3 Threat Groups Started Targeting ICS/OT in 2025: Dragos

CISA orders feds to patch actively exploited Dell flaw within 3 days

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) ordered government agencies to patch their systems within three days against a maximum-severity Dell vulnerability that has been under active exploitation since mid-2024. According to security researchers from Mandiant and the Google Threat Intelligence Group (GTIG), this hardcoded-credential vulnerability (CVE-2026-22769) in Dell's RecoverPoint (a solution used for VMware virtual machine backup and recovery) is being exploited by a suspected Chinese hacking group tracked as UNC6201. After gaining access to a victim's network in CVE-2026-22769 attacks, UNC6201 deploys several malware payloads, including a newly identified backdoor called Grimbolt. This malware is built using a relatively new compilation technique that makes it harder to analyze than its predecessor, the Brickstorm backdoor. While the group swapped Brickstorm for Grimbolt in September 2025, it's not yet clear whether this switch was part of a planned upgrade or "a reaction to incident response efforts led by Mandiant and other industry partners." "Analysis of incident response engagements revealed that UNC6201, a suspected PRC-nexus threat cluster, has exploited this flaw since at least mid-2024 to move laterally, maintain persistent access, and deploy malware including SLAYSTYLE, BRICKSTORM, and a novel backdoor tracked as GRIMBOLT," they said. The security researchers have also found overlaps between UNC6201 and the Silk Typhoon Chinese state-backed cyberespionage group (although the two are not considered identical by GTIG), also tracked as UNC5221 and known for exploiting Ivanti zero-days to target government agencies with custom Spawnant and Zipline malware. Silk Typhoon has previously breached the systems of several U.S. government agencies, including the U.S. Treasury Department, the Office of Foreign Assets Control (OFAC), and the Committee on Foreign Investment in the United States (CFIUS). Feds ordered to prioritize CVE-2026-22769 patches CISA has now added the security flaw to its Known Exploited Vulnerabilities (KEV) catalog on Wednesday and ordered Federal Civilian Executive Branch (FCEB) agencies to secure their networks by the end of Saturday, February 21, as mandated by Binding Operational Directive (BOD) 22-01. "These types of vulnerabilities are frequent attack vectors for malicious cyber actors and pose significant risks to the federal enterprise," CISA warned on Wednesday. "Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable." Last week, CISA also gave U.S. federal agencies three days to secure their BeyondTrust Remote Support instances against an actively exploited remote code execution vulnerability (CVE-2026-1731). Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

bleepingcomputer.comFeb 19, 2026extracted

Fed agencies ordered to patch Dell bug by Saturday after exploitation warning

Fed agencies ordered to patch Dell bug by Saturday after exploitation warning Editor's note: This article was updated with comment from the Cybersecurity and Infrastructure Security Agency at 8:00 a.m. EST. on Feb. 19. Dell and Google released notices on Tuesday about CVE-2026-22769, warning that a sophisticated Chinese actor has been targeting the bug since at least mid-2024. Dell’s advisory said the vulnerability carries a severity score of 10 out of 10 and provided fixes for the issue. The advisory notes Google’s findings of “limited active exploitation.” Google-owned security firm Mandiant published its own lengthy blog about the vulnerability and the attacks that resulted from it. Mandiant said the activity was targeted at organizations across North America. The Cybersecurity and Infrastructure Security Agency (CISA) confirmed CVE-2026-22769 is being exploited on Wednesday and ordered all federal agencies to patch it by Saturday. Nick Andersen, executive assistant director for cybersecurity at CISA, said the agency is “actively combating the multi-year Brickstorm threat campaign.” Anderson explained the issue relates to hard-coded credentials that had been leaked and exploited by threat actors. “Hard-coded credentials remain a critical risk, and CISA urges all organizations to take decisive steps now to mitigate exposure and prevent compromise,” he said. Dell RecoverPoint for Virtual Machines are typically part of an organization’s resilience layer, replicating virtual machines and enabling disaster recovery while allowing businesses to quickly restore systems if they are disrupted by failure or attack, according to Keeper Security’s Shane Barney. Because it integrates directly with hypervisors, storage infrastructure and backup systems, it typically operates with elevated privileges, he said, making it a high-value target. “Targeting backup and disaster recovery platforms reflects a deliberate and knowledgeable approach. If an attacker compromises the systems responsible for restoration, they can weaken an organization’s ability to recover from disruption,” Barney said. “In the context of espionage, access to this layer can also provide deep visibility into infrastructure architecture and replicated data sets.” In its blog, Mandiant and Google Threat Intelligence Group tied the exploitation of the bug to UNC6201 — a group they said has links to Silk Typhoon. Silk Typhoon was accused by U.S. authorities of hacking the Treasury Department in 2024 and abusing vulnerabilities in widely used tools from IT firm Ivanti. Charles Carmakal, CTO of Mandiant, said during exploitation of the vulnerability, the hackers were deploying a newer version of a backdoor called BRICKSTORM. “Any organization using Dell RecoverPoint for Virtual Machines should immediately apply the recommendations provided by Dell,” Carmakal said. “Nation-state threat actors continue targeting systems that don’t commonly support endpoint detection and response solutions, which make it very hard for victim organizations to know they are compromised and significantly prolong intrusion dwell times.” Carmakal said they observed the hackers using a novel backdoor they named GRIMBOLT. Mandiant said GRIMBOLT appeared to be a replacement for the BRICKSTORM malware, using much of the same architecture but serving as a better way for the hackers to remove any of the fingerprints from attacks. “It's unclear if the threat actor's replacement of BRICKSTORM with GRIMBOLT was part of a pre-planned life cycle iteration by the threat actor or a reaction to incident response efforts led by Mandiant and other industry partners,” the researchers explained. CISA, the National Security Agency (NSA) and Canadian Centre for Cyber Security published an advisory about BRICKSTORM in December, raising alarms that Chinese hackers were using it to attack governments in several countries and maintain long-term access. CISA last week updated the advisory, noting that it was seeing newer versions of BRICKSTORM that made it “more versatile and harder to detect.” Cybersecurity firms like Mandiant have repeatedly reported seeing BRICKSTORM used in attacks on legal firms, software-as-a-service providers and technology companies since March 2025, with the initial goal being to steal valuable intellectual property and sensitive data or raid the email inboxes of senior company leaders. Crowdstrike said it also saw “multiple intrusions targeting VMware vCenter environments at U.S.-based entities” throughout 2025 involving BRICKSTORM. In one incident tracked by Crowdstrike, the Chinese hackers had access dating back to 2023. Mayuresh Dani, security research manager at Qualys, said Chinese threat actors are adept and comfortable working inside the pipelines of modern VMware-based disaster recovery environments like the ones described in Mandiant’s advisory. “This vulnerability shows us that the threat actor understands modern VMware DR architectures and knows how to live in them quietly,” Dani explained. “A compromised appliance can influence which copies of data get replicated, where they go, and what gets restored in a disaster, making it a high leverage target.” Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

therecord.mediaFeb 18, 2026extracted

China-linked hackers exploited Dell zero-day since 2024 (CVE-2026-22769)

China-linked hackers exploited Dell zero-day since 2024 (CVE-2026-22769) A suspected China-linked cyberespionage group has been covertly exploiting a critical zero-day flaw (CVE-2026-22769) in Dell’s RecoverPoint for Virtual Machines software since at least mid-2024, according to new research from Google’s threat intelligence team and Mandiant. The attackers deployed stealthy backdoors (BRICKSTORM and GRIMBOLT), a webshell (SLAYSTYLE) and maintained long-term access inside targeted networks. “Beyond the Dell appliance exploitation, Mandiant observed the actor employing novel tactics to pivot into VMware virtual infrastructure, including the creation of ‘Ghost NICs’ [i.e., Network Interface Cards] for stealthy network pivoting and the use of iptables for Single Packet Authorization (SPA),” the researchers shared on Tuesday. They tied the attacks to UNC6201, a suspected PRC-nexus threat cluster that shows “notable overlaps” with UNC5221, a Chinese threat actor that’s often conflated with Silk Typhoon (“although GTIG does not currently consider the two clusters to be the same.) Default credentials exposed Dell backup systems to compromise The analysts were unable to pinpoint how the attackers achieved initial access to affected systems, but UNC6201 is known to target edge appliances. (UNC5221 as well.) Mandiant incident responders discovered CVE-2026-22769 while investigating hacked Dell RecoverPoint systems inside a victim’s network, after they noticed the systems were communicating with hacker-controlled command and control servers associated with BRICKSTORM and GRIMBOLT backdoors. “During analysis of the appliances, analysts identified multiple web requests to an appliance prior to compromise using the username admin. These requests were directed to the installed Apache Tomcat Manager, used to deploy various components of the Dell RecoverPoint software, and resulted in the deployment of a malicious WAR file containing a SLAYSTYLE web shell,” they explained. “After analyzing various configuration files belonging to Tomcat Manager, we identified a set of hard-coded default credentials for the admin user in /home/kos/tomcat9/tomcat-users.xml. Using these credentials, a threat actor could authenticate to the Dell RecoverPoint Tomcat Manager, upload a malicious WAR file using the /manager/text/deploy endpoint, and then execute commands as root on the appliance.” The BRICKSTORM backdoor is a known threat, wielded by UNC5221 and related threat clusters, and deployed on appliances that do not support traditional endpoint detection and response (EDR) tools. This allows the attackers to keep their presence in target organizations’ networks quiet. According to Mandiant and GTIG, the GRIMBOLT backdoor is built in a way that turns it directly into machine code before it’s run, which makes it easier to run on small devices and harder to detect via static analysis. The attackers edited a legitimate shell script to launch the backdoor each time the script is run. “It’s unclear if the threat actor’s replacement of BRICKSTORM with GRIMBOLT was part of a pre-planned life cycle iteration by the threat actor or a reaction to incident response efforts led by Mandiant and other industry partners,” the analysts added. Remediation and investigation Dell has provided instructions on how to remediate CVE-2026-22769, and Mandiant and GTIG have provided indicators of compromise, outlined artifacts that point to Dell RecoverPoint compromise, and shared YARA rules for detecting the presence of the GRIMBOLT backdoor and the SLAYSTYLE webshell. Earlier this month, CISA revised its report on the BRICKSTORM backdoor with the latest indicators of compromise related to the threat. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

helpnetsecurity.comFeb 18, 2026extracted

Dell RecoverPoint for VMs Zero-Day CVE-2026-22769 Exploited Since Mid-2024

thehackernews.comFeb 18, 2026extracted

Dell RecoverPoint Zero-Day Exploited by Chinese Cyberespionage Group

A zero-day vulnerability in Dell’s RecoverPoint for Virtual Machines product has been exploited by a China-linked cyberespionage group since at least mid-2024, Google’s Threat Intelligence Group (GTIG) and Mandiant reported on Tuesday. Exploitation of the vulnerability identified as CVE-2026-22769 has been attributed by GTIG and Mandiant to a threat actor tracked as UNC6201. The hackers exploited the flaw for lateral movement, persistence, and malware deployment. Dell RecoverPoint for Virtual Machines, part of the vendor’s data protection offering, provides resilience and disaster recovery functionality for VMware VMs. According to Dell’s advisory for CVE-2026-22769, the vulnerability is a hardcoded credential issue affecting RecoverPoint for Virtual Machines versions prior to 6.0.3.1 HF1. The tech giant has advised users to update their installations to the patched version as soon as possible. “[CVE-2026-22769] is considered critical as an unauthenticated remote attacker with knowledge of the hardcoded credential could potentially exploit this vulnerability leading to unauthorized access to the underlying operating system and root-level persistence,” Dell said. This appears to be the first public mention of the threat group UNC6201, but Google pointed out that it has found links to UNC5221, a China-nexus APT known for dwelling in compromised networks for hundreds of days to obtain valuable information. Google previously detailed UNC5221’s use of the BrickStorm malware. In a September 2025 report the company noted that the threat group may have used some of the stolen information to identify zero-day vulnerabilities in enterprise technologies. It’s unclear if CVE-2026-22769 may be one of those zero-days. In its new report, Google revealed that the newly documented group, UNC6201, had also used the BrickStorm malware, but in September 2025 it started replacing it with a new piece of malware named GrimBolt. GrimBolt is a backdoor developed in C# that is compiled using native ahead-of-time (AOT) compilation and packed with UPX, which makes it more difficult to analyze. The malware provides remote shell capabilities. “It’s unclear if the threat actor’s replacement of BrickStorm with GrimBolt was part of a pre-planned life cycle iteration by the threat actor or a reaction to incident response efforts led by Mandiant and other industry partners,” GTIG and Mandiant said. Both GrimBolt and BrickStorm were deployed on systems running Dell RecoverPoint for Virtual Machines. The initial access method has yet to be confirmed, but one likely vector is edge appliances. In addition to GrimBolt and BrickStorm, the attacks exploiting CVE-2026-22769 involved the deployment of a web shell named SlayStyle. Google researchers also discovered that UNC6201 created ‘ghost NICs’ on VMs. After carrying out their malicious activities, the threat actors deleted the NICs, making the attack stealthier and more difficult to investigate. Mandiant CTO Charles Carmakal noted in a LinkedIn post that “nation-state threat actors continue targeting systems that don’t commonly support EDR solutions, which makes it very hard for victim organizations to know they are compromised and significantly prolongs intrusion dwell times.” GTIG and Mandiant have made available indicators of compromise (IoCs) to help defenders detect potential attacks. Related: China Revives Tianfu Cup Hacking Contest Under Increased Secrecy Related: Notepad++ Supply Chain Hack Conducted by China via Hosting Provider

securityweek.comFeb 18, 2026extracted

Chinese hackers exploiting Dell zero-day flaw since mid-2024

A suspected Chinese state-backed hacking group has been quietly exploiting a critical Dell security flaw in zero-day attacks that started in mid-2024. Security researchers from Mandiant and the Google Threat Intelligence Group (GTIG) revealed today that the UNC6201 group exploited a maximum-severity hardcoded-credential vulnerability (tracked as CVE-2026-22769) in Dell RecoverPoint for Virtual Machines, a solution used for VMware virtual machine backup and recovery. "Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability," Dell explains in a security advisory published on Tuesday. "This is considered critical as an unauthenticated remote attacker with knowledge of the hardcoded credential could potentially exploit this vulnerability leading to unauthorized access to the underlying operating system and root-level persistence. Dell recommends that customers upgrade or apply one of the remediations as soon as possible." Once inside a victim's network, UNC6201 deployed several malware payloads, including newly identified backdoor malware called Grimbolt. Written in C# and built using a relatively new compilation technique, this malware is designed to be faster and harder to analyze than its predecessor, a backdoor called Brickstorm. While the researchers have observed the group swapping out Brickstorm for Grimbolt in September 2025, it remains unclear whether the switch was a planned upgrade or "a reaction to incident response efforts led by Mandiant and other industry partners." Targeting VMware ESXi servers The attackers also used novel techniques to burrow deeper into victims' virtualized infrastructure, including creating hidden network interfaces (so-called Ghost NICs) on VMware ESXi servers to move stealthily across victims' networks. "UNC6201 uses temporary virtual network ports (AKA "Ghost NICs") to pivot from compromised VMs into internal or SaaS environments, a new technique that Mandiant has not observed before in their investigations," Mandiant communications manager Mark Karayan told BleepingComputer. "Consistent with the earlier BRICKSTORM campaign, UNC6201 continues to target appliances that typically lack traditional endpoint detection and response (EDR) agents to remain undetected for long periods." The researchers have found overlaps between UNC6201 and a separate Chinese threat cluster, UNC5221, known for exploiting Ivanti zero-days to target government agencies with custom Spawnant and Zipline malware and previously linked to the notorious Silk Typhoon Chinese state-backed threat group (although the two are not considered identical by GTIG). GTIG added in September that UNC5221 hackers used Brickstorm (first documented by Google subsidiary Mandiant in April 2024) to gain long-term persistence on the networks of multiple U.S. organizations in the legal and technology sectors, while CrowdStrike has linked Brickstorm malware attacks targeting VMware vCenter servers of legal, technology, and manufacturing companies in the United States to a Chinese hacking group it tracks as Warp Panda. To block ongoing CVE-2026-22769 attacks, Dell customers are advised to follow the remediation guidance shared in this security advisory. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

bleepingcomputer.comFeb 17, 2026extracted

OT teams are losing the time advantage against industrial threat actors

OT teams are losing the time advantage against industrial threat actors In many industrial environments, internet-facing gateways, remote access appliances, and boundary systems sit close enough to production networks that attackers can move from IT intrusion to operational disruption with limited resistance. Dragos’ 2026 OT/ICS Year in Review describes a threat landscape where adversaries are spending more time learning how physical processes work and less time treating OT access as a passive foothold. A shift in 2025 involved multiple state-aligned groups moving into control-loop mapping. That includes identifying engineering workstations, pulling configuration and alarm files, and collecting enough operational context to interfere with physical outcomes. Control-loop mapping removes a key barrier between unauthorized access and physical impact, since attackers no longer need to guess how a process behaves. “Adversaries are mapping how control systems work, understanding where commands originate, how they propagate, and where physical effects can be induced,” said Robert M. Lee, CEO of Dragos. “We’re seeing the ecosystem evolve with specialized threat groups systematically building access pathways for more capable adversaries to reach OT environments. Meanwhile, ransomware groups are causing more operational disruption and multi-day outages that require OT-specific recovery. Yet industrial organizations significantly underestimate the reach of ransomware into OT environments because they think it’s ‘just IT.’” Dragos tracked 26 threat groups targeting OT environments, including three new groups identified in 2025: AZURITE, PYROXENE, and SYLVANITE. The activity across these groups shows more specialization and a growing division of labor, where one team focuses on gaining access and another focuses on OT operations. Initial access groups are feeding OT-capable operators SYLVANITE was tracked as a large-scale initial access group targeting industrial organizations through internet-facing systems. Its operations relied heavily on rapid exploitation of vulnerabilities in products from Ivanti, F5, SAP, and ConnectWise. The group also used tooling such as Cobalt Strike, Sliver, and multiple web shells, then handed access to other actors, including VOLTZITE. A May 2025 incident involved exploitation of Ivanti Endpoint Manager Mobile (EPMM) at a U.S. utility through CVE-2025-4427 and CVE-2025-4428. Attackers extracted data from the backend MySQL database, including LDAP user details and Office 365 tokens, then replayed those credentials internally for lateral movement. The incident response effort was limited by lack of telemetry in adjacent networks, leaving responders unable to confirm whether attackers moved toward OT systems. This type of access brokering compresses the time between vulnerability disclosure and operational risk. It also increases the number of industrial organizations exposed to follow-on OT attacks, even when the initial compromise appears limited to a DMZ or enterprise-adjacent system. Control-loop reconnaissance is becoming routine KAMACITE and ELECTRUM remained central examples of how access-building translates into disruptive operations. KAMACITE has historically operated as an access development group supporting ELECTRUM, the actor tied to Ukraine’s 2015 and 2016 power outages. In late 2024 through early 2025, KAMACITE expanded beyond Ukraine and targeted the European OT supply chain. Activity included spear phishing aimed at engineering and vendor personnel and long-running conversations using industry-specific terms. After that campaign, KAMACITE shifted into sustained reconnaissance against internet-exposed industrial devices in the United States between March and July 2025. The scanning focused on specific components including Schneider Electric Altivar variable frequency drives, Smart HMIs, Accuenergy AXM modules, and Sierra Wireless Airlink gateways. The sequencing suggested deliberate mapping of entire control loops, moving from operator interfaces to actuators, metering points, and remote gateways. Dragos found no evidence of successful exploitation during the scanning activity. The reconnaissance still indicates that exposed edge devices are being treated as operational intelligence sources, with collected data that could support future disruption planning. Destructive malware development continues to mature ELECTRUM activity in 2025 included destructive operations targeting Ukrainian infrastructure. In late May 2025, the group targeted eight Ukrainian ISPs, with responsibility claimed through the pro-Russian hacktivist persona Solntsepek. Dragos verified outages, including a four-hour disruption affecting Corbina’s autonomous system. In parallel, researchers identified a destructive malware family called PathWiper, linked by Dragos to ELECTRUM with moderate confidence. PathWiper was identified in June 2025, with samples appearing in the wild beginning in March 2025. The malware overwrote filesystem structures, enumerated mounted volumes, and targeted all accessible storage media to cause irreversible data loss. Dragos also identified another destructive wiper variant in December 2025, reinforcing ongoing iteration in ELECTRUM’s malware pipeline. Ransomware remains an OT outage driver Ransomware groups continued to target industrial organizations at scale. Dragos tracked 119 ransomware groups impacting more than 3,300 industrial organizations in 2025, up from 80 groups in 2024. Manufacturing accounted for more than two-thirds of observed victims. A recurring issue involved misclassification of ransomware events as IT-only incidents. In multiple cases, engineering workstations and HMI systems were treated as standard Windows endpoints, even when they supported SCADA or other operational workloads. The operational disruption often came through boundary systems such as VMware ESXi hosts and OT-support servers that ran historian and engineering functions. Visibility gaps are leaving defenders blind Dragos found that 30 percent of its incident response cases in 2025 began with operational staff reporting abnormal behavior, not with alerts or confirmed detection. In many cases, the telemetry required to determine whether cyber activity was involved had never been collected. Dragos estimated fewer than 10 percent of OT networks worldwide have visibility and monitoring in place. The overall pattern across 2025 showed attackers moving faster, operating deeper, and relying on weak segmentation and exposed access paths. The most urgent challenge remains basic: collect OT network data before an incident, monitor remote access pathways, and treat engineering workstations and OT boundary systems as high-value operational assets.

helpnetsecurity.comFeb 17, 2026extracted

3 Threat Groups Started Targeting ICS/OT in 2025: Dragos

Three new threat groups started targeting industrial control systems (ICS) and other operational technology (OT) in 2025, according to a new report from cybersecurity company Dragos. The security firm’s 9th annual Year in Review OT/ICS Cybersecurity Report shows that of the total of 26 threat groups tracked by Dragos, 11 were active in 2025. Three of them are newly added to the list: Sylvanite, Azurite, and Pyroxene. Sylvanite appears to act as a “rapid exploitation broker” that enables the group named Voltzite to access critical infrastructure. Voltzite is known for gaining long-term access to targets, including the US electric grid. Sylvanite has been observed quickly weaponizing n-day vulnerabilities — for instance, it exploited Ivanti VPN vulnerabilities within 48 hours of their disclosure. The hackers then installed persistent web shells on F5 appliances, extracted Active Directory credentials, and then handed over access to Voltzite. The group has targeted electric power, oil and gas, water, manufacturing, and public administration organizations in North America, Europe, Japan, South Korea, the Philippines, Saudi Arabia, and Guam. Sylvanite overlaps with groups and activity previously linked by other cybersecurity firms to China, including UNC5221 (known for the use of the Brickstorm malware). However, Dragos noted that precise attribution remains challenging, and overlapping activity between two groups does not necessarily mean they are the same entity. The second new group, Azurite, has also been linked to threat groups tied by other cybersecurity firms to China, including to Flax Typhoon, Ethereal Panda, and UNC5923. Some links to Voltzite have also been found. The threat group has been seen stealing operational information from manufacturing, automotive, electric, defense, oil and gas, and government organizations in Taiwan, the United States, Japan, South Korea, Australia, and Europe. The hackers have compromised SOHO routers to build proxy infrastructure. They have also leveraged compromised edge devices to pivot to OT, including engineering workstations, from which they can conduct malicious activities using existing software to evade detection. According to Dragos, Azurite has exfiltrated OT network diagrams and operational data, including alarm data, PLC configurations, and HMI data. While the goal may be intellectual property theft, the stolen information could also be used to cause disruption in the targeted organization. “Azurite has not been observed manipulating, stopping, or modifying OT-specific software; it has only identified and exfiltrated information already on target assets,” the security firm said in its report. “This activity is highly likely to support capability development, target designation, and environment awareness for the preparation of offensive operations in case of geopolitical conflict.” The third new group is Pyroxene, whose activity and techniques overlap with groups known to be associated with Iran, including APT35 (Charming Kitten). Pyroxene, which has been around since at least 2023, specializes in cross-domain access, enabling movement from IT to OT networks. The group stands out for its use of social engineering, including creating fake LinkedIn profiles that pose as aerospace recruiters, and the use of wipers. Pyroxene has targeted the manufacturing, transportation, logistics, aerospace, aviation, and utilities sectors in the United States, Europe, and the Middle East. “Wiper malware targeting IT systems can have a severe downstream impact on ICS operations. Destructive wiping of IT systems can render systems unbootable and disrupt operational dependencies, resulting in loss of availability. Even without direct PLC targeting, the loss of supporting IT services can halt operations, delay recovery, and increase safety risk across industrial environments,” the security firm noted. It added, “Dragos assesses with moderate confidence Pyroxene is actively positioning for future ICS-impacting operations by exploiting supply chains, trusted relationships, and IT-OT dependencies, creating a credible risk of disruption or destruction even when OT networks are not directly targeted.” Updates on known threat groups targeting ICS/OT Kamacite, a Russia-linked group tracked by Dragos for more than a decade and responsible for reconnaissance and initial access in Electrum attacks, has been seen expanding its targets beyond Ukraine. The security firm has observed the hackers scanning for industrial devices in the US, including HMIs, gateways, meters, and variable-frequency drives (VFDs). Electrum has been conducting disruptive attacks, often targeting Ukraine. However, this threat group has also recently expanded beyond Ukraine, including for the recent campaign targeting Poland’s power grid. According to Dragos, this appears to be a result of the conflict in Ukraine — or at least the cyber aspect of the war — winding down, and Russian threat actors resuming global operations in the interests of Moscow, as they did before the war. In a briefing with the media, Dragos CEO Robert M. Lee pointed out that threat groups are still largely focusing on the theft of intellectual property. However, they are also increasingly focused on collecting data that can later be used to cause disruption or damage. Dragos’ full 2026 report also includes information on other known threat groups, ransomware attacks on industrial organizations, vulnerabilities affecting ICS/OT products, and recommendations for defenders. Related: 5 Bills to Boost Energy Sector Cyber Defenses Clear House Panel

securityweek.comFeb 17, 2026extracted