MITRE ATT&CK Evaluations for ICS: Detecting XENOTIME Activity
Summary: MITRE Engenuity announced the initial participants for its inaugural ATT&CK Evaluations for ICS, in which ICS security vendors will be tested on detecting an emulation of the XENOTIME activity group across MITRE's ICS-ATT&CK knowledgebase of 11 tactics and 96 techniques. The emulated attack chain covers XENOTIME's initial access, an engineering workstation, and the loss of safety caused by TRISIS, the malware the group used against safety equipment at a Saudi oil and gas facility in 2017.
What's compelling: XENOTIME is one of only two activity groups Dragos tracks that can build and deploy ICS-specific malware in operations environments, and Dragos calls it the most dangerous group it follows - the evaluation's test case is a real attack chain that ended in lost safety at a live plant.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026