One adversary. Many names.

Dragos · OT-focused access

VOLTZITE is the Dragos activity group tracking intrusions into US critical infrastructure that overlap heavily with the activity governments and vendors report as Volt Typhoon. The defining characteristic is patience: long-dwell access obtained through internet-facing edge devices, maintained almost entirely with living-off-the-land techniques, and used to collect information about operational technology rather than to cause an immediate effect.

Also reported as Volt Typhoon, BRONZE SILHOUETTE, Vanguard Panda +4

Dragos · Stage 2 ICS effects

ELECTRUM is the Dragos activity group associated with ICS-capable operations against the Ukrainian electric sector, including the 2016 Kyiv transmission substation event and later attempts using updated Industroyer capability. It is the cluster that demonstrably possesses and has deployed malware able to speak electric-sector protocols directly to field equipment.

Also reported as Sandworm Team, APT44, Seashell Blizzard +6

Dragos · IT access with OT relevance

KAMACITE is the Dragos activity group focused on gaining and maintaining access to industrial organisations — phishing, credential theft and initial-access operations — with reported operational relationships to ICS-effects activity carried out by ELECTRUM.

Also reported as ELECTRUM, Sandworm-associated activity, BlackEnergy operations

Dragos · Stage 2 ICS effects

XENOTIME is the Dragos activity group associated with the TRITON / TRISIS intrusion, in which malware was written to interact with Schneider Electric Triconex safety instrumented systems at a petrochemical facility. It is the only publicly reported activity group whose capability was aimed directly at a safety instrumented system.

Also reported as TEMP.Veles, TRITON / TRISIS, HatMan

Dragos · Stage 2 ICS effects

CHERNOVITE is the Dragos activity group credited with developing PIPEDREAM, the modular ICS attack framework discovered before deployment. PIPEDREAM is capability, not an actor: it is the toolset, and CHERNOVITE is the cluster that built it. Conflating the two is the single most common naming error in OT threat intelligence.

Also reported as PIPEDREAM, INCONTROLLER

Dragos · OT-focused access

BAUXITE is the Dragos activity group associated with attacks on internet-exposed industrial devices across water, energy and manufacturing. Public reporting describes technical overlap with the hacktivist-branded persona CyberAv3ngers, which CISA and partner agencies have linked to IRGC-affiliated actors.

Also reported as CyberAv3ngers

Dragos · OT-focused access

AZURITE is a Dragos activity group reported for interest in engineering workstations and the operational data held on them — controller configuration, HMI screens, alarm lists and process documentation. The pattern is collection rather than immediate effect, but the material collected is exactly what an actor would need to build a targeted capability later.

Also reported as Flax Typhoon, Ethereal Panda, UNC5923 +2

Dragos · IT access with OT relevance

SYLVANITE is reported as an access-development cluster: it specialises in compromising internet-facing edge infrastructure, rapidly weaponising newly disclosed vulnerabilities, and establishing footholds that other operations then use. Public reporting describes handoff of that access to VOLTZITE follow-on activity.

Also reported as VOLTZITE

Dragos · IT access with OT relevance

GRAPHITE is a Dragos activity group targeting energy, oil and gas, logistics and government organisations, with public reporting describing technical overlap with the actor widely tracked as APT28. The overlap is technical and analytic — it is not presented here as a direct alias.

Also reported as APT28, Forest Blizzard

Dragos · IT access with OT relevance

PYROXENE is a more recently named Dragos activity cluster reported against industrial and critical-infrastructure organisations. Public technical reporting remains limited relative to older clusters, and this profile deliberately separates what is technically evidenced from what is geopolitical assessment.

No publicly associated names established

Dragos · OT-focused access

KOSTOVITE is reported for compromising remote-access infrastructure at energy organisations and operating almost entirely with living-off-the-land techniques once inside, including reaching OT networks through the same remote-access path legitimate engineers use.

