THE Philippines has emerged as a cybersecurity ‘hotspot’ in Southeast Asia, ranking among the region’s ‘most at risk’ countries for industrial cyberattacks-with nearly one in five Industrial Control System (ICS) computers encountering malicious activity in the second quarter of 2025, according to the latest data from cybersecurity firm Kaspersky.
In its new Industrial Control Systems Cyber Emergency Response Team (ICS CERT) report, the company revealed that 19.09 percent of ICS computers in the Philippines had malicious objects blocked in the second quarter of 2025.
While this figure marks a slight decline from 22.27 percent in the first quarter, it still underscores the country’s high exposure to industrial malware within the region, according to Kaspersky Head of Sales for Asia Emerging Countries Sam Yan.
‘While some attack vectors have seen a slight decline, the overall trend highlights the importance of maintaining strong defenses,’ he said. ‘Organizations need to continuously strengthen their cybersecurity posture through regular assessments, timely updates, and capacity-building for both IT [information technology] and OT [operational technology] teams to stay resilient against evolving threats.’
The report found that 10.33 percent of ICS computers in the country were targeted by internet-borne threats, down from 13.20 percent in the previous quarter.
Kaspersky also flagged the persistent threat of spyware-including spy Trojans, backdoors, and keyloggers-which affected 3.41 percent of Philippine ICS computers in the second quarter, slightly higher than 3.38 percent from the previous quarter.
These attacks often seek to exfiltrate sensitive industrial data or compromise operational control systems.
Kaspersky added that the share of ICS computers exposed to threats via email clients increased to 1.91 percent in the second quarter from 1.36 percent in the first quarter.
In contrast, the Philippines saw a mild improvement in threats coming from removable media-such as USB drives-with infection rates dropping to 0.42 percent from 0.66 percent in the previous quarter.
Still, Kaspersky noted that these attack vectors remain a concern in industrial settings where external devices are often used for maintenance and system updates.
To address these evolving threats, the company is offering Kaspersky Industrial CyberSecurity (KICS), an Extended Detection and Response (XDR) platform tailored for operational technology (OT) environments.
The platform integrates network traffic analysis, endpoint protection, and incident response to help industrial operators detect and mitigate attacks that can disrupt production lines, critical infrastructure, and utilities.