The Hunt: Detecting VOLTZITE Threat Group Activity in Critical Infrastructure
Summary: Dragos's OT Cyber Threat Intelligence team has tracked VOLTZITE, a threat group targeting ICS environments across critical infrastructure, since early 2023, and notes its overlap with Volt Typhoon, which CISA flagged in advisories in May 2023 and February 2024. In a late-2023 investigation, Dragos OT Watch found a customer network making bidirectional HTTPS connections over TLS v1.2 on port 443 to a known VOLTZITE command and control server, exchanging 3.89 MB, with GIS server data exfiltrated from the IT network and SMB traversal detected near critical OT systems.
Why it matters: The adversary reached the IT network, pulled GIS data out over an encrypted channel, and was probing SCADA-related information next to OT systems without yet touching them - the boundary held, but only after a hunt caught it.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026