Threat landscape for industrial automation systems in Q4 2024

In Q4 2024, Kaspersky ICS CERT reported that 21.9% of ICS computers had malicious objects blocked (down 0.1 pp QoQ and 2.8 pp YoY), with October highest and November the lowest in two years; regionally, blocks ranged from 10.6% in Northern Europe to 31% in Africa, and the biometrics sector led industries. Threats from internet, email, and removable media declined to period lows, while within categories, denylisted resources and malicious documents fell (to 5.52% and 1.71%), but malicious scripts/phishing rose to 7.11%, spyware to 4.30%, and ransomware to 0.21% (two-year high); worms and viruses increased to 1.37% and 1.61%, miners decreased (Windows executables to 0.70% and web miners to 0.39%), and AutoCAD malware dropped to 0.38%.