Threat landscape for industrial automation systems. Q2 2026
2026-08-30T20:51:46Z•555915bafa8ccef718870fbacba081ae9aa00123a8a6550c5221b773b0df4c5c
AI-securityAPTAndroid-malwareArmored-LikhoC2CoolClientDNS-C2Google-Apps-ScriptHead-MareHoneyMyteICSPhantomCorePhantomGraphTelegram-stealingTrueConfevasionexploitsindustrial-control-systemskernel-rootkitmalwarephishing-as-a-serviceอ-MFA-bypassproxy-botnetransomwarethreat-intelligencevulnerabilities
What happened
Kaspersky Securelist Q2 2026 and August 2026 reporting covering industrial-control-system threats, vulnerabilities and exploits including AI frameworks, Android head-unit adware and proxy botnets, HoneyMyte’s CoolClient kernel rootkit, Armored Likho espionage malware, Head Mare exploitation of unpatched TrueConf servers, Project CAV3RN C2 evasion using Google Apps Script and DNS, broader PC/mobile/IoT malware trends, and cloud-hosted adversary-in-the-middle phishing used to bypass MFA. The feed describes multiple active campaigns and techniques with potentially significant enterprise and ICS/ภ
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- kaspersky_securelist
- Record identifier
- 555915bafa8ccef718870fbacba081ae9aa00123a8a6550c5221b773b0df4c5c
- Enrichment time
- 2026-08-30T20:51:46Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.