Email-Borne Worm Surge Drives New Threat Wave Across Industrial Control Systems

A sudden, global Q4 2025 outbreak of a backdoor worm called Backdoor.MSIL.XWorm propagated via phishing emails disguised as job applications (Curriculum-vitae-catalina), infecting industrial control system (ICS) environments across all regions within two months; the report details infection mechanics, regional infection rates (notably high in Southern Europe, South America, the Middle East, and Africa), use of obfuscation to evade detection, removable-media spread in Africa, and defensive recommendations such as blocking executable email attachments, tightening removable media policies, focused HR training, and deploying behavior-based detection on ICS endpoints.