Threat landscape for industrial automation systems. Q2 2026

Kaspersky Securelist Q2 2026 reporting describes threats affecting industrial control systems, vulnerabilities and exploits including AI frameworks, Android head-unit malware forming an ad-serving proxy botnet, a HoneyMyte CoolClient kernel-level rootkit, Armored Likho espionage malware, Head Mare exploitation of unpatched TrueConf servers, Project CAV3RN C2 via Google Apps Script and DNS, broader PC/mobile/IoT malware trends, and cloud-hosted adversary-in-the-middle phishing used to bypass MFA. The collection spans espionage, persistence, defense evasion, botnets, ransomware, exploitation, C2