No publicly associated names established

Dragos · IT access with OT relevance

HEXANE is reported for targeting oil and gas and telecommunications organisations, with public reporting describing overlap with activity other vendors track as an Iran-linked cluster. Reported tradecraft is largely IT-side: phishing, credential theft and access to organisations that operate industrial processes.

Also reported as OilRig-adjacent reporting, Lyceum

Dragos · OT-focused access

ALLANITE is reported for access operations against electric utilities in the United States and United Kingdom, including collection of information from business and operations networks. Public reporting emphasises reconnaissance and access rather than demonstrated ICS effects.

Also reported as Palmetto Fusion / Dragonfly-adjacent reporting

Dragos · IT access with OT relevance

CHRYSENE is reported for operations against petrochemical, oil and gas and electricity generation organisations, with public reporting describing a relationship to the tooling ecosystem associated with the Shamoon-era wiper activity. Reported activity is focused on IT-side access into organisations that run industrial processes.

Also reported as OilRig / Greenbug-adjacent reporting

Dragos · OT-focused access

DYMALLOY is reported for deep and long-lived access into electric utilities, oil and gas, and advanced industrial organisations, including access to operator interfaces. Public reporting describes overlap with the widely reported Dragonfly / Energetic Bear activity.

Also reported as Dragonfly / Berserk Bear / Energetic Bear

Dragos · IT access with OT relevance

MAGNALLIUM is reported for targeting oil and gas and aerospace organisations, with public reporting describing overlap with activity other vendors track as APT33. Reported operations focus on enterprise access at organisations that operate industrial processes.

Also reported as APT33, Peach Sandstorm

Dragos · IT access with OT relevance

PARISITE is reported for exploiting known vulnerabilities in VPN appliances to gain access to aerospace, oil and gas, government and utility organisations, and for providing that access to other operations.

Also reported as Iran-linked access operations reported by multiple vendors

Dragos · IT access with OT relevance

PETROVITE is reported for targeting mining and energy operations, primarily through reconnaissance and information collection about operational environments rather than demonstrated ICS effects.

No publicly associated names established

Dragos · IT access with OT relevance

RASPITE is reported for reconnaissance and access operations against electric utilities, including credential-theft techniques delivered through compromised websites. Reported activity is access-focused, with no publicly demonstrated ICS capability.

Also reported as LeafMiner-adjacent reporting

Dragos · IT access with OT relevance

STIBNITE is reported for targeting wind generation and electric utility organisations in North Africa, using credential-theft websites and phishing to gain access to operational organisations.

No publicly associated names established

Dragos · IT access with OT relevance

TALONITE is reported for phishing campaigns against North American electric utilities using malicious documents and custom malware, focused on access rather than demonstrated ICS effects.

No publicly associated names established

Dragos · IT access with OT relevance

VANADINITE is reported for exploiting internet-facing infrastructure — including widely exploited enterprise application vulnerabilities — to access energy, manufacturing and transportation organisations, with public reporting describing overlap with activity other vendors track as part of the Winnti-associated ecosystem.

Also reported as Winnti-associated reporting

Dragos · IT access with OT relevance

WASSONITE is reported for targeting electric generation, nuclear energy, manufacturing and research organisations, using remote access tooling, credential theft and removable-media techniques. Public reporting describes overlap with activity other vendors associate with DPRK-linked operations.

Also reported as Lazarus-associated reporting

Dragos · IT access with OT relevance

BENTONITE is reported for opportunistic targeting of maritime oil and gas, governments and manufacturing through exploitation of internet-accessible assets. Detailed public technical reporting remains limited.

No publicly associated names established

Dragos · IT access with OT relevance

GANANITE is a more recently named Dragos activity group reported against critical infrastructure and government organisations in Central Asia and South Asia, focused on espionage and access. Public technical detail is limited.

No publicly associated names established

Dragos · IT access with OT relevance

LAURIONITE is reported for exploitation of internet-facing enterprise applications at organisations including aviation, healthcare and energy, providing access that could affect OT-supporting IT. Public technical detail is limited.

No publicly associated names established