Skip to main content
OT Atlas

Threats · Activity group

SYLVANITE

activeIT access with OT relevanceDragosAttribution · Moderate
Last verified

Executive summary

SYLVANITE is reported as an access-development cluster: it specialises in compromising internet-facing edge infrastructure, rapidly weaponising newly disclosed vulnerabilities, and establishing footholds that other operations then use. Public reporting describes handoff of that access to VOLTZITE follow-on activity.

Defensively, SYLVANITE is a reminder that the edge device is the front door of most OT-supporting networks, and that patch latency on VPNs and firewalls is measured against the actor's exploitation speed.

At a glance

Tracked byDragos
NexusNot publicly established as a government attribution
First observed2024 (public reporting)
Last reported2025
ICS kill chainStage 1 — Reconnaissance · Stage 1 — Intrusion

Rosetta Stone

Names across the industry

Every edge states the kind of relationship the public source supports — an alias is not the same as an overlap.

SYLVANITE
  • VOLTZITE
    Reported linkModerate

    Tracked by Dragos — Reported access handoff relationship, not equivalence.

Relevance

Why OT defenders care

Objectives

  • Rapid exploitation of edge-device vulnerabilities
  • Credential theft
  • Durable access for follow-on operations

Reported impacts

  • Access provision enabling later intrusion activity

Observed behaviours

  • Exploitation within days of vulnerability disclosure
  • Web shell installation on appliances
  • Credential extraction from device configuration

Targeting

Sectors, geography and assets

Target industries

Electric powerOil and gasManufacturingTelecommunications

Target geography

United StatesGlobal

Observed assets

VPN concentratorFirewallRemote access gatewayPerimeter web application

Protocols in scope

HTTPSSSHIPsec / SSL VPN

Capability

Malware and tools

Malware, commercial tooling, open-source utilities and native operating-system tools are kept separate — they demand different detections.

Malware

  • Web shells

Commercial tool

Not publicly established

Open-source utility

  • Tunnelling utilities

Native OS tool

Not publicly established

ATT&CK

Technique mapping

ATT&CK Enterprise

ATT&CK for ICS

History

Known campaigns and incidents

Reported campaigns

  • Not publicly established as named campaigns

Atlas incident case studies

Not publicly established

Defence

Defensive hunting priorities

Start with the hunts below — each one is a complete procedure in the Field Playbook.

Priorities

  • Emergency patch path for internet-facing appliances, decoupled from OT change windows
  • Rotate device credentials and certificates after any appliance patch
  • Log and baseline outbound connections originating from appliances themselves

Hunt for this activity

Indicators

Indicator guidance

Indicators expire. Behaviour usually ages better.

This registry deliberately does not republish volatile IP and domain lists. Pull current indicators from the linked authoritative reporting, match them locally against your own telemetry, and invest your standing detections in the behaviours listed above.
Last verified