Surge of Email-Borne Worms Targeting Industrial Control Systems

• •Email-borne worms, particularly XWorm, are increasingly targeting ICS.
• •The surge in incidents is linked to phishing-driven malware distribution.
• •Organizations must improve email security to combat this evolving threat.

In Q4 2025, a significant increase in email-borne worms targeting industrial control systems (ICS) was reported, primarily driven by the XWorm backdoor. This malware spread through phishing emails, affecting operational technology (OT) environments globally. The incidents represent a concerning shift in the threat landscape, despite an overall decline in malware activity on ICS networks. The specific impact on ICS networks remains under investigation, with ongoing assessments of the malware's capabilities and reach. Organizations are urged to enhance their email security measures to mitigate the risk posed by such threats. The current status indicates that the threat is active, with ongoing incidents being reported.