Industrial cyberattacks on critical systems are on the rise
- Cyberpeace Tech
- Jan 29
- 3 min read
During the second quarter of 2025, a significant portion of industrial systems in Spain faced digital intrusion attempts, confirming that operational infrastructures remain one of the main targets of cybercrime.
Almost two out of ten devices linked to industrial control systems detected and blocked malicious activity, a figure that, although slightly lower than in the previous quarter, remains high.
This behavior is not unique to Spain. Southern Europe has similar levels of exposure, well above those recorded in northern regions of the continent. Globally, the trend also reflects that industrial environments remain under constant pressure, especially those with critical processes and high technological dependence.
Industrial cyberattacks and their impact on key sectors
Analysis by industry reveals that some sectors are more vulnerable than others. Biometrics-based solutions and building automation systems accounted for the highest levels of incidents, even exceeding global averages.
In contrast, sectors such as manufacturing, electric power, construction, and industrial engineering showed a lower incidence, although this does not eliminate the risk.
For Mexico, this scenario is particularly relevant. The growing digitization of manufacturing plants, industrial parks, and energy systems means that the country faces similar challenges. The European experience can serve as a warning to strengthen security in OT environments before threats reach more critical levels.
Main attack vectors in industrial systems
Attacks originating from the internet continue to be one of the most common entry points. A significant proportion of the industrial systems analyzed managed to block external threats, demonstrating that direct exposure of these environments remains a latent risk.
Email also remains a highly effective channel for attackers.
Attempts to infect systems through malicious messages reached one of the highest levels worldwide, confirming that the human factor remains a weak point in industrial operations.
In comparison, attacks using removable devices, such as USB drives, were much less frequent.
However, their presence, although low, indicates that they remain a route that should not be overlooked, especially in environments where physical media are still used to transfer information.
Spyware, a persistent threat to OT environments
Among the different types of malware detected, spyware stands out as one of the most dangerous. This type of malicious software has the ability to steal sensitive information and facilitate lateral movement within compromised networks, putting entire production processes at risk.
Although its impact varies between countries, data shows that it continues to affect a significant percentage of industrial systems, reinforcing the need for advanced detection and response mechanisms.
Best practices for strengthening industrial security
Given this scenario, specialists recommend adopting a preventive and continuous approach to protecting OT environments. Some key actions include:
Conducting regular security assessments to identify risks before they are exploited.
Implementing constant vulnerability management with clear priorities.
Keeping critical components of the industrial network up to date and applying security patches in a timely manner.
Using detection and response solutions that enable advanced threats to be identified and responded to quickly.
Training both IT and OT personnel in industrial cybersecurity to improve incident prevention and response.
For Mexico, implementing these recommendations could mean the difference between a resilient operation and a costly disruption in sectors that are strategic to the national economy.
At Cyberpeace, we believe that timely information is key to reducing risks in digital and industrial environments. Staying up to date on cybersecurity threats allows you to anticipate attacks and make better protection decisions.
Prevention starts with knowledge. If you want to continue learning about cybersecurity and digital protection, follow us on our social media channels and become part of an informed community.
Comments