Launched: 9th Annual Dragos OT Cybersecurity Year in Review
Summary: Dragos released its 9th Annual OT Cybersecurity Year in Review, reporting that adversaries are moving beyond pre-positioning to actively mapping control loops and learning to manipulate physical processes. The report introduces three new threat groups (AZURITE, PYROXENE, SYLVANITE), tracks KAMACITE and ELECTRUM expanding into the United States and Europe, and counts 119 ransomware groups hitting 3,300 industrial organizations in 2025, a 49 percent increase from 80 groups in 2024.
What you should know: KAMACITE conducted systematic reconnaissance of U.S. industrial devices from March to July 2025, mapping control loops across HMIs, VFDs, meters and remote gateways together, and in December 2025 ELECTRUM hit Polish energy infrastructure in the first major coordinated attack on distributed energy resources at scale. Dragos also found 82 percent of organizations lack clear criteria for when operational anomalies should trigger a cyber investigation, and 73 percent of all-time IR cases involved compromised VPN or jumphost credentials.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026