Cyber Attacks on Industrial Systems Rise Amid Evolving Threat Landscape

Kaspersky ICS CERT reported about 40 incidents targeting industrial organizations in Q2 2026, primarily involving phishing and ransomware. A notable incident involved an Israeli food producer where an attacker exploited knowledge of refrigeration systems, resulting in the destruction of compressors.

In contrast, Darktrace identified ZionSiphon malware aimed at Israeli water facilities, which failed due to a logic error. Meanwhile, an unidentified actor breached multiple Mexican government entities, escalating an intrusion attempt against an operational technology interface using AI-generated scripts.

Additionally, CISA is monitoring Iranian-affiliated groups targeting US programmable logic controllers. The disparity in domain knowledge among attackers continues to be a key factor in the effectiveness of cyber-physical attacks, posing ongoing risks to industrial operations.