.webp)
The summer of 2026 was particularly hot in many parts of the globe, and the cyberthreat landscape followed a similar trajectory. Between June and August 2026, Nozomi Networks Labs observed sustained malicious activity across OT, IoT and critical infrastructure environments, with threat actors targeting organizations in Manufacturing, Transportation, Energy and other essential sectors. The attacks and detections reviewed in this report show a landscape shaped by several parallel forces: persistent abuse of weak or default credentials, continued interest in exposed industrial and IoT assets, faster vulnerability discovery and exploitation cycles, and the ongoing evolution of botnets capable of generating large volumes of opportunistic traffic. At the same time, geopolitical tensions and high-profile global events continued to influence attacker priorities, reinforcing the need for defenders to treat cyber risk as both a technical and operational challenge. In this blog, we take a concise look at the strongest trends observed during the summer period and explain how organizations can use these insights to improve visibility, prioritize remediation and better protect their environments from the most prevalent threats.
Top OT/IoT Cybersecurity Events
First, let’s review the most concerning developments in OT/IoT cybersecurity that happened during the summer months.
Global Overview
The FIFA 2026 World Cup attracted the attention of many people from across the globe. As such events serve as magnets for attackers, it is extremely important to stay vigilant and be ready for any unexpected situations.
Two big wars continue to rage in the Eastern Hemisphere. Both state-sponsored attackers and financially motivated groups have become particularly bold in executing attacks against direct and indirect targets. One such campaign, involving Russian threat actors hacking cameras to track NATO supply routes, serves as a vivid reminder that the border between cyber and physical spaces is thinner than it has ever been.
A lot of critical infrastructure has recently come under attack. Services essential to our well-being , like water and electricity supply, are attractive targets, as successfully attacking them may serve as a strong political message that will be amplified all over the globe by mass media regardless of the outcome.
Even hospitals were not spared by attackers who have no red lines when it comes to the ethicality of their actions; even the human life of civilians can be endangered. It is worth mentioning that the proportion of state-sponsored and financially motivated groups remains fluid; this summer we saw an increase in the activity of the latter compared to the springtime.
Taken together, these events show that this summer's threat landscape was shaped as much by geopolitics and global attention as by technology. Major public events, ongoing conflicts, and the high visibility of attacks on essential services all create openings that both state-sponsored and financially motivated actors are quick to exploit. For defenders, the common thread is clear: no sector is off-limits, and the gap between cyber incidents and real-world consequences keeps narrowing, making continuous visibility and readiness across OT and IoT environments more important than ever.
Nozomi Networks Highlights
AI is rapidly increasing the speed of vulnerability discovery, exploit development and threat evolution. This creates particular challenges for OT and critical infrastructure environments, where patching is often constrained by safety, availability and operational requirements. Nozomi Networks is addressing this shift through both AI-assisted defense and vulnerability research. Its AI-powered Threat Intelligence capabilities are designed to identify emerging threats, new malware variants and suspicious activity before traditional signatures are available.
In parallel, Nozomi Networks joined Anthropic’s Project Glasswing to explore the use of advanced AI models for vulnerability discovery in OT, IoT and cyber-physical systems. This trend is also reshaping vulnerability management. In its analysis, Zero-Days at AI Speed, Nozomi Networks highlights how AI can compress the window between vulnerability disclosure and exploitation from days to hours. For critical infrastructure operators, this increases the importance of virtual patching, compensating controls, continuous asset visibility and faster coordination between security and operations teams.
The broader implication is clear: cyber resilience will increasingly depend not only on identifying vulnerabilities, but on how quickly organizations can translate new threat intelligence into effective protection.
Trends in Cyberattacks
Here are the trends we observed in OT/IoT environments. All the data below comes from anonymized telemetry submitted by our customers participating in the submission program.
Top Observed Techniques
Here are the MITRE ATT&CK TTPs most commonly detected in our customers’ environments all over the globe.
We can clearly see that attackers keep prioritizing simple, time-proven methods like targeting default and weak credentials in their bid to establish initial access and perform lateral movement. These approaches don’t require any sophisticated setups or spending big money on buying zero-day exploits, and can be easily prevented by exercising due diligence, having the right monitoring in place and holistically acting on its findings. Various types of protocols of different OSI levels need to be monitored to achieve comprehensive coverage here.
