Loading story…
The oil and gas sector is undergoing a significant transformation in cybersecurity, with a growing emphasis on identity as the central control plane for both operational technology (OT) and information technology (IT) environments. As the industry modernizes, the convergence of IT and OT is accelerating, driven by the adoption of cloud technologies, AI-driven analytics, and the need for improved production, safety, and resilience. This shift is prompting organizations to move beyond legacy tools and siloed approaches, recognizing that modernization and security must be integrated to address evolving threats and regulatory pressures.
At the same time, organizations across critical infrastructure sectors are recognizing the necessity of strong partnerships between CISOs and COOs to ensure operational excellence and resilience. The digital transformation of operations means that cybersecurity incidents now pose existential risks to business continuity, making cyber resilience a core component of operational strategy. Effective collaboration between security and operations leadership is essential to prepare for, respond to, and recover from cyber threats while maintaining uninterrupted business functions.
See the actors and campaigns active against you right now.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Industrial control systems (ICS) and critical infrastructure organizations are facing an escalating threat landscape due to the convergence of operational technology (OT) and information technology (IT), which has eroded traditional security boundaries. As ICS environments become increasingly interconnected with corporate IT networks, they are exposed to a broader array of sophisticated cyber threats, including those from nation-state actors. The consequences of a successful cyberattack on ICS can be severe, ranging from equipment failure and production halts to environmental disasters and threats to human safety. The Colonial Pipeline incident, which resulted from a single compromised password, demonstrated how a digital breach can disrupt physical operations and supply chains, affecting millions of people. In addition to direct attacks on ICS, critical infrastructure organizations must contend with the proliferation of unmonitored data across collaboration platforms such as SharePoint, Google Drive, Exchange, Gmail, Teams, Slack, and Box. This 'back-office clutter' creates a vast, largely ungoverned attack surface that is increasingly targeted by sophisticated adversaries. Sensitive documents, including CAD files, PDFs, and chat transcripts, are often left unclassified and unmonitored, making them attractive targets for cybercriminals. Security leaders have traditionally focused on patching and segmenting OT systems, but the rapid growth of data sprawl in enterprise collaboration tools now demands equal attention. The ease of spinning up new sites and channels for business operations has led to petabytes of data scattered across thousands of locations, often without adequate oversight. This situation is exacerbated by the fact that attackers can exploit these unmonitored environments to gain access to critical systems or sensitive information. The need for robust ICS cybersecurity is now a top priority, as the risks extend far beyond data loss to include operational disruption and public safety hazards. Organizations are urged to implement comprehensive monitoring, classification, and governance of both OT and IT environments to mitigate these risks. The evolving threat landscape requires a shift from traditional, static security measures to dynamic, intelligence-driven approaches that can adapt to new attack vectors. Failure to address these challenges could result in significant operational, financial, and reputational damage for industrial organizations. The integration of continuous monitoring and incident response capabilities is essential to detect and respond to threats in real time. As cyber threats continue to evolve, the security of ICS and the management of enterprise data sprawl must remain at the forefront of critical infrastructure protection strategies. The lessons from past incidents underscore the urgent need for a holistic approach to cybersecurity that encompasses both the physical and digital assets of industrial organizations.
Jun 29, 2026
The energy sector is experiencing significant digital transformation, leading to increased integration between information technology (IT) and operational technology (OT) systems. Joe Doetzl, head of cybersecurity at Hitachi Energy, highlights that this convergence is driven by the need to support distributed grid architectures, power data centers, and expand renewable energy generation, which collectively broaden the threat landscape for both cyber and kinetic attacks. As a result, organizations are adopting unified security strategies and tools to manage risks across both IT and OT environments. Doetzl emphasizes that common governance, risk management, and cybersecurity practices can be applied across IT and OT domains, with centralized leadership and technology stacks enabling more effective enterprise-wide defense. The use of shared tooling for risk measurement and action planning, as well as the integration of data from both environments into a single cyber defense center, are key steps in addressing the evolving security challenges faced by the energy sector.
Jun 29, 2026
CISOs are increasingly required to integrate legal intelligence and robust identity and access management (IAM) strategies to build organizational resilience against evolving cyber threats. Legal compliance is now a core component of cybersecurity, with executives expected to design controls that are both technically sound and legally defensible, addressing criminal, civil, and regulatory requirements across multiple jurisdictions. This approach transforms security from a reactive IT function into a strategic business enabler, emphasizing due diligence, data sovereignty, and the importance of timely breach notification and consent management. Simultaneously, the shift from perimeter-based defenses to identity-centric security has made IAM the defining control plane in modern organizations. With the majority of breaches involving credential misuse, CISOs are urged to adopt dynamic, continuously validated trust models that extend beyond Zero Trust principles. Effective IAM programs must address the complexity of third-party and supply chain identities, automate offboarding, and use identity hygiene as a key risk indicator, ensuring that trust is managed as both a technical and business relationship.
Jul 12, 2026