Hackers are stepping up their attacks on Industrial Control Systems (ICS) in the first quarter of 2025, employing an arsenal of 11,679 different malware families. This is a worrying development for industrial cybersecurity.
According to a Kaspersky security solutions Report, the persistence of cyber threats targeting operational technology (OT) infrastructures remains a critical issue.
While the overall percentage of ICS computers on which malicious objects were blocked held steady at 21.9% from Q4 2024 to Q1 2025, a year-over-year decline of 2.5 percentage points compared to Q1 2024 indicates a long-term downward trend.
However, this stability masks a surge in specific threat categories and regional disparities, with Africa reporting the highest affected rate at 29.6% and Northern Europe the lowest at 10.7%.
The internet and email continue to be the primary vectors for these attacks, delivering malicious scripts, phishing pages, and documents that often serve as droppers for next-stage malware like spyware, ransomware, and crypto miners.
Rising Threats in ICS Environments
Delving deeper into the technical landscape, the data underscores a notable shift in attacker strategies.
The percentage of ICS computers targeted by internet-based threats and email clients saw an uptick in Q1 2025, marking the first increase since late 2023.
Malicious scripts and phishing pages emerged as the leading initial infection method, correlating strongly with rises in spyware detections, while web miners and malicious documents also saw significant proportional increases-1.4 times and 1.1 times higher than the previous quarter, respectively.
Conversely, the blocking of denylisted internet resources dropped to its lowest since 2022, partly due to attackers leveraging legitimate services like content delivery networks (CDNs) and cloud storage to evade reputation-based defenses.
This evasion tactic complicates traditional security measures, prompting experts to advocate for policy-based blocking of such services in OT networks where their use is often unnecessary.
Evolving Attack Vectors
Among industries, the biometrics sector stands out as the most targeted, being the only OT infrastructure type to report an increase in affected ICS computers, despite a broader downward trend.
Regionally, variations in threat exposure highlight the need for tailored defenses, with six of 13 surveyed regions noting quarterly increases, Russia experiencing the most significant spike.
Meanwhile, next-stage malware trends show mixed outcomes spyware and ransomware detections dipped slightly to 4.20% and 0.16%, respectively, while miners, particularly web miners, surged to 0.53%, the highest since Q3 2023.
Self-propagating malware like worms and viruses saw declines, but their persistence via removable media and outdated software vulnerabilities remains a concern.
The sheer diversity of threats, coupled with attackers’ multi-stage tactics exploiting security flaws for lateral movement within OT networks, underscores the urgency for industrial organizations to bolster their cybersecurity frameworks.
As malicious actors adapt, leveraging legitimate platforms and refining techniques, the industrial sector must prioritize advanced detection, proactive mitigation, and stringent access controls to safeguard critical automation systems from this evolving digital onslaught.
Find this News Interesting! Follow us on Google News, LinkedIn, & X to Get Instant Updates!
