Loading story…
Operational technology (OT) and industrial control system (ICS) defenders face a critical challenge due to the lack of available data on real-world cyberattacks. Unlike IT environments, where logs and telemetry are routinely collected and analyzed post-incident, most OT operators do not capture sufficient data, making forensic analysis and incident response extremely difficult. Rob Lee, CEO of Dragos, highlights that in OT environments, instructions—whether legitimate or malicious—are transient and often disappear unless specialized monitoring tools are in place prior to an attack.
This data scarcity leaves OT environments particularly vulnerable, especially as nation-state adversaries increasingly target critical infrastructure. Without proactive data collection and monitoring, organizations have little chance of determining whether a cyberattack has occurred or understanding its impact, putting essential services at risk and leaving significant blind spots in national and industrial cybersecurity posture.
See the actors and campaigns active against you right now.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Dragos’ annual review of cyberattacks targeting **operational technology (OT)** warns of a “silent epidemic” of **ransomware impacting commercial OT environments** that is frequently **mischaracterized as an IT-only incident**, obscuring operational impact and hindering effective response. Dragos CEO **Rob Lee** attributed this to gaps in OT understanding within IT security teams and to insufficient collection of OT network telemetry needed to perform reliable root-cause analysis and accurately scope incidents. The report also highlights concerning evolution in **nation-state OT threat activity**, describing a shift from basic initial-access efforts toward **OT-focused reconnaissance** and **pre-positioning** intended to enable future disruptive or real-world effects. Overall, Dragos frames the combination of limited OT visibility, misclassification of incidents, and increasingly purposeful nation-state operations as key risk drivers for organizations running industrial and other OT systems.
Jun 29, 2026
Security reporting and expert commentary warn that **operational technology (OT)** environments remain highly exposed due to fragile access controls and that attacker capability is trending toward more dangerous, process-aware operations. Lessons drawn from the 2015 **Ukraine power grid** disruption emphasize that remote connectivity, vendor access, and broad VPN permissions can become the “soft underbelly” of critical infrastructure, with recurring real-world examples of disruption tied to **misused remote access and stolen credentials** (including the **Colonial Pipeline** shutdown following a compromised password). The core takeaway is that OT systems are no longer “too specialized” to be targeted, and that common enterprise intrusion paths—credential compromise and remote access abuse—continue to translate into operational impact when they bridge into industrial environments. Separately, OT-focused threat analysis highlights early signs that attackers are gaining the “process comprehension” historically missing from many intrusions into industrial systems. A forthcoming RSA Conference 2026 presentation is expected to demonstrate **“living-off-the-plant”** techniques—analogous to living-off-the-land in IT—where adversaries leverage native industrial tooling and legitimate functions inside plants to blend in and potentially manipulate physical processes. The reporting argues that “security by obscurity” (attackers’ unfamiliarity with bespoke/legacy OT) has limited the severity of many incidents so far, but that this advantage is eroding as adversaries become more comfortable operating within industrial environments, increasing the risk of more consequential OT attacks.
Jun 29, 2026
Industrial control systems (ICS) and critical infrastructure organizations are facing an escalating threat landscape due to the convergence of operational technology (OT) and information technology (IT), which has eroded traditional security boundaries. As ICS environments become increasingly interconnected with corporate IT networks, they are exposed to a broader array of sophisticated cyber threats, including those from nation-state actors. The consequences of a successful cyberattack on ICS can be severe, ranging from equipment failure and production halts to environmental disasters and threats to human safety. The Colonial Pipeline incident, which resulted from a single compromised password, demonstrated how a digital breach can disrupt physical operations and supply chains, affecting millions of people. In addition to direct attacks on ICS, critical infrastructure organizations must contend with the proliferation of unmonitored data across collaboration platforms such as SharePoint, Google Drive, Exchange, Gmail, Teams, Slack, and Box. This 'back-office clutter' creates a vast, largely ungoverned attack surface that is increasingly targeted by sophisticated adversaries. Sensitive documents, including CAD files, PDFs, and chat transcripts, are often left unclassified and unmonitored, making them attractive targets for cybercriminals. Security leaders have traditionally focused on patching and segmenting OT systems, but the rapid growth of data sprawl in enterprise collaboration tools now demands equal attention. The ease of spinning up new sites and channels for business operations has led to petabytes of data scattered across thousands of locations, often without adequate oversight. This situation is exacerbated by the fact that attackers can exploit these unmonitored environments to gain access to critical systems or sensitive information. The need for robust ICS cybersecurity is now a top priority, as the risks extend far beyond data loss to include operational disruption and public safety hazards. Organizations are urged to implement comprehensive monitoring, classification, and governance of both OT and IT environments to mitigate these risks. The evolving threat landscape requires a shift from traditional, static security measures to dynamic, intelligence-driven approaches that can adapt to new attack vectors. Failure to address these challenges could result in significant operational, financial, and reputational damage for industrial organizations. The integration of continuous monitoring and incident response capabilities is essential to detect and respond to threats in real time. As cyber threats continue to evolve, the security of ICS and the management of enterprise data sprawl must remain at the forefront of critical infrastructure protection strategies. The lessons from past incidents underscore the urgent need for a holistic approach to cybersecurity that encompasses both the physical and digital assets of industrial organizations.
Jun 29, 2026