Threats · Activity group

KOSTOVITE

activeOT-focused accessDragosAttribution · Low

Last verified2026-08-20

Executive summary

KOSTOVITE is reported for compromising remote-access infrastructure at energy organisations and operating almost entirely with living-off-the-land techniques once inside, including reaching OT networks through the same remote-access path legitimate engineers use.

At a glance

Tracked byDragos

NexusNot publicly established as a government attribution

First observed2021 (public reporting)

Last reportedContinued Dragos tracking

ICS kill chainStage 1 — Intrusion · Stage 1 — Collection of OT information

Rosetta Stone

Names across the industry

Every edge states the kind of relationship the public source supports — an alias is not the same as an overlap.

No publicly associated names established for this cluster.

Relevance

Why OT defenders care

Objectives

Access to renewable and energy operations
Persistence through legitimate remote access

Reported impacts

No publicly confirmed process disruption

Observed behaviours

Zero-day exploitation of remote access appliances (as reported)
Living-off-the-land operation inside OT-supporting networks

Targeting

Sectors, geography and assets

Target industries

Electric powerRenewable energy

Target geography

Not publicly established in detail

Observed assets

Remote access gatewayJump hostOT server

Protocols in scope

SSHRDPHTTPS

Capability

Malware and tools

Malware, commercial tooling, open-source utilities and native operating-system tools are kept separate — they demand different detections.

Malware

Not publicly established

Commercial tool

Not publicly established

Open-source utility

Not publicly established

Native OS tool

Native OS administration tooling

ATT&CK

Technique mapping

ATT&CK Enterprise

ATT&CK for ICS

History

Known campaigns and incidents

Reported campaigns

Not publicly established

Atlas incident case studies

Not publicly established

Defence

Defensive hunting priorities

Start with the hunts below — each one is a complete procedure in the Field Playbook.

Priorities

Monitor remote access appliance behaviour
Baseline jump-host sessions
Alert on administrative tooling used outside change windows

Hunt for this activity

New IT-to-OT communication pathA corporate system has begun communicating with an OT asset over a path that is not in the approved conduit list.
New remote-access sourceRemote access into the environment originated from a source that has not been seen before.
Abnormal SSH usageSSH sessions are reaching Linux-based OT infrastructure from unexpected sources or accounts.
Living-off-the-land behaviourBuilt-in operating system tooling is being used for discovery, credential access or movement outside normal administration.
New vendor remote-access pathA vendor is connecting through a path or tool that is not part of the approved remote-access design.
Firewall policy path unexpectedly exercisedA permissive firewall rule that normally sees no traffic has started being used.

Indicators

Indicator guidance

Indicators expire. Behaviour usually ages better.

This registry deliberately does not republish volatile IP and domain lists. Pull current indicators from the linked authoritative reporting, match them locally against your own telemetry, and invest your standing detections in the behaviours listed above.

Sources

Vendor IntelligenceDragos
Threat groups — OT activity group profiles (opens in a new tab)

Last verified2026-08-20