Threat landscape for industrial automation systems. Europe, Q4 2025

Related tags

biometrics

buildings automation

construction

malware

manufacturing

miners

phishing

ransomware

spyware

statistics

Southern Europe

Key cybersecurity issues in the region

High risk of targeted attacks

High levels of email threats (phishing) and spyware clearly indicate that industrial systems in the region are highly exposed to advanced attackers.

Threats from email are relevant for all industries of the region, foremost for biometrics and building automation. Attacks on computers in these industrial automation sectors significantly raise the risk of supply-chain attacks on other industries.

Southern Europe led all regions in the percentage of ICS computers on which threats from email clients were blocked — 2.3 times higher than the global average.

It also led the ranking of regions in the percentage of ICS computers on which malicious documents were blocked – 2.2 times higher than the global average.

Attackers distribute malicious documents in phishing emails and use them as an initial infection vector. Typically, such documents contain exploits, malicious macros, or harmful links.

High rate of malicious scripts and phishing pages

Likewise, the large percentage of malicious scripts and phishing pages further demonstrates the high risk of targeted attacks against the technological infrastructures of industrial enterprises in the region. Many of these scripts and pages are aimed directly at stealing authentication data for corporate services.

By percentage of ICS computers on which malicious scripts and phishing pages were blocked, Southern Europe ranked fourth among regions globally, with a rate 1.4 times the global average.

Malicious scripts are used by attackers for a wide range of purposes — from data collection, tracking, and redirecting the user’s browser to malicious web resources, to downloading various malware into the system or browser (such as spyware, cryptominers, and ransomware). They are distributed both via the internet and through spam emails.

High rate of spyware

By the percentage of ICS computers on which spyware was blocked, Southern Europe ranked third, with a rate 1.3 times higher than the global average.

Spyware is used by attackers to steal confidential data. In targeted attacks, it is also used for lateral movement within compromised networks and for downloading final-stage malware. In some cases, spyware infections end with ransomware being deployed.

High ransomware rate

In terms of the percentage of ICS computers on which ransomware was blocked, Southern Europe ranked third with a figure that was 1.8 times above the global average.

The percentage of ICS computers on which ransomware was blocked in the region increased by a factor of 1.47. During the quarter, this figure grew in five regions, with Southern Europe recording the most growth. This high position was driven by Greece, where the percentage of ICS computers on which ransomware was blocked increased by a factor of 3.6.

Threat of the quarter

In Q4 2025, email became a channel for spreading phishing messages during the latest wave of phishing campaigns known as Curriculum-vitae-catalina. These emails, disguised as a resume, contained a malicious executable file, the remote administration backdoor worm known as Backdoor.MSIL.XWorm. As a result, the figure for worms increased across all regions. Southern Europe led all other regions in terms of the growth in this metric.

The figure for worms increased across all surveyed industries in the region, but most of all in the building automation industry (by a factor of 2.96) and the construction industry (by a factor of 2.60).

Statistics across all threats

In Q4 2025, Southern Europe ranked eighth globally in the percentage of ICS computers on which malicious objects were blocked. The figure for Southern Europe was the highest among all regions in Europe.

This figure for the region increased to 18.8%. This was below the global average but still 2.2 times higher than in Northern Europe, the lowest-ranked region.

Southern Europe was one of four regions where the percentage of ICS computers on which malicious objects were blocked increased in Q4 2025. The region ranked first in terms of this increase.

Among the region’s countries, Greece led in the percentage of ICS computers on which malicious objects were blocked, at 24.97%. Malta had the lowest figure at 10.96%.

Threat sources

Southern Europe ranked first globally in the percentage of ICS computers on which threats form email clients were blocked. The rate for the region (6.34%) was 2.3 times higher than the global average.

The internet was another threat source that ranked above the global average. The figures for all other threat sources in Southern Europe were below the global averages.

The main malware distribution channels in the region were the internet and email.

In Q4 2025, the region saw the figures for internet threats and removable drive threats increase.

Internet

In terms of the percentage of ICS computers on which internet threats were blocked, Southern Europe rose from eighth to fifth place globally in Q4 2025. The figure for the region, at 8.00%, was twice as high as that for Northern Europe, which had the lowest figure among regions.

The figures increased across all countries in the region except for North Macedonia and Cyprus, ranging between 3.45% in Cyprus and 9.24% in Greece.

The main categories of internet threats blocked on ICS computers in the region were denylisted internet resources and malicious scripts and phishing pages.

Email clients

By percentage of ICS computers on which threats from email clients were blocked, Southern Europe led globally, with 6.34% in Q4 2025. This was 9.9 times higher than in Northern Europe, which ranked last.

The percentage of ICS computers on which threats from email clients were blocked in Southern Europe has declined for two consecutive quarters.

Among countries in the region, Greece led with 11.68% in the percentage of ICS computers on which threats from email clients were blocked. The lowest figure observed was in Malta at 3.51%.

The main categories of email threats blocked on ICS computers were malicious scripts and phishing pages, spyware, and malicious documents.

Based on the percentage of ICS computers on which malicious documents were blocked, Southern Europe ranked first globally.

Q4 2025 saw a noticeable increase in the percentage of ICS computers on which worms from mail clients were blocked. This was connected associated with the latest wave of phishing campaigns known as Curriculum-vitae-catalina, which launched attacks across all regions of the world.

The attackers distributed phishing emails disguised as job applications. Disguised as a resume (Curriculum Vitae), these emails contained a malicious executable file, a remote administration backdoor worm known as Backdoor.MSIL.XWorm. Running that file caused system infection.

Normally, these campaigns are designed to deliver malware for data theft, spyware, or remote administration tools (RATs).

In Southern Europe, these attacks peaked in November. The figure for worms increased across all regions, with Southern Europe taking the top spot in terms of the growth for this metric.

Removable media

In terms of the percentage of ICS computers on which threats from removable media were blocked, Southern Europe ranked ninth among regions in Q4 2025 at 0.10%. This figure was 2.0 times higher than in the Australia and New Zealand region, which ranked last.

Southern Europe was one of three regions where the figure grew during the quarter.

Within the region, North Macedonia was the leader with 0.34%.

The main categories of threats that were blocked when connecting removable media to ICS computers were worms, spyware, malicious scripts and phishing pages, and viruses.

Threat categories

Compared to the global averages, Southern Europe had higher percentages of ICS computers with the following categories of threats blocked:

Malicious documents: 2.2 times higher, or first among regions by the percentage of ICS computers on which this threat was blocked.
Malicious scripts and phishing pages: 1.4 times higher.
Spyware: 1.3 times higher, or third among regions by the percentage of ICS computers on which this threat was blocked.
Ransomware: 1.8 times higher (third globally).
Worms: 1.1 times higher.

Attackers use malicious scripts, phishing pages, and malicious documents to deliver targeted malware, including spyware and ransomware.

Malicious documents

Southern Europe ranked first among regions by the percentage of ICS computers on which malicious documents were blocked, at 3.82%. This figure was 8.3 times above that for Northern Europe, which had the lowest percentage among all regions.

The percentage of ICS computers on which malicious documents were blocked in the region has declined for two consecutive quarters.

Among the region’s countries, Greece led by the percentage of ICS computers on which malicious documents were blocked, at 8.92%.

Malicious documents were distributed primarily via email.

Malicious scripts and phishing pages

In terms of the percentage of ICS computers on which malicious scripts and phishing pages were blocked, Southern Europe ranked fourth, at 8.92%. This was 3.5 times above Northern Europe, which had the lowest figure.

Among the region’s countries, Greece led by the percentage of ICS computers on which malicious scripts and phishing pages were blocked, at 13.77%.

Malicious scripts and phishing pages spread both via the internet and through email.

Spyware

Based on the percentage of ICS computers on which spyware was blocked, Southern Europe ranked third globally, behind only Africa and Southeast Asia.

