Loading threat actor…
KAMACITE is a Russia-linked OT-focused intrusion and access-development threat cluster associated with the Sandworm ecosystem, overlapping with reporting under APT44 and Seashell Blizzard. The group has been active since at least 2014 and is best characterized as an initial-access and reconnaissance element that supports follow-on operations by ELECTRUM, including disruptive activity against industrial environments. KAMACITE has been linked to OT-specific operations surrounding the BLACKENERGY2 campaign and the 2015 and 2016 Ukraine electric power incidents, where it is assessed to have enabled access later used for grid disruption. KAMACITE has consistently targeted critical infrastructure and industrial organizations, especially electric utilities, oil and gas, water, manufacturing, and broader OT supply-chain entities. Confirmed targeting includes Ukrainian electricity infrastructure, U.S. energy companies, U.S. industrial sectors, and reconnaissance against liquefied natural gas infrastructure in the Netherlands. The group has also conducted operations across Europe and North America and expanded beyond Ukraine to target the European OT supply chain. Its tradecraft centers on establishing and maintaining footholds through spear-phishing, credential theft and abuse of stolen credentials, brute-force logons against remote services, and exploitation of exposed edge infrastructure and internet-facing services. Reported activity includes targeting authentication surfaces such as enterprise remote access and cloud identity services, exploiting firewall and router vulnerabilities, and using compromised SOHO or edge devices to support access operations. KAMACITE has also conducted sustained reconnaissance and scanning of internet-exposed industrial devices to map operational environments and identify pathways into OT networks. The group is assessed to perform long-dwell reconnaissance, persistence, and low-profile access development, then hand off access to ELECTRUM for deeper OT intrusion or disruptive actions. KAMACITE demonstrates capability to pivot toward OT environments and support Stage 1 of the ICS Cyber Kill Chain, with repeated emphasis on reconnaissance, access enablement, and persistence rather than direct deployment of ICS-disruption tooling. Its role within the Sandworm-aligned ecosystem reflects a division of labor in which KAMACITE develops access and operational context while ELECTRUM executes OT-impacting actions. The actor’s targeting of critical infrastructure, especially energy-related assets, aligns with espionage and pre-positioning for potential disruptive operations.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
10 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 malware families attributed to this actor across reporting.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Threat group involved in attacks on industrial targets, providing initial access via phishing before handing operations to ELECTRUM.
Access development and reconnaissance group historically supporting ELECTRUM; conducted spear-phishing against OT supply-chain personnel and later performed targeted scanning/reconnaissance of exposed industrial edge devices consistent with control-loop mapping.
Initial access provider for Electrum; conducted reconnaissance/scanning of vulnerable internet-exposed industrial devices in US water, energy, and manufacturing sectors.
Initial access/reconnaissance activity supporting Electrum, characterized by precision scanning of internet-exposed industrial devices in US critical infrastructure sectors.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.