Threats · Activity group

KAMACITE

activeIT access with OT relevanceDragosAttribution · Moderate

Last verified2026-08-20

Executive summary

KAMACITE is the Dragos activity group focused on gaining and maintaining access to industrial organisations — phishing, credential theft and initial-access operations — with reported operational relationships to ICS-effects activity carried out by ELECTRUM.

KAMACITE and ELECTRUM are deliberately tracked as separate clusters. Public reporting supports an access-enablement relationship between them; it does not support flattening them into a single actor.

At a glance

Tracked byDragos

NexusReported as Russia-linked

First observed2014 (public reporting of related operations)

Last reportedContinued reporting through the Russia–Ukraine conflict

ICS kill chainStage 1 — Reconnaissance · Stage 1 — Intrusion · Stage 1 — Management and enablement

Rosetta Stone

Names across the industry

Every edge states the kind of relationship the public source supports — an alias is not the same as an overlap.

KAMACITE

ELECTRUM
Reported linkModerate
Tracked by Dragos — Reported access-enablement relationship, not equivalence.
Sandworm-associated activity
Technical overlapModerate
Tracked by Multiple vendors
BlackEnergy operations
Reported linkModerate
Tracked by Historic vendor reporting

Relevance

Why OT defenders care

Objectives

Initial access into industrial and energy organisations
Credential harvesting
Handoff or enablement of follow-on OT operations

Reported impacts

No direct process effects attributed to KAMACITE itself; reported as an enabler of subsequent operations

Observed behaviours

Spearphishing against industrial organisations
Credential collection and reuse
Persistence in IT networks that support operations

Targeting

Sectors, geography and assets

Target industries

Electric powerOil and gasGovernment

Target geography

UkraineEuropeUnited States

Observed assets

Corporate IT supporting OTRemote access gatewayDomain controller

Protocols in scope

SMTPHTTPSSMBRDP

Capability

Malware and tools

Malware, commercial tooling, open-source utilities and native operating-system tools are kept separate — they demand different detections.

Malware

BlackEnergy-associated toolingReported in historic operations against energy organisations.
Credential phishing infrastructure

Commercial tool

Not publicly established

Open-source utility

Not publicly established

Native OS tool

Not publicly established

ATT&CK

Technique mapping

ATT&CK Enterprise

ATT&CK for ICS

History

Known campaigns and incidents

Reported campaigns

Reported access operations preceding Ukrainian electric sector events

Atlas incident case studies

Not publicly established

Defence

Defensive hunting priorities

Start with the hunts below — each one is a complete procedure in the Field Playbook.

Priorities

Phishing-resistant MFA on all remote access
Monitor for valid-account anomalies in OT-supporting IT
Segment the enablement path between corporate IT and OT

Hunt for this activity

New remote-access sourceRemote access into the environment originated from a source that has not been seen before.
Abnormal RDP usageRDP is being used along a path or at a time that does not match administrative practice.
Account used from a new hostA valid account authenticated from a host it has never used before.
Account used outside the expected maintenance windowAn account with a strictly scheduled purpose was used outside its window.

Indicators

Indicator guidance

Indicators expire. Behaviour usually ages better.

This registry deliberately does not republish volatile IP and domain lists. Pull current indicators from the linked authoritative reporting, match them locally against your own telemetry, and invest your standing detections in the behaviours listed above.

Sources

Vendor IntelligenceDragos
Threat groups — OT activity group profiles (opens in a new tab)
ATT&CKMITRE ATT&CK
Groups (opens in a new tab)

Last verified2026-08-20