Latin America Ranks Second in Global ICS Cyber Exposure

Latin America has become the world's second most exposed region to industrial cybersecurity threats, with 20.4% of Industrial Control System (ICS) computers affected by malicious objects, reveals Kaspersky ICS CERT. 

Phishing campaigns and malicious documents are becoming the primary entry points for cybercriminals seeking to infiltrate industrial environments across Latin America, placing the region among the world's most exposed to operational technology (OT) threats.

"The region's indicators make it clear that email remains the most exploited link by advanced attackers seeking to compromise operational technology," says Eduardo Chavarro, Director for the Americas of the Global Incident Response Team, Kaspersky.

According to the latest Kaspersky ICS CERT report, 20.4% of Industrial Control System (ICS) computers in Latin America encountered malicious objects, making the region the second most exposed globally to perimeter cyberthreats. The finding contrasts with the global trend, where the percentage of affected ICS computers declined to 19.7%, the lowest level recorded since 2022.

The results suggest that while industrial cybersecurity conditions are gradually improving worldwide, organizations across Latin America continue to face elevated exposure to attacks, which often begin outside industrial networks before expanding into critical operational environments.

Industrial Attacks Increasingly Begin With Credential Theft

"The use of malicious documents and spyware in these campaigns is not intended to cause immediate damage but to establish stealthy initial access,” says Chavarro. “Once valid credentials are obtained, malicious actors can move laterally across corporate networks until they reach critical process control systems, significantly increasing the risk of operational incidents or ransomware deployment.”

Email-based attacks remain the most significant exposure point for industrial organizations in the region. Kaspersky found that 5.30% of industrial computers in Latin America encountered email-borne threats, representing a rate 1.9 times higher than the global average.

Mexico recorded the highest regional exposure, with 9.51% of ICS computers affected through email, followed by Uruguay at 8.56%. Colombia, Brazil, Argentina, and Chile remained within the regional averages observed in the study.

Malicious documents also continue to represent a growing risk. Across Latin America, 3.08% of industrial computers were affected by malicious files, a rate 1.8 times above the global average. Mexico again reported the highest exposure at 5.28%, closely followed by Uruguay at 5%.

Credential theft campaigns are also intensifying through malicious scripts and phishing websites designed to capture employee authentication data before attackers attempt to access industrial environments.

Panama registered the highest regional rate for these attacks, with 18.24% of ICS computers affected. According to Kaspersky, the increase was driven by campaigns targeting government websites built on WordPress, highlighting how broader cyber campaigns can create indirect risks for industrial organizations.

Critical Industries Remain the Primary Targets

The report also identifies the industrial sectors experiencing the highest levels of blocked malicious activity across Latin America, illustrating how cybercriminals continue to target environments that support essential services and critical infrastructure.

Biometric systems recorded the highest exposure, with 27.1% of ICS computers detecting malicious activity. Building automation followed at 22.4%, while the construction sector reached 21.9%. Electric power infrastructure registered an infection rate of 19%, followed by ICS engineering and integration companies at 18.7%. Manufacturing reported the lowest rate among the six most affected sectors, although 15.7% of industrial computers still encountered blocked malicious activity.

The findings reinforce a broader industry concern that perimeter attacks increasingly serve as the initial stage of more sophisticated campaigns targeting operational technology. Rather than immediately disrupting industrial processes, attackers frequently seek to compromise employee credentials before expanding their access into OT environments.

For industrial organizations, this approach raises the importance of securing the connection between traditional IT infrastructure and operational networks, where compromised user accounts can become pathways into critical systems.

Kaspersky’s Recommendations

To strengthen industrial cybersecurity, Kaspersky recommends reinforcing email filtering and monitoring capabilities to detect phishing campaigns, malicious code, and suspicious attachments before they reach employees. The company also advises organizations to maintain strict segmentation between IT and OT networks, limiting connections across both environments while closely monitoring any authorized communication between them.

Additional recommendations include auditing the use of removable media such as USB devices, requiring mandatory malware scans before external storage devices are connected to industrial systems, and providing continuous cybersecurity awareness training focused on social engineering techniques and phishing identification.

Kaspersky also recommends deploying cybersecurity platforms specifically designed for industrial environments to improve visibility, threat monitoring, and incident response across ICS and OT infrastructure, helping organizations reduce operational disruption risks as cyberthreats against industrial systems continue to evolve.