New ICS Threat Activity Group: VANADINITE
Summary: Dragos disclosed VANADINITE, a new ICS threat activity group targeting electric utilities, oil and gas, manufacturing, telecommunications, and transportation across North America, Europe, Asia, and Australia, with activity largely focused on industrial entities in 2019. The group exploited publicly disclosed vulnerabilities in external-facing network and security devices, including CVE-2020-8193 in Citrix ADC, Gateway, and SD-WAN WANOP devices, and U.S. Department of Justice indictments associate activities linked to VANADINITE with operators working on behalf of the People's Republic of China.
Why it matters: Dragos attributes ColdLock ransomware, with low confidence, to VANADINITE, and it caused significant IT disruption at oil and gas companies that indirectly impacted gas station operations throughout Taiwan. Dragos assesses with high confidence the group will keep exploiting recently disclosed vulnerabilities in external-facing appliances for initial access, a technique multiple ICS-targeting adversaries use.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Mentions
- CVE-2020-8193
- Related
- CVE-2020-8193: Citrix ADC, Gateway, and SD-WAN WANOP Appliance Authorization Bypass Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026