Skip to main content
OT Atlas

Threats · Activity group

PARISITE

activeIT access with OT relevanceDragosAttribution · Low
Last verified

Executive summary

PARISITE is reported for exploiting known vulnerabilities in VPN appliances to gain access to aerospace, oil and gas, government and utility organisations, and for providing that access to other operations.

At a glance

Tracked byDragos
NexusReported by vendors as Iran-linked
First observed2017 (public reporting)
Last reportedContinued Dragos tracking
ICS kill chainStage 1 — Reconnaissance · Stage 1 — Intrusion

Rosetta Stone

Names across the industry

Every edge states the kind of relationship the public source supports — an alias is not the same as an overlap.

PARISITE
  • Iran-linked access operations reported by multiple vendors
    Technical overlapLow

    Tracked by Multiple vendors

Relevance

Why OT defenders care

Objectives

  • Initial access via VPN vulnerabilities
  • Access enablement for follow-on operations

Reported impacts

  • Access provision; no confirmed process effects

Observed behaviours

  • Exploitation of published VPN vulnerabilities
  • Credential collection from appliances

Targeting

Sectors, geography and assets

Target industries

Oil and gasAerospaceGovernmentElectric power

Target geography

Middle EastNorth AmericaEurope

Observed assets

VPN concentratorRemote access gateway

Protocols in scope

HTTPSSSL VPN

Capability

Malware and tools

Malware, commercial tooling, open-source utilities and native operating-system tools are kept separate — they demand different detections.

Malware

Not publicly established

Commercial tool

Not publicly established

Open-source utility

  • Public exploit tooling for known VPN vulnerabilities

Native OS tool

Not publicly established

ATT&CK

Technique mapping

ATT&CK Enterprise

ATT&CK for ICS

History

Known campaigns and incidents

Reported campaigns

Not publicly established

Atlas incident case studies

Not publicly established

Defence

Defensive hunting priorities

Start with the hunts below — each one is a complete procedure in the Field Playbook.

Priorities

  • Rapid patching of remote access appliances
  • Credential rotation after patching
  • Session monitoring on VPN

Hunt for this activity

  • New remote-access sourceRemote access into the environment originated from a source that has not been seen before.
  • New VPN geographyA remote-access session originated from a country or network the account has never used.

Indicators

Indicator guidance

Indicators expire. Behaviour usually ages better.

This registry deliberately does not republish volatile IP and domain lists. Pull current indicators from the linked authoritative reporting, match them locally against your own telemetry, and invest your standing detections in the behaviours listed above.
Last verified