Dragos
Ransomware & Extortion
Cybercrime, Malware & Attack Techniques
OT/ICS Cybersecurity Year in Review 2025
Dragos' 8th annual OT/ICS Cybersecurity Year in Review analyzes the 2024 threat landscape and shows OT is no longer a niche target: adversaries, hacktivists and ransomware crews are converging on industrial systems as geopolitical conflict continues. Dragos now tracks 23 threat groups (9 active in 2024) and identified two new ones — GRAPHITE (APT28-linked; hydro, energy, logistics, defense in Eastern Europe/Middle East, credential-phishing that bypasses 2FA, Ubiquiti EdgeRouter C2, growing use of legitimate internet services) and BAUXITE (oil & gas, electric, water/wastewater and chemical manufacturing across the US, Europe, Australia and Middle East). Russia-linked KAMACITE and ELECTRUM continue to collaborate on Ukraine-focused OT operations, with KAMACITE broadening spear-phishing (LummaStealer, TAT24-97 loader) to European ONG targets and ELECTRUM extending its wiper arsenal with AcidPour (an evolution of AcidRain, which had disrupted KA-SAT and German wind turbines). China-linked VOLTZITE remains the most critical group to track in critical infrastructure, exploiting internet-facing VPN/firewall bugs and using living-off-the-land techniques against SOHO routers and shared botnets (65% of sites assessed had insecure remote conditions). Ransomware attacks rose 87% year over year, hitting manufacturing hardest where downtime forces payment; CARR-style campaigns showed even basic HMI abuse over internet-exposed OT can cause tangible disruption. Vulnerability analysis: 22% of 2024 advisories had incorrect data, 22% were network-exploitable and perimeter-facing, 39% could cause both loss of view AND loss of control (down from 53%), and Dragos provided mitigations for 47% of advisories that shipped without any. The report reiterates the SANS ICS 5 Critical Controls and the "Now, Next, Never" framework as the best defense, and highlights supply chain / DLL-hijack risks, servo drives, and IoT in ICS as emerging research areas.
Feb 2025Read →
