In Q2 of 2026, the percentage of Industrial Control Systems (ICS) computers on which malicious objects were blocked continued to decrease but, at the same time, the percentage of these computers targeted by ransomware increased across almost every global region.
This is according to the latest Kaspersky ICS CERT report, which says that the top regions by the number of ICS computers attacked by ransomware were Africa, the Middle East, Central Asia and South Caucasus, East Asia, Southern Europe, and South Asia.
The most notable increases in the number of ICS machines attacked by ransomware from Q1 to Q2 2026 were observed in Africa (a 31% increase), the Middle East (11%), Central Asia (31%), Southeast Asia (50%), South America (38%), and Australia and New Zealand (67%). The only exceptions to this rising trend were Western Europe, Southern Europe, and Canada.
“Ransomware remains a challenge for industrial enterprises, with its operational dynamics increasingly shifting toward highly evasion-prone tactics while exploiting legitimate administrative tools to blend in with normal network traffic,” says Evgeny Goncharov, head of Kaspersky ICS CERT. “As we have previously mentioned, with legacy operational systems deeply embedded in critical infrastructure, a single localised failure can paralyse entire supply chains and trigger catastrophic physical shutoffs. While ransomware operators rely on these critical operational halts to leverage massive payouts, it is vital that targeted organisations refuse to pay the ransom and instead reinvest those resources into proactive, dedicated security solutions and robust containment procedures that protect their environments from future compromise.”
In terms of all recorded threats (not just ransomware), the biometrics sector remained the most targeted industry globally, with malicious objects blocked on 26% of its ICS computers during the second quarter – which is slightly more than in the first quarter.
Biometrics systems are characterised by the availability of Internet access, extensive email use and, in many cases, minimal cybersecurity controls within the organisations that use these systems.
Regionally, Southern Europe led the ranking based on the percentage figures for biometrics, with malicious objects blocked on 33% of ICS computers, followed by Africa and Central Asia.