Top mobile, IoT, and OT threat trends

ThreatLabz researchers identified patterns seen across industries worldwide. Three major trends stand out:

1. Android malware hides in everyday apps: Android malware rose 67% globally year-over-year, fueled by spyware and banking malware embedded in legitimate applications. Even trusted marketplaces like Google Play saw 239 malicious Android apps downloaded 42 million times.
2. IoT botnets keep amplifying risk: Botnet families such as Mirai, Gafgyt, and Mozi continue to dominate IoT threat activity, accounting for 75% of all malicious IoT payloads. These campaigns exploit unpatched routers and edge devices to rapidly expand their networks.
3. Legacy OT and supply chains remain weak links: Threat actors continue to take advantage of the overlap between outdated operational systems and vulnerable vendor ecosystems, knowing that one unpatched controller or compromised vendor update can open the door to many connected networks and critical services.

These cross-industry trends form the foundation of the public sector cyber risk story. Whether through a compromised mobile device, a hacked smart sensor, or a vulnerable control system, attackers are finding new entry points into public sector networks. Here’s how these attack patterns emerged across government, healthcare, and education between June 2024–May 2025.

Government key findings

Government agencies rely heavily on connected devices, surveillance systems, and smart city infrastructure. In the past year alone, IoT malware attacks against government systems surged by 370%, while mobile threats rose 147%.

In recent events, nation-stage groups like Volt Typhoon and Salt Typhoon have infiltrated government systems by exploiting IoT devices, public-facing routers, and other edge infrastructure to gain covert access and maintain long-term persistence.

Even local governments are vulnerable: smart traffic lights, emergency alert systems, and utility management networks can all be manipulated through IoT weaknesses. A single compromised device can cascade into widespread service disruptions, threatening public safety and trust.

Healthcare key findings

Healthcare providers remain one of the most targeted verticals for mobile and IoT attacks, as threat actors seek to exploit valuable patient data and disrupt critical care operations. Over the past year, ThreatLabz observed a 224% surge in mobile-related attacks targeting healthcare organizations, many involving Android-based malware designed to harvest credentials or compromise clinical workflows

IoT and OT systems in hospitals—from infusion pumps and MRI machines to connected HVAC systems—often run on outdated firmware or lack strong authentication. The impact of compromise can disrupt care or allow threat actors to move laterally across healthcare networks to access sensitive medical records or connected hospital systems. Even though medical devices represent a relatively small fraction of the total volume of IoT devices tracked by ThreatLabz (0.6%), they are among the most sensitive, and any compromise carries direct risks to patient safety.

Education key findings

Education has quietly become a major target for IoT malware with an 861% surge in attacks over the past year. Schools and universities are increasingly exposed through smart classroom devices, connected cameras, and online learning platforms.

Attacks recognize that education institutions often operate with limited cybersecurity budgets and device sprawl. Threat actor goals vary from stealing personal data to launching ransomware campaigns that can shut down digital learning environments.

In some cases, IoT botnets are weaponized to overwhelm university systems or hijack connected devices such as routers for broader attacks.

For additional details on the IoT malware and Android threat landscapes, read the ThreatLabz 2025 Mobile, IoT, and OT Threat Report.