In a nutshell: Kaspersky data shows a doubling of ransomware incidents on Austrian ICS systems in Q4 2025, primarily distributed via phishing emails with malicious documents.
The Kaspersky report for Q4 2025 documents an increase in attacks on industrial control systems in Western Europe. Austria recorded the strongest growth among all Western European countries in blocked ransomware on ICS systems, indicating targeted attack campaigns.
According to the latest Kaspersky report on the threat landscape of industrial automation systems, Austria was particularly hard hit in the fourth quarter of 2025. The share of ICS computers on which ransomware was blocked rose by a factor of 2.71. Malicious documents were detected 1.49 times more frequently, malicious scripts and phishing sites 1.35 times. These growth rates significantly exceed those of all other Western European countries.
Email has established itself as the primary attack vector. Austria leads the region with 2.28 percent of threats distributed via email clients and recorded an increase by a factor of 1.34. Kaspersky identified the phishing campaign “Curriculum-vitae-catalina” as the main cause: attackers sent emails disguised as application letters containing the Backdoor.MSIL.XWorm backdoor worm. The campaign peaked in October 2025.
Germany and Switzerland show different threat patterns. Germany has the highest share of blocked malicious documents at 0.91 percent and ranks alongside France in spyware share (1.17 percent). In Switzerland, only the share of blocked spyware on ICS systems increased.
Kaspersky recommends multi-layered measures to protect industrial systems: dedicated security solutions for operational technology (OT) and IT networks, consistent inspection of incoming emails, regular employee awareness training, patch management, multi-factor authentication, and strict network segmentation between IT and OT environments.
Source: www.it-daily.net · Published June 8, 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrase and classification by Lumi News Pipeline v1.6.5.