2025 OT/ICS Threat Landscape Analysis
Abstract
In 2025, adversaries targeting operational technology (OT) crossed a line that had previously been limited to a small number of well-known attacks impacting industrial control systems (ICS). They are no longer simply gaining access and waiting. Multiple threat groups, independently and across different geopolitical alignments, moved into actively mapping control loops: identifying engineering workstations, exfiltrating configuration files and alarm data, and learning how physical processes operate well enough to disrupt them. This is the removal of the last practical barrier between having access and being able to cause physical consequences. It indicates that the teams behind these operations are being told to prepare to act, not just to maintain options.