Loading story…
Mandiant reported a red team exercise at a European engineering organization that demonstrated how a financially motivated actor using FIN11-style tactics could move from a standard corporate endpoint into operational technology environments. Starting with regular employee credentials, the team was able to escalate access to domain administrator, steal critical data, and reach OT servers, illustrating how weaknesses between enterprise and OT networks can enable ransomware operators to extend an intrusion beyond traditional IT systems.
The report warns that OT environments remain exposed even though many ransomware incidents have primarily affected enterprise networks. