Malicious objects of all types were detected and blocked on 34 percent of Industrial Control System (ICS) computers in the first half of 2023, according to the ICS CERT landscape report by Kaspersky. The second quarter of 2023 saw the highest quarterly level of threats globally since 2019, with 26.8 percent of ICS computers affected. One of the findings highlights a trend showing high-income countries are experiencing rise in cyber threat detections.
In the first half of 2023, Kaspersky’s security solutions blocked 11,727 different malware families in industrial systems. Out of all categories, only one showed growth in H1 2023: denylisted internet resources (11.3%). This marks the second consecutive half-year of increased threat activity in this category. Denylisted internet resources were the leading threat category until 2022, when they were overtaken by malicious scripts and phishing pages. These elements remain the most prevalent threats (12.7%), although their percentages have been increasingly converging.
In H1 2023, traditionally safer regions experienced unexpected shifts. Australia and New Zealand, the United States and Canada, Western Europe, and Northern Europe, typically characterized by lower threat levels, witnessed increases in attacked ICS computers proportions during this time period.
Percentage of ICS computers on which malicious objects were blocked in selected regions
Despite these increases, it’s crucial to emphasize that these regions still maintain relatively low threat percentages when compared to others. The rise in threats can be primarily attributed to the blocking of denylisted internet resources and malicious scripts, commonly delivered via the internet and email. Additionally, spyware detection showed considerable growth in these areas.
Regarding global figures, threat percentages varied significantly by region, with Africa experiencing the highest incidence at 40.3 percent, while Northern Europe reported the lowest at 14.7 percent. Notably, Ethiopia faced the highest threat percentage by country at 53.3 percent, while Luxembourg reported the lowest, at 7.4 percent.
Building automation remained the industry most exposed to cyber threats, accounting for 38.5 percent of computers attacked. However, the energy, oil and gas industries experienced opposite trends since 2021. Energy saw an increase of 36 percent in threats, while the oil and gas sector experienced a decrease, accounting for 30.8 percent.
In addition, engineering, ICS integration, manufacture, and energy sectors showed an overall increase in the percentage of ICS computers on which malicious objects were blocked in H1 2023.
Percentage of ICS computers on which malicious objects were blocked in selected industries
“For industrial enterprises cybersecurity is now about safeguarding investments and ensuring the resilience of key assets. The findings from our analysis of attacks on the industrial sector reveal crucial insights into evolving threat landscapes in various industries. By understanding these risks, organizations can make informed decisions, allocate resources wisely, and efficiently fortify their defenses. In doing so, they not only protect their bottom line but also contribute to a safer and more secure digital ecosystem for all,” comments Evgeny Goncharov, head of Kaspersky ICS CERT.
