Uncovering ICS Threat Groups
Summary: Dragos explains that threat activity groups are analytic constructs built by clustering intrusion events that share features such as IP addresses, domains, or file hashes, first defined in the Diamond Model of Intrusion Analysis. The company says it names its groups after rare earth minerals and will not standardize naming with other vendors, warning that cross-vendor "Rosetta Stone" correlations are a mistake when the underlying groups were built to answer different analytic questions.
Why it matters: If your threat intelligence depends on matching one vendor's group name to another's, Dragos argues that equivalence is often built on inference rather than direct evidence - and a group of groups assembled without shared analytic principles will be fundamentally incorrect.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026