Threat Proliferation in ICS Cybersecurity: XENOTIME Now Targeting Electric Sector, in Addition to Oil and Gas
Summary: Dragos identified that XENOTIME, the group behind the 2017 TRISIS attack on a Saudi Arabian oil and gas facility, expanded its targeting beyond oil and gas to electric utilities, probing US and Asia-Pacific utility networks starting in late 2018 using tactics similar to its oil and gas operations. The activity matched Stage 1 ICS Cyber Kill Chain reconnaissance and initial access, including attempted authentication with credentials and possible credential stuffing, with no known successful intrusion into electric utility victims to date.
Bottom line: XENOTIME is the only known entity to specifically target safety instrumented systems for disruptive or destructive purposes, and it remains one of only four threats to execute a deliberate disruptive or destructive attack - so its interest in electric utilities means safety and protection equipment there could face the same tradecraft.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026