Threat Analytics and Activity Groups
Summary: Dragos describes a shift in OT defense from indicator-of-compromise (IOC) approaches, which are backward-looking and target-specific, to threat behavioral analytics built on adversary tactics, techniques, and procedures. It illustrates this with activity groups derived from the Diamond Model, such as DYMALLOY's HMI screenshot exfiltration and ELECTRUM, the group responsible for CRASHOVERRIDE, using living-off-the-land techniques for network pivoting.
What's compelling: An IOC-based defense has almost no value in catching previously unobserved intrusions, and the source notes that most IOCs captured after an intrusion are unique to that event and will not recur. The tradeoff it names is concrete: a general behavior analytic catches any permutation of a technique but leaves the analyst with a wider field of possibilities, while a group-specific analytic narrows the investigation at the cost of breadth.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026