Dragos, Schweitzer Engineering Laboratories, Juniper Networks and Bonneville Power Administration have collaborated on a reference architecture called the Converged Industrial Edge for Utilities, formerly the Ambassador Project under the DOE's CEDS...
MITRE Engenuity announced the initial participants for its inaugural ATT&CK Evaluations for ICS, in which ICS security vendors will be tested on detecting an emulation of the XENOTIME activity group across MITRE's ICS-ATT&CK knowledgebase of 11 tactics and...
Dragos released its latest monthly Knowledge Pack to Dragos Platform customers, delivering threat behavior analytics, ICS/OT device data, and investigation playbooks. The release also maps Platform detections to MITRE ATT&CK for ICS Tactics and Techniques,...
Dragos published a Manufacturing Sector Cyber Threat Perspective reporting that it publicly tracks five ICS-focused activity groups targeting manufacturing - CHRYSENE, PARISITE, MAGNALLIUM, WASSONITE, and XENOTIME - alongside ransomware capable of...
The SolarWinds supply chain compromise delivered affected software to 18,000 organizations, with follow-on adversary activity publicly supported in the dozens, and in compromised Orion instances the adversary had uncontested access as early as October...
Dragos describes a framework for assessing how open source intelligence (OSINT) lets adversaries plan ICS attacks, including collecting data on energy infrastructure and physical processes needed to recover from a compromise. The blog cites the July 2020...
Dragos reported that its annual recurring revenue grew over 80% in 2020 and its Dragos Platform customer count rose more than 200% year-over-year, following a $110 million Series C funding round announced December 8, 2020. The company said more than a...
The City of Oldsmar disclosed an unlawful intrusion into its water treatment system in which an attacker used TeamViewer, installed on an operator machine and reachable from the internet, to raise the sodium hydroxide dosing setpoint from 100 ppm to 11,100...
Dragos launched a QRadar Device Support Module that integrates its Dragos Platform with IBM Security QRadar SIEM, certified for release and available through the IBM Security App Exchange. The module uses QRadar's open APIs so defenders can manage and...
Dragos describes updates to its OT security platform, including configurable dashboards that surface asset and protocol communications on login, improved baselines for spotting deviations, and MITRE ATT&CK for ICS Threat IDs incorporated across the...
Dragos released its annual ICS 2020 Year in Review report on February 24, 2021, stating that its data shows a 3x rise in ICS-focused threats converging with a more hyperconnected industrial environment. The report covers ICS/OT cyber threats,...
Dragos published its fourth annual ICS Cybersecurity Year in Review, reporting that analysts uncovered four new ICS Activity Groups in 2020 - KAMACITE, STIBNITE, TALONITE, and VANADINITE - primarily targeting energy and manufacturing, while the 11 groups...
Dragos disclosed KAMACITE as one of four new ICS threat activity groups in its ICS Cybersecurity 2020 Year in Review, describing a set of related behaviors targeting electric utilities, oil and gas operations, and manufacturing since at least 2014. The...
Dragos published new guidance this week outlining a process for industrial leaders to create or refine cyber risk management programs for ICS and OT environments, built on existing standards and meant to get executives, risk managers, and practitioners...
Dragos built the capture-the-flag event for the 2021 SANS ICS Summit, its 16th year, using tactics tied to the XENOTIME activity group, which deployed TRISIS malware against a Middle East victim in 2017 and by February 2019 was probing U.S. and other...
Dragos disclosed VANADINITE, a new ICS threat activity group targeting electric utilities, oil and gas, manufacturing, telecommunications, and transportation across North America, Europe, Asia, and Australia, with activity largely focused on industrial...
Dragos disclosed a new ICS threat activity group, STIBNITE, which ran multiple intrusion operations from late 2019 through 2020 against wind generation and government entities in Azerbaijan. STIBNITE gains initial access through credential theft websites...
Dragos describes how industrial incident response requires different equipment than enterprise IR, dividing kits into three categories and recommending organizations mix go-bag, centralized fly-away, and site-specific gear. The post stresses that...
LOGIIC's Project 12, supported by Dragos and other researchers starting in March 2019 and delayed by COVID-19, examined whether intelligent HART-protocol sensors and transmitters used in safety instrumented systems could have their data integrity...
Dragos began tracking the TALONITE activity group in July 2019, which targets U.S. electric sector organizations for initial access using phishing lures built around engineering themes and two custom malware families, LookBack and FlowCloud. Both are...
On May 7th, public reporting emerged that Colonial Pipeline's operations were affected by a ransomware incident in its IT environment, and operators temporarily halted OT operations as a precaution. Dragos assessed with high confidence that the DarkSide...
IronNet Cybersecurity and Dragos announced on May 13, 2021 a joint initiative to integrate IronNet's IronDome threat intelligence sharing solution with Dragos's Neighborhood Keeper, aiming at an integrated IT-OT approach to critical infrastructure...
Dragos investigated the February 2021 Oldsmar, Florida water poisoning attempt and found a Florida water utility contractor's WordPress site had been compromised with a fingerprinting script that profiled over 1,000 end-user computers during a 58-day...
Dragos used Team Cymru internet traffic telemetry to identify a DarkSide affiliate's stolen-data repository on a leased VPS, where data from Colonial Pipeline and other victims was staged via SFTP over SSH port 22, with the campaign beginning in the last...
Dragos opened a blog series on asset visibility for industrial asset owners, arguing that knowing which assets are where and how they behave on the network establishes a baseline of what normal looks like. The post cautions that relying on anomaly...
Dragos and NERC's Electricity Information Sharing and Analysis Center announced a joint initiative, dated June 17, 2021, that gives E-ISAC analysts visibility into ICS cyber threats through Dragos's Neighborhood Keeper technology, an opt-in, anonymized...
Dragos outlines five misconceptions it says keep organizations from reducing risk to ICS/OT environments, including the belief that air gaps still isolate these systems and that IT detection tools work equally well in OT. The article cites the Oldsmar...
Dragos analyzed dozens of cybersecurity standards across ten verticals and found every one biased toward prevention: NIST CSF allocates 60% of controls to Identify and Protect, NIST 800-53 is 95% preventative, and the ISA/IEC 62443 series is 75%...
Dragos announced on July 14, 2021 that it became a founding sponsor of The Smart Factory @ Wichita, a 60,000 square foot Industry 4.0 experience center by Deloitte on Wichita State University's Innovation Campus. The Dragos Platform will be deployed into...
The Transportation Security Administration updated its Pipeline Security Guidelines and issued an accompanying Security Directive adding requirements for pipeline operators to understand industrial cyber risks, operating environments, and incident response...