How Adversaries Use Spear Phishing to Target Engineering Staff
Summary: Dragos reports that recent spear-phishing campaigns have narrowed their lures to engineering staff and critical-operations personnel, using themes such as a failed licensing exam, fake engineering resumes, and impersonated bodies including NCEES, NERC, GEC, and ASCE. Dragos ties this to tracked groups TALONITE (tracked since July 2019, using LookBack and FlowCloud malware against the U.S. electric sector), ALLANITE (phishing and watering holes against U.S. and UK electric utilities), STIBNITE (wind generation and government targets in Azerbaijan, 2019-2021), and DYMALLOY (2020 compromise of Ukrainian industrial supply providers to harvest NTLM hashes).
What's compelling: A successful click can hand an adversary credentials or a machine with dual access to both IT and OT networks, skipping the slower pivot through IT entirely - and groups like TALONITE have been refining engineering-specific lures since 2019.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026