Nozomi Networks Report: Credential Attacks Dominate OT/IoT Threats

Nozomi Networks has published a report titled "OT/IoT Summer 2026 Cyber Trends," covering threats observed from June to August, according to datanet.co.kr. The report found that credential-related attacks accounted for about one third of total detections during that period.

Enterprise brute force attacks made up 10.6% of all attack types in the report. In ICS environments, techniques using valid or default accounts to gain persistence and lateral movement each appeared at 10.8%.

Scattered Spider was the most active attacker group, accounting for 48% of all attacks in the report. Russia-linked or Russian-speaking actors UNC4536, RomCom and APT29 made up more than one third of all alerts. Manufacturing, transportation, and energy/utilities/waste were the industries where the most attacks were observed.

Vulnerability disclosures

Among vulnerabilities found in 2026, HIGH severity CVSS ratings accounted for 50% and CRITICAL 8%, up from a combined 48% the previous year. Nozomi Networks Labs stated it has found and disclosed more than 560 zero-day vulnerabilities, including four high-severity vulnerabilities in Siemens PROFINET and nine in NTFS-3G, as well as 19 vulnerabilities in Pepperl+Fuchs and 16 in Advantech.

Nozomi Networks is participating in Anthropic's Project Glasswing to explore using advanced AI models for vulnerability research in OT/IoT and cyber-physical systems.