Report by Claroty

Analyzing CPS Attack Trends

5 FINDINGSPublished Mar 18, 2026
View Original Report →

Key Findings

The top Russian-targeted EU countries in the last 12 months were Italy (18%), France (11%), and Spain (9%).

EuropeItalyFranceSpainRussian Threat Actors

71% of incidents carried out by Russia-affiliated groups target organizations in European Union countries.

Nation-State ThreatsEuropeRussian Threat Actors

66% of CPS incidents include the compromise of human-machine interfaces (HMI) or supervisory control and data acquisition (SCADA) systems that control industrial processes.

Industrial Control SystemsHuman Machine InterfaceCyber-Physical SystemsSupervisory Control and Data Acquisition

81% of incidents carried out by Iran-affiliated groups target organizations in the U.S. and Israel.

Iran-Affiliated GroupsNation-State ThreatsGeopoliticsUSIsrael

82% of attacks against cyber-physical systems involve using Virtual Network Computing (VNC) protocol clients to remotely access exposed internet-facing assets.

Operational TechnologyRemote AccessCyber-Physical Systems