March 2026 OT attack spike: what should defenders prioritise now?

TL;DR: March was the most telling month for OT attack activity, with payload diversity, CVE-tagged exploitation and ICS/OT scanning all spiking together even though raw session volume peaked later in May, according to TXOne Networks’ 2026 H1 honeypot report. The data points to opportunistic attackers leaning on legacy SMB exposure, cloud-hosted infrastructure and default credentials rather than novel tradecraft.

Editorial analysis by NHI Mgmt Group, based on content published by TXOne Networks: “TXOne Honeypot Report: 2026 H1 Threat Landscape”.

By the numbers:

• Over 91% of malware downloads were delivered over SMB 445/TCP.

Key questions

Q: What breaks when legacy SMB stays exposed in OT and adjacent networks?

A: Legacy SMB exposure keeps old exploitation paths, malware delivery and credential abuse open long after organisations think the original risk has passed.

Q: Why does cloud-hosted attacker infrastructure matter for defenders?

A: Because it changes the economics of detection and blocking.

Q: What are the signs that credential abuse is becoming application aware?

A: Look for login attempts that match a specific ecosystem rather than generic default-credential lists, especially when usernames and passwords mirror the technology stack being targeted.

Practitioner guidance

• Restrict legacy SMB exposure Inventory every SMB-reachable asset, remove unnecessary 445/TCP exposure, and segment legacy systems that still require SMB for business continuity.
• Block and monitor hosting-provider scanning Treat cloud and VPS ASN ranges as a distinct threat source in perimeter filters, rate limits and enrichment workflows for bulk scanning activity.
• Eliminate default credentials on machine-facing services Replace shared admin defaults with unique credentials or key-based authentication on any internet-facing node, validator or service endpoint.

Bottom line: Legacy SMB exposure remains a durable delivery path for opportunistic attackers, which means old services still create present-day governance debt.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →