How Adversaries See Your Extended Operational Technology (xOT) Environment
Summary: Dragos describes how adversaries in extended operational technology (xOT) environments build an operational model of how processes work, citing VOLTZITE (overlapping with Volt Typhoon) collecting GIS data, OT network diagrams, SCADA configurations and alarm data from engineering workstations to find conditions that trigger shutdowns. It also cites 628 Akira incidents tracked since the start of 2025, including a 2025 case where, after EDR blocked ransomware on Windows systems, the adversary used an internet-connected Linux webcam outside EDR coverage to deploy ransomware to network shares.
What's compelling: The webcam did not control the manufacturing process, yet its connectivity gave the adversary a path to systems the organization depended on - and many xOT devices cannot run EDR or central management, leaving default credentials, outdated firmware and expired certificates to manual effort that adversaries count on.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026