TALONITE

TALONITE is an ICS/OT-focused threat activity group tracked since 2019 for campaigns centered on initial access and information gathering against the electric sector, especially in the United States. Its operations have shown a near-exclusive focus on electric utilities, with additional earlier evidence of targeting entities in Japan and Taiwan. TALONITE is assessed as a serious threat to electric-sector organizations because it appears designed to establish footholds in enterprise environments that could enable follow-on operations against operationally sensitive networks. TALONITE primarily gains access through spearphishing campaigns using engineering-themed lures and malicious documents or executables. The group has used custom malware families known as LookBack and FlowCloud, both functioning as remote access trojans with persistence mechanisms and host-data collection capabilities. Reported functionality includes credential capture, persistence, and collection of system and host information. The group also abuses or modifies legitimate binaries to conceal malicious activity and blends adversary-controlled with occasionally compromised infrastructure to complicate tracking and containment. Observed activity supports TALONITE as an initial-access and post-compromise collection actor rather than a confirmed disruptive ICS operator. There is no confirmed evidence that it penetrated control system networks or executed disruptive operations in victim environments. Although direct lateral movement was not observed, available malware capabilities support an assessment that the group likely could leverage stolen or reused credentials for follow-on movement. Behavioral and tooling overlap has been noted with activity tracked by some organizations as APT10, also known as menuPass or Stone Panda, but no definitive attribution to a known intrusion set or state sponsor has been established.