New ICS Threat Activity Group: TALONITE
Summary: Dragos began tracking the TALONITE activity group in July 2019, which targets U.S. electric sector organizations for initial access using phishing lures built around engineering themes and two custom malware families, LookBack and FlowCloud. Both are remote access trojans with persistence mechanisms, and Dragos assesses with high confidence that TALONITE lateral movement relies on credential reuse, though it observed no lateral movement itself.
What you should know: Dragos found that 90 percent of its services customers lacked fundamental visibility into ICS environments, meaning most asset owners would be blind to an initial-access and information-gathering campaign that has run against U.S. electric utilities since July 2019.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026