The percentage of ICS computers in Southern Europe where spyware was blocked fluctuates over time. In Q4 2025, it dropped to 5.12%. This was a three-year low for the region, but it was still 4.1 times above the figure for Northern Europe, which was last among regions.

Among the region’s countries, Greece led by the percentage of ICS computers on which spyware was blocked, at 8.12%.

The main source of spyware in the region is email, though it is also encountered on the internet. You may recall that Southern Europe led the global ranking in the percentage of ICS computers on which threats from email clients were blocked.

Ransomware

In terms of the percentage of ICS computers on which ransomware was blocked, Southern Europe rose from fifth to third place globally.

At 0.28%, the region’s figure was 5.6 times above that for Northern Europe, which ranked last.

The percentage of ICS computers on which ransomware was blocked fluctuates in the region. It grew by a factor of 1.47 in Q4 2025; Southern Europe led all other regions in terms of the growth for this metric.

Among the region’s countries, Greece, at 1.03%, led by a wide margin in terms of the percentage of ICS computers on which ransomware was blocked. In this country, the figure for the quarter increased by a factor of 3.6.

Worms

In terms of the percentage of ICS computers on which worms were blocked, Southern Europe ranked sixth globally at 1.77%. This was 5.5 times above the figure for Northern Europe, which ranked last.

In Q4 2025, the worm metric grew across all regions due to the latest wave of phishing campaigns known as Curriculum-vitae-catalina which we described earlier.

In Southern Europe, the percentage of ICS computers on which worms were blocked increased by a factor of 2.16. As a result, the region was the leader in terms of worms.

The percentage of ICS computers on which worms were blocked during the quarter grew significantly across all countries in the region. North Macedonia led with 5.44%.

In Q4 2025, worms were spread over email during a phishing attack.

Industries

In Southern Europe, of all the industries surveyed for the report, malicious objects were most often blocked in biometrics.

Southern Europe led among regions in terms of biometrics.

In Southern Europe, the percentage of ICS computers on which malicious objects were blocked was above the global average in biometrics (by a factor of 1.2) and in the building automation industry (by a factor of 1.1).

In Q4 2025, the percentage of ICS computers on which malicious objects were blocked increased across all of the surveyed industries except for biometrics.

The observed changes in the percentage of ICS computers on which malicious objects were blocked across all of the surveyed industries exhibited a tendency to fluctuate. The figures for biometrics and building automation significantly exceeded the regional average.

Threat sources and malware categories in industries: ‘hotspots’

We use heat maps when assessing threats to industries in the regions. The color on the heatmap indicates the position in the global industry rankings across regions for each individual threat category or source. Red signifies that the figure is close to the maximum.

Threat source figures for industries in Southern Europe, Q4 2025

Threat category figures for industries in Southern Europe, Q4 2025

Characteristics of the region

Southern Europe ranked first globally by percentage of ICS computers on which threats from email clients were blocked. Email clients are a pertinent source of threats for all industries in the region.

In the percentage of ICS computers on which threats from email clients were blocked in different industries, Southern Europe had the following global rankings:

First in biometrics, building automation, construction, and engineering and ICS integrators industry.
Third in the manufacturing industry.
Fourth place in the electrical energy industry.

The high figures for threats spread by email clients (phishing) and spyware clearly pointed to a significant exposure of the region’s OT systems to advanced attackers.

The risk of targeted attacks was relevant for all industries in the region, to a lesser extent for the electrical energy industry and to a greater extent for biometrics and building automation systems. Attacks on computers in these industrial automation sectors significantly raise the risk of supply-chain attacks on other industries.

In terms of the percentage of ICS computers on which malicious documents were blocked across various industries, Southern Europe ranked as follows:

First in biometrics, building automation, and the engineering and ICS integrators industry.

Second in the construction industry.
Third in the manufacturing industry.

In terms of the percentage of ICS computers on which spyware was blocked across various industries, Southern Europe ranked as follows:

First in biometrics and building automation.
Fourth in the construction industry and manufacturing industry.

Southern Europe ranked third among regions in terms of the percentage of ICS computers on which ransomware was blocked. Southern Europe ranked as follows for this figure across various industries:

First in the building automation industry.
Third in the engineering and ICS integrators industry.

