Threat Hunting Part 1: Improving Through Hunting
Summary: Dragos opens a threat-hunting series by noting that only four ICS-tailored malware cases have been deployed against targets: STUXNET, HAVEX, BLACKENERGY 2, and CRASHOVERRIDE, tied to campaigns including Dragonfly and Sandworm. The post names two fundamental ICS security challenges - lack of visibility into what devices exist and their function, and the expertise to respond safely when something is found - and argues hunting can move the blue team from art to science.
What's compelling: With only four known ICS-tailored malware cases and a threat landscape the post calls mostly unknown, hunting measured solely on finding evil will show a very low return on investment - the value sits in closing blind spots you cannot currently see.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026