VOLTZITE Threat Group’s Under the Radar Cyber Espionage on U.S. Critical Systems
Summary: Dragos tracks an active threat group it calls VOLTZITE, which overlaps with Volt Typhoon and the adversary in CISA advisories from May 2023 and February 2024, and has conducted reconnaissance and enumeration against multiple US-based electric companies since 2023. The group has since targeted emergency management services, telecommunications, satellite services, and defense industrial bases, and Dragos has also observed it targeting electric transmission and distribution in Africa.
What you should know: VOLTZITE's living-off-the-land techniques and slow, steady reconnaissance are unlikely to surface through traditional detection methods, which lets the group stretch out its dwell time inside a network - so the cross-zone traffic between your IT and OT networks is where this adversary would be caught, if anyone is watching it.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026