Biometrics

Southern Europe ranked first among regions in the percentage of ICS computers on which malicious objects were blocked in biometrics.

Based on indicators for biometrics among regions, Southern Europe had the following rankings:

First by percentage of ICS computers on which threats from email clients were blocked.
Third for internet threats.
First for the percentage of ICS computers on which malicious documents, malicious scripts and phishing pages, and spyware were blocked.
Second for worms.

The regional industry rankings for biometrics was as follows:

First by percentage of ICS computers on which threats from email clients were blocked.
Third for internet threats.
First in the following threat categories: denylisted internet resources, malicious scripts and phishing pages, malicious documents, spyware, and worms.
Second for ransomware, viruses, and both categories of miners.

Building automation

Southern Europe was third among regions in terms of the percentage of ICS computers on which malicious objects were blocked in the building automation industry.

Based on industry indicators among regions, Southern Europe had the following rankings:

First by percentage of ICS computers on which threats from email clients were blocked.
Third for internet threats.
First by the percentage of ICS computers on which the following categories of threats were blocked: malicious documents, malicious scripts and phishing pages, spyware, ransomware, and worms.

Among industries in the region, the building automation industry had the following rankings:

First by the percentage of ICS computers on which internet threats were blocked.
Second place in the percentage of ICS computers on which threats from email clients and network folders were blocked.
First by the percentage of ICS computers on which ransomware was blocked.
Second in the following threat categories: denylisted internet resources, malicious scripts and phishing pages, malicious documents, spyware, and worms.
Third place in viruses.

Construction

Southern Europe was seventh among regions in the percentage of ICS computers on which malicious objects were blocked in the construction industry.

Based on industry indicators among regions, Southern Europe had the following rankings:

First by percentage of ICS computers on which threats from email clients were blocked.
Third by the metric for network folders.
Second place in the percentage of ICS computers on which malicious documents were blocked.

In the regional cross-industry rankings, the construction sector ranked:

First for the percentage of ICS computers on which threats from network folders were blocked.
Second place in internet threats.
Third for threats from email clients.
First by the percentage of ICS computers on which viruses, malware for AutoCAD, and both categories of miners were blocked.
Third in the following threat categories: denylisted internet resources, malicious scripts and phishing pages, malicious documents, and spyware.

Engineering and ICS integrators

Southern Europe was 10th among regions in the percentage of ICS computers on which malicious objects were blocked in the engineering and ICS integrators industry.

Based on the engineering and ICS integrators industry indicators among regions, Southern Europe had the following rankings:

First by percentage of ICS computers on which threats from email clients were blocked.
First in the percentage of ICS computers on which malicious documents were blocked.
Third place in ransomware.

In the regional cross-industry rankings, engineering and ICS integrators had the following rankings:

Third by the percentage of ICS computers on which threats from removable media were blocked.
Second in terms of malware for AutoCAD.
Third place in ransomware.

Electric power

Southern Europe was 10th among regions in the percentage of ICS computers on which malicious objects were blocked in the electrical energy industry.

In the regional cross-industry rankings, the electrical energy industry ranked:

Second in the percentage of ICS computers on which threats from removable media are blocked.
Third by the metric for network folders.
Third in both categories of miners and malware for AutoCAD.

Manufacturing

Southern Europe was seventh among regions by the percentage of ICS computers on which malicious objects were blocked in the manufacturing industry.

Based on industry indicators among regions, Southern Europe had the following rankings:

Third by the percentage of ICS computers on which email client threats were blocked.
Third place in the percentage of ICS computers on which malicious documents were blocked.

In the regional cross-industry rankings, the manufacturing sector ranked:

First by the percentage of ICS computers on which threats were blocked when connecting removable media.
Third by the percentage of ICS computers on which worms were blocked.

Eastern Europe

Key cybersecurity issues in the region

Eastern Europe ranked ninth globally by the percentage of ICS computers on which malicious objects were blocked. Eastern Europe ranked second for this metric among the European regions.

Eastern Europe had high rankings among all regions in the following threat categories:

Third in malicious documents.
Third in miners in the form of executable files for Windows.
Fourth for worms.
Fifth in denylisted internet resources.
Sixth for spyware.
Sixth in web miners.

Among the threat sources, email clients ranked the highest at sixth place.

High risk of targeted attacks

High levels of email threats (phishing) and spyware clearly indicate that industrial systems in the region are highly exposed to advanced attackers.

In Eastern Europe, the percentage of ICS computers on which threats from email clients were blocked was 1.3 times higher than the global average.

The percentage of ICS computers on which malicious documents were blocked exceeded the global average by 1.5 times. Based on the metric for malicious documents, Eastern Europe came third among all the regions. This was the region’s highest position in the rankings, both by source and by threat category.

Attackers distribute malicious documents in phishing emails and use them as an initial infection vector. Typically, such documents contain exploits, malicious macros, or harmful links.

Based on the metrics for malicious documents in the building automation industry, Eastern Europe was second in the corresponding regional rankings, while it ranked third in the engineering and ICS integrators industry.

In Eastern Europe in Q4 2025, the percentage of ICS computers on which malicious scripts and phishing pages were blocked was slightly below the global average.

High rate of spyware

The percentage of ICS computers on which spyware was blocked in Eastern Europe was relatively stable, slightly higher than the global average in Q4 2025. Spyware is used by attackers to steal confidential data. In targeted attacks, it is also used for lateral movement within compromised networks and for deploying final-stage malware.

Based on the percentage of ICS computers on which spyware was blocked in the building automation industry, Eastern Europe ranked fourth globally.

High figure for miners in the form of executable files for Windows

In Q4 2025, Eastern Europe ranked third among regions based on the percentage of ICS computers on which miners in the form of executable files for Windows were blocked.

In Eastern Europe, miners in the form of executable files for Windows actively use modules and components that are essentially worms and deliver the miner to other computers in the network (automated lateral movement).

Eastern Europe ranked third among regions based on the metrics for executable miners in the building automation, construction and electric power industries, and fourth in the engineering and ICS integrators industry.

Industries

The threat of targeted attacks in the region is especially relevant for the building automation industry. Eastern Europe ranked second among regions based on the metrics for email client threats and malicious documents in this industry, and fourth for spyware.

Among industries located in Eastern Europe, the building automation industry led in terms of the metrics for all threat sources, and for malicious scripts, malicious documents, and spyware.

Note the high figure for ransomware in the manufacturing industry. Based on the metric for ransomware in the manufacturing industry, Eastern Europe ranked third among all regions. Manufacturing topped the regional rankings of industries in terms of this metric.

Statistics across all threats

In Q4 2025, Eastern Europe ranked ninth globally in the percentage of ICS computers on which malicious objects were blocked.

The indicator in the region decreased to 18.1%, the lowest value for three years. It was slightly lower than the global average and 2.1 times higher than in Northern Europe, which had the lowest rate among all regions.

Among the region’s countries, Bosnia and Herzegovina led in this metric with 26.68%. The lowest figure was in Poland – 10.60%. Over the quarter, the figure grew only in Ukraine, Montenegro, and Czechia.

Threat sources

With the exception of email clients, all threat source rates in Eastern Europe were below the global average.

The percentage of ICS computers on which threats from email clients were blocked was 1.3 times higher than the global average.

Malicious objects in the region spread primarily via the internet and email. The figures decreased for all threat sources across the region in Q4 2025.

Internet

Based on the percentage of ICS computers on which internet threats were blocked, Eastern Europe ranked eighth globally at 6.92%, which was 1.7 times higher than the lowest figure (Northern Europe).

Country-level rates ranged from 4.24% in Croatia to 9.60% in Bosnia and Herzegovina.

The main categories of internet threats that were blocked on ICS computers in the region included malicious scripts and phishing pages, as well as denylisted internet resources.

Based on the indicator for denylisted internet resources, Eastern Europe ranked fifth in the corresponding ranking of regions.

Email clients

By percentage of ICS computers on which threats from email clients were blocked, Eastern Europe ranked sixth globally in Q4 2025, at 3.69%. This was 5.8 times higher than in Northern Europe, which ranked last.

Among countries in the region, Bosnia and Herzegovina (13.42%) led all other countries by a wide margin in the percentage of ICS computers on which threats from email clients were blocked. The lowest figure observed was in Ukraine at 0.29%.

The main categories of mail client threats that were blocked on ICS computers in the region were malicious scripts and phishing pages, malicious documents, and spyware.

Q4 2025 saw a noticeable increase in the percentage of ICS computers on which worms from email clients were blocked. This was connected with the latest wave of phishing campaigns known as Curriculum-vitae-catalina, which launched attacks across all regions of the world. In Eastern Europe, these attacks peaked in November.

The hackers distributed phishing emails disguised as job applications. Disguised as a resume (Curriculum Vitae), these emails contained a malicious executable file, a remote administration backdoor worm known as Backdoor.MSIL.XWorm. Running that file caused system infection.

Normally, these campaigns are designed to deliver malware for data theft, spyware, or remote administration tools (RATs).

In terms of growth in the worm rate, the region was third.

Removable media

In terms of ICS computers on which threats were blocked when connecting removable media, Eastern Europe ranked seventh globally in Q4 2025, at 0.19%. This was 3.8 times higher than in the Australia and New Zealand region, which ranked last in the corresponding ranking.

Among the countries in the region, Bulgaria led in the percentage of ICS computers on which threats were blocked upon connecting removable media, with 0.47%.

The main categories of removable media threats blocked on ICS computers in the region were worms, spyware, and viruses.

Network folders

Eastern Europe fell from fifth to eighth place in the rankings of regions in the percentage of ICS computers on which threats from network folders were blocked.

After growing in the previous quarter, the figure for network folders across the region dropped to 0.02%. This was 3.1 times higher than in Northern Europe, which ranked last.

In a protected infrastructure, threats from network folders are encountered fairly rarely and not in all of the region’s countries. The same is true for industries. Network folder threats were only detected in two industries: building automation, and engineering and ICS integrators.

Among countries in the region, Slovenia led in the percentage of ICS computers on which threats from network folders were blocked with a figure of 0.07%.

In Q4 2025, the prevalent type of threat that spread through network folders was worms.

Threat categories

Compared to the global averages, the region had a higher percentage of ICS computers with the following categories of blocked threats:

Malicious documents: 1.5 times higher (third among regions by the percentage of ICS computers on which the threat was blocked).
Worms: 1.3 times higher (fourth globally).
Spyware.

In terms of miners in the form of executable files, Eastern Europe ranked third among regions. The figure for the region was slightly below the global average.

In the region, the figures for all threat categories except worms, malicious documents, and executable miners decreased over the quarter. Eastern Europe led among regions in terms of the growth in malicious documents.

Malicious scripts and phishing pages

Malicious scripts and phishing pages led the regional rankings for threat categories based on the percentage of ICS computers on which they were blocked.

Based on the percentage of ICS computers on which malicious scripts and phishing pages were blocked in Q4 2025, Eastern Europe ranked seventh globally with 6.47%. This was 2.6 times higher than Northern Europe, which had the lowest rate.

Among countries in the region, Bosnia and Herzegovina led in this metric with 14.27%. This was 2.2 times higher than the regional figure for this threat.

Malicious scripts and phishing pages spread both via the internet and through email.

Spyware

By the percentage of ICS computers on which spyware was blocked, Eastern Europe ranked sixth globally with 3.95%. This figure was 3.2 times higher than in Northern Europe, which had the lowest rate.

The percentage of ICS computers in Eastern Europe on which spyware was blocked fluctuates over time. In Q4 2025, this figure reached a three-year low.

Among the region’s countries, Bosnia and Herzegovina led significantly in the percentage of ICS computers on which spyware was blocked, with 10.07%. The lowest figure was in Albania – 1.74%. The only country where the figure increased over the quarter was Ukraine.

