Skip to main content
OT Atlas

Threats · Activity group

VANADINITE

activeIT access with OT relevanceDragosAttribution · Low
Last verified

Executive summary

VANADINITE is reported for exploiting internet-facing infrastructure — including widely exploited enterprise application vulnerabilities — to access energy, manufacturing and transportation organisations, with public reporting describing overlap with activity other vendors track as part of the Winnti-associated ecosystem.

At a glance

Tracked byDragos
NexusReported by vendors as China-linked
First observed2019 (public reporting)
Last reportedContinued Dragos tracking
ICS kill chainStage 1 — Reconnaissance · Stage 1 — Intrusion

Rosetta Stone

Names across the industry

Every edge states the kind of relationship the public source supports — an alias is not the same as an overlap.

VANADINITE
  • Winnti-associated reporting
    Technical overlapLow

    Tracked by Multiple vendors

Relevance

Why OT defenders care

Objectives

  • Access to industrial organisations through exposed applications
  • Information collection

Reported impacts

  • No publicly confirmed OT process effects

Observed behaviours

  • Mass exploitation of newly disclosed application vulnerabilities
  • Web shell persistence

Targeting

Sectors, geography and assets

Target industries

Electric powerManufacturingTransportationOil and gas

Target geography

EuropeNorth AmericaAsia

Observed assets

Perimeter web applicationRemote access gatewayCorporate IT supporting OT

Protocols in scope

HTTPSSMB

Capability

Malware and tools

Malware, commercial tooling, open-source utilities and native operating-system tools are kept separate — they demand different detections.

Malware

  • Web shells

Commercial tool

Not publicly established

Open-source utility

  • Public exploit tooling

Native OS tool

Not publicly established

ATT&CK

Technique mapping

ATT&CK Enterprise

ATT&CK for ICS

History

Known campaigns and incidents

Reported campaigns

Not publicly established

Atlas incident case studies

Not publicly established

Defence

Defensive hunting priorities

Start with the hunts below — each one is a complete procedure in the Field Playbook.

Priorities

  • External attack surface management
  • Web shell detection on perimeter servers
  • Rapid patching

Hunt for this activity

Indicators

Indicator guidance

Indicators expire. Behaviour usually ages better.

This registry deliberately does not republish volatile IP and domain lists. Pull current indicators from the linked authoritative reporting, match them locally against your own telemetry, and invest your standing detections in the behaviours listed above.
Last verified