Skip to main content
OT Atlas

Threats · Activity group

PYROXENE

activeIT access with OT relevanceDragosAttribution · Low
Last verified

Executive summary

PYROXENE is a more recently named Dragos activity cluster reported against industrial and critical-infrastructure organisations. Public technical reporting remains limited relative to older clusters, and this profile deliberately separates what is technically evidenced from what is geopolitical assessment.

Where reporting says activity is 'aligned with' or 'overlaps with' a state interest, this page does not upgrade that to a government identity.

At a glance

Tracked byDragos
NexusNot publicly established as a government attribution
First observed2024 (public reporting)
Last reported2025
ICS kill chainStage 1 — Reconnaissance · Stage 1 — Intrusion

Rosetta Stone

Names across the industry

Every edge states the kind of relationship the public source supports — an alias is not the same as an overlap.

No publicly associated names established for this cluster.

Relevance

Why OT defenders care

Objectives

  • Access to industrial organisations
  • Information collection

Reported impacts

  • No publicly confirmed OT process effects

Observed behaviours

  • Exploitation of internet-facing services
  • Use of valid accounts

Targeting

Sectors, geography and assets

Target industries

Electric powerOil and gasManufacturing

Target geography

Not publicly established in detail

Observed assets

Remote access gatewayCorporate IT supporting OT

Protocols in scope

Not publicly established

Capability

Malware and tools

Malware, commercial tooling, open-source utilities and native operating-system tools are kept separate — they demand different detections.

Malware

Not publicly established

Commercial tool

Not publicly established

Open-source utility

Not publicly established

Native OS tool

Not publicly established

ATT&CK

Technique mapping

ATT&CK Enterprise

ATT&CK for ICS

History

Known campaigns and incidents

Reported campaigns

Not publicly established

Atlas incident case studies

Not publicly established

Defence

Defensive hunting priorities

Start with the hunts below — each one is a complete procedure in the Field Playbook.

Priorities

  • Perimeter exposure management
  • Remote access monitoring

Hunt for this activity

No group-specific hunts mapped yet — start with the core hunt packs.

Indicators

Indicator guidance

Indicators expire. Behaviour usually ages better.

This registry deliberately does not republish volatile IP and domain lists. Pull current indicators from the linked authoritative reporting, match them locally against your own telemetry, and invest your standing detections in the behaviours listed above.
Last verified