Spyware was blocked in the region across all threat sources, primarily in email clients.

Denylisted internet resources

By percentage of ICS computers on which denylisted internet resources were blocked, Eastern Europe ranked fifth globally with 2.95%. This figure was 1.7 times higher than in Northern Europe, which had the lowest rate.

The percentage of ICS computers on which denylisted internet resources were blocked is decreasing in Eastern Europe just as it is decreasing globally. Nevertheless, threats in this category ranked third in the regional rankings.

Among countries of the region, Ukraine led with 4.05% in the percentage of ICS computers on which denylisted internet resources were blocked. The lowest figure was in Romania – 1.55%. Over the quarter, this indicator decreased in all countries except Bosnia and Herzegovina.

Malicious documents

Based on the percentage of ICS computers on which malicious documents were blocked in Q4 2025, Eastern Europe rose from fifth to third place globally.

The rate increased by 2.72%, which was 5.9 times higher than in Northern Europe, which ranked last. Eastern Europe led among regions in terms of the growth in malicious documents.

Note that in 2025, the percentage of ICS computers on which malicious documents were blocked over the quarter in Eastern Europe was above the level of the previous 18 months.

Among countries in the region, Bosnia and Herzegovina led with 9.35%. Ukraine was last in the ranking with 0.43%.

Malicious documents are distributed primarily via email.

Malicious documents are often used by attackers to deliver targeted malware – including spyware.

Worms

By the percentage of ICS computers on which worms were blocked, Eastern Europe rose from sixth to fourth place globally, with 2.06%. The region’s figure was 6.4 times higher than in Northern Europe, which ranked last.

In Q4 2025, the worm metric grew across all regions due to the global phishing campaign known as Curriculum-vitae-catalina which we described earlier. Eastern Europe ranked third among regions in terms of growth in this metric.

Among countries in the region, Belarus led with 3.54% in the percentage of ICS computers on which worms were blocked. This figure grew across all countries except Albania and Montenegro.

In Q4 2025, email became the main distribution channel for worms due to a phishing attack.

Miners in the form of executable files for Windows

For miners in the form of executable files for Windows, the region ranked third, with 0.59%. This figure was slightly below the global average and 4.2 times higher than in North America (Canada), which had the lowest figure among regions.

Belarus and Ukraine also led among the region’s countries in terms of miners in the form of executable files for Windows with 1.20% and 1.08%, respectively.

Among industries in the region, this threat was especially relevant for the building automation and electric power sectors.

Industries

Of the region’s industries considered in this report, building automation was the most frequently targeted. Eastern Europe was one of three regions where the electric power industry came second in the regional rankings of industries. This industry ranked first only in East Asia, while its rankings in all other regions are lower.

All industries showed indicators lower than the global averages.

The building automation industry was the only industry in the region where this indicator increased in Q4 2025.

The trends for the majority of industries under review suggest stabilization after significant growth in 2022. The figures for the construction industry and the engineering and ICS integrators industry are gradually decreasing.

Threat sources and malware categories in industries: ‘hotspots’

Threat source indicators for industries in Eastern Europe, Q4 2025

Threat category indicators for industries in Eastern Europe, Q4 2025

The high risk of targeted attacks against the technological infrastructures of industrial enterprises is demonstrated by the high indicators for threats that are propagated via email clients (phishing), spyware, and malicious scripts and phishing pages.

The building automation industry’s indicators show all the signs of high exposure to advanced categories of threat actors. The figure for email client threats was also high in the construction industry.

Eastern Europe ranked second among regions based on the figure for email clients in both the building automation industry and the construction industry.

Based on the metric for ransomware in the manufacturing industry, Eastern Europe ranked third among all regions. Manufacturing topped the regional rankings of industries in terms of this metric.

Eastern Europe ranked third among regions in terms of executable miners in the building automation industry, construction industry, and electric power industry.

Building automation

Eastern Europe ranked seventh globally in the percentage of ICS computers on which malicious objects were blocked in the building automation industry.