New ICS Threat Activity Group: STIBNITE
Summary: Dragos disclosed a new ICS threat activity group, STIBNITE, which ran multiple intrusion operations from late 2019 through 2020 against wind generation and government entities in Azerbaijan. STIBNITE gains initial access through credential theft websites spoofing Azeri government organizations and spearphishing with malicious Microsoft Office documents, then drops custom malware called PoetRAT for information gathering and post-exploitation tasks including listing files, taking screenshots, transferring files, and command execution.
What's compelling: Dragos assesses with moderate confidence that STIBNITE's stolen credentials and network information could move it from Stage 1 to a Stage 2 ICS intrusion, and it found that 88 percent of its 2020 services engagements involved significant network segmentation issues and 90 percent of its services customers lacked fundamental visibility into ICS environments.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026