To better understand the targeted environments, attackers need to explore them using Discovery techniques that involve network and system scanning. Detecting them early and acting promptly can prevent further damage from being dealt. We can clearly see here that attackers tend to prioritize Denial of Service (DoS) and Data Manipulation attacks over other options, as they are perfectly suited to OT and IoT environments where system availability and data integrity matter the most.
Combined, these techniques trace the full arc of a typical OT/IoT intrusion: gaining a foothold through default, valid or brute-forced credentials, maintaining communication over common protocols, mapping the environment through discovery and finally disrupting operations or tampering with data. Credential-related techniques alone accounted for roughly a third of all observed detections, which means some of the most effective defenses remain the most basic ones: eliminating default passwords, enforcing strong authentication and monitoring for unusual account activity. Organizations that combine these fundamentals with continuous network visibility are well positioned to break the attack chain early, before reconnaissance turns into real operational impact.
Top Targeted Countries
Let's look at the list of countries that produced the highest average number of alerts per organization, to minimize the bias towards the number of customers in each region. Only the countries where we have a statistically significant number of customers participating in the telemetry sharing program were taken into account. Here are the results:
Compared to 2H 2025, Australia went two positions up, now taking first place. The United Kingdom still remains among the top three countries, but this time it moved one position down taking 2nd place. Finally, France replaced Germany in our top three chart taking 3rd place.
For these countries, this is an obvious call for action to verify their cybersecurity posture and stay vigilant. At the same time, regardless of which countries attract particular attention from attackers, any organization in the world can be targeted by malicious actors, so extreme caution should be exercised by everyone regardless of their geographical location.
Top Affected Industries
Let’s understand which sectors were the most targeted during the reviewed period. Again, only the industries where we have a statistically significant number of customers participating in the telemetry sharing program were considered. The findings were based on the average number of alerts per organization associated with the sector. Here are the results:
Manufacturing again took 1st place, outpacing the Transportation sector, which was the most targeted industry during 2H 2025. This finding was also confirmed by other cybersecurity vendors. Another noticeable change: the Energy, Utilities & Waste industry now takes 3rd place, replacing the Government sector. All three sectors share a common profile: they depend heavily on interconnected OT and IoT systems, often run legacy equipment that is difficult to patch, and cannot afford prolonged downtime, which makes them especially attractive to attackers seeking either disruption or leverage for extortion.
The rise of Energy, Utilities & Waste reflects the growing appeal of targets whose compromise has immediate, visible consequences for the public. For organizations in these industries, the priority should be aligning security investments with operational risk, focusing on visibility into critical processes, segmentation between IT and OT networks and response plans that minimize the impact of any successful intrusion. This also aligns with the incidents that happened this summer with various critical infrastructure sectors being increasingly targeted by both state-sponsored and financially motivated actors to achieve their goals.
Let’s explore these actors in greater detail.
Most Active Threat Actors
Here are the groups that were most active in the environments monitored by our solutions during the summer months. The attribution was done based on the detections associated with their malicious payloads, traffic, behavioral traces on endpoints and Indicators of Compromise (IoCs) involved.
As in 2H 2025, the Scattered Spider group leads the chart, with close to half of all actor-attributed alerts related to their activity. This group is known to execute highly effective social engineering attacks.
The exact location of the UNC4536 actor is still not officially confirmed, but multiple sources state that this actor appears to be Russian speaking. The RomCom-related threat actor (also tracked as UNC4895) linked to Russia took 3rd place with over 12% of attributed attacks being related to them. Little public information is available for an actor tracked by our TI exchange partner Mandiant as UNC5636; it has also not yet been reliably linked to any particular country. Finally, the notorious APT29, aka Cozy Bear, attributed to Russia's Foreign Intelligence Service (SVR), closes our top-5 chart. This actor became infamous for its long-term cyber espionage, particularly against governments, diplomatic organizations and technology companies.
The mix of actors in this chart highlights two distinct pressures on defenders. On one side, financially motivated groups like Scattered Spider rely on social engineering to bypass technical controls, a reminder that people and identity processes are as much a part of the attack surface as networks and devices. On the other, Russia-linked or Russian-speaking actors (UNC4536, RomCom, and APT29) together account for over a third of attributed alerts, reflecting the ongoing influence of geopolitics on the threat landscape. In both cases, organizations should focus on the behaviors and indicators the actors leave behind and keep detection logic continuously updated as new intelligence emerges.
Changes in Vulnerability Landscape
Let's explore what recently discovered (2026) OT-related vulnerabilities appear most frequently in modern OT/IoT environments. As above, all the findings are based on our anonymized telemetry coming from participating customers all over the globe.
Top Recently Discovered Vulnerabilities
Here is how the situation looks globally at the end of summer 2026:
Siemens PLCs remain a popular option with multiple companies using them to support their daily operations. The same applies to other common OT vendors like Rockwell Automation. Leaving their solutions unpatched opens the door for malicious actors to successfully execute various types of attacks. As we can see here, 80% of the most detected recently discovered vulnerabilities have an associated CVSS score of HIGH or CRITICAL. Therefore, a proper vulnerability management and mitigation plan is essential to prevent or minimize the potential losses associated with this risk.
Regarding the CVSS score, the global distribution shows that 50% have a HIGH CVSS score and 8% have a CRITICAL CVSS score. This is a big increase compared to last year, when 43% of 2025 vulnerabilities had a HIGH CVSS score and only 5% of them were marked as CRITICAL. Coupled with the fact that every year more and more vulnerabilities are being discovered and reported by researchers, especially because of the advancements in AI development, prioritizing their remediation becomes a race against time for some organizations, who should fix the holes in their protection faster than attackers can discover and abuse them.
Finally, it is worth mentioning that in many cases the vulnerable assets may also be some of the hardest to fix. These controllers often sit at the heart of production processes, where downtime for patching must be carefully planned, sometimes months in advance. With the combined share of HIGH and CRITICAL vulnerabilities rising from 48% to 58% year over year, organizations cannot rely on patching alone. Knowing exactly which vulnerable devices are present in their environments and how critical they are for daily operations, prioritizing fixes by real-world exposure, and also applying virtual patching or network-level compensating controls in the meantime are what will keep this gap from turning into an incident.
Nozomi-discovered 0-day Vulnerabilities
By the end of summer 2026, Nozomi Networks Labs had responsibly disclosed more than 560 zero-day vulnerabilities. One example is our research into Siemens PROFINET assets, where four vulnerabilities were discovered, and their real-world significance in OT environments can be very high. Memory-handling flaws such as NULL pointer dereferences and out-of-bounds reads can crash or destabilize a device. In industrial environments, where availability is critical, even a temporary loss of a PROFINET asset can interrupt production. For asset owners, the lesson is to assess vulnerabilities not only by their CVSS score, but also by the role the affected device plays in their operations.
Our research also extended beyond individual industrial devices. Nozomi Networks Labs uncovered nine vulnerabilities in NTFS-3G, the widely used read-write NTFS driver for Linux. Several of the flaws are memory-safety vulnerabilities that can allow a local attacker to escalate privileges and, in some cases, execute arbitrary code with elevated privileges. Because NTFS-3G is used across Linux systems, embedded devices, networking appliances, and industrial equipment, vulnerabilities in such a widely deployed component can have a broad impact.
Other research focused on devices positioned directly between the physical process and the control network. In the Pepperl+Fuchs IO-Link Master ICE2-8IOL-K45P-RJ45, Nozomi Networks Labs identified 19 vulnerabilities. By chaining an authentication bypass with command injection flaws, an attacker with network access could gain root-level control of the device without credentials. From there, the attacker could manipulate sensor readings or actuator commands, disrupt communication with connected field devices, or use the device as a foothold for further attacks within the OT network.
A similar risk emerged from our analysis of the Advantech EKI-1242EIMS and EKI-1242IEIMS fieldbus gateways, where 16 vulnerabilities were uncovered. The most severe allows an unauthenticated network attacker to execute arbitrary OS commands as root. Other flaws could expose sensitive network information, alter device configuration, or disrupt industrial communications. Since these gateways connect fieldbus devices with industrial Ethernet networks, compromising them could give an attacker a powerful position from which to interfere with connected industrial processes.
Finally, for those interested in performing their own OT security research with responsible disclosure and helping make industrial environments safer, Nozomi Networks Labs continues to share its research experience and methodologies, as demonstrated in our blog post on extracting PLC firmware through native code execution.
Evolution of Botnets
Botnets were definitely not hibernating this summer with thousands and thousands of compromised devices comprising them constantly performing attacks against our infrastructure. Looking at the global statistics, here are the countries where the highest number of compromised assets was detected by our globally distributed chain of honeypots based on their unique IP addresses.
As shown, the US again leads the chart this time, followed by China, where the proportion of devices in IoT botnets decreased sharply in the past few months. Multiple factors drive these proportions, including attack surface size, with a higher total number of potential victim devices increasing it, as well as their cybersecurity posture. India also went a few positions down now taking 9th place compared to 3rd place in 2H 2025, swapping its place with the United Kingdom. Nozomi Networks will continue to closely monitor the global situation to ensure our customers are adequately protected, regardless of their geolocation. Looking at the spikes in botnet attacks, we can see that August 29 was the most active day of the reported period, when we recorded attacks coming from 1,716 unique IP addresses. All the associated IoCs are used to provide timely protection to our customers.
With the help of our new AI-assisted detection engine, Nozomi Networks Labs is now able to spot new malware families much faster than before. The following new strains and families of IoT botnets were observed during the summer months of 2026:
In addition to that, a new Golang-based botnet Kairos was spotted recently; a dedicated blog post covering it with all the technical details will be published shortly.
The steady stream of new families shows that botnet authors keep refining their tools rather than reinventing them: modernized Mirai derivatives, portable Golang-based code, and the adoption of publicly available exploits all lower the effort needed to build and grow a botnet. What these families have in common is their reliance on the same weaknesses highlighted earlier in this report, namely default or weak credentials and exposed, unpatched devices. Every compromised camera, router, or controller not only becomes a potential entry point into its own network but also adds firepower to attacks against others. Keeping IoT devices off the public internet wherever possible, replacing default passwords, applying firmware updates and monitoring for unusual outbound traffic remain the most effective ways to keep assets from being recruited, while timely threat intelligence helps block known botnet infrastructure before it can do harm.
Conclusion
The summer of 2026 confirmed that the OT/IoT threat landscape is being pushed forward from several directions at once. Geopolitical conflicts and high-profile global events kept critical infrastructure in the spotlight, with Manufacturing, Transportation and Energy, Utilities & Waste bearing the brunt of the activity. A diverse mix of actors, from financially motivated groups like Scattered Spider to Russia-linked espionage and disruption operators, targeted these environments with a combination of social engineering and technical intrusion. Yet despite this diversity, the methods behind most attacks remained strikingly familiar: default and weak credentials, discovery scanning, and denial-of-service techniques continued to dominate our telemetry, while botnets kept growing by recruiting poorly secured, internet-exposed devices.
At the same time, the pace of change is accelerating. The share of HIGH and CRITICAL vulnerabilities rose noticeably year over year, with the most frequently detected ones affecting widely deployed PLCs that are difficult to patch, and AI is shortening the window between vulnerability disclosure and exploitation. New botnet families are appearing faster, too, built on proven code and publicly available exploits. For defenders, this means that getting the fundamentals right is no longer enough on its own; it must be combined with continuous visibility, risk-based prioritization and the ability to act on fresh threat intelligence quickly. The recommendations below summarize the key steps organizations can take to stay ahead of these threats.
Mitigations and Recommendations
- Establish complete asset and network visibility across OT and IoT
- Including wired and wireless networks and endpoints
- Leverage AI-driven security systems to detect anomalies and threats
- Ensure continuously updated malware prevention for ICS networks
- Prioritize risk-based vulnerability management for OT environments
- Participate in intelligence sharing to improve collective cyber resilience
.webp)
