Azurite
Azurite is a Dragos-tracked OT/ICS-focused threat group identified in 2025 that targets critical infrastructure and industrial organizations. Dragos assesses Azurite as overlapping with China’s Flax Typhoon activity. The group’s described operational focus is gaining long-term access to OT engineering workstations and conducting data exfiltration of operationally relevant files, including network diagrams, alarm data, and process information. Reported targeting includes OT/ICS environments across manufacturing, defense, automotive, electric power, oil and gas, and government organizations, with victim geographies spanning the United States, Europe, and the Asia-Pacific region. Known alias in the provided content: “azurite” (no additional aliases specified).
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Utilities
Tradecraft
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
OT-focused activity cluster overlapping with Flax Typhoon, targeting OT engineering workstations to establish long-term access and exfiltrate data.
Dragos-tracked activity cluster newly observed targeting ICS/OT environments (no further details provided in the content).
Named by Dragos as a newly identified (2025) threat group targeting OT environments; no additional activity details provided in the content.
OT-focused long-term access and operational data theft (engineering workstation access; exfiltration of diagrams/alarm/process data) to support downstream capability development; activity overlaps with Flax Typhoon.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.