Defending SOGARD: Behind the Scenes at the 2021 SANS ICS Summit CTF
Summary: Dragos built the capture-the-flag event for the 2021 SANS ICS Summit, its 16th year, using tactics tied to the XENOTIME activity group, which deployed TRISIS malware against a Middle East victim in 2017 and by February 2019 was probing U.S. and other electric utility networks. The CTF targeted Dragos's own SOGARD brewery ICS range, where a fictional intrusion turned a 15% ABV dark stout into a 4% ABV lager and was attributed to newly identified ICS-tailored malware called BEERSIS.
What you should know: XENOTIME's TRISIS was the first malware known to target safety instrumented systems and could have led to a human safety or loss-of-life event, and the group's later probing of U.S. electric utilities is the threat model your ICS defenders are being trained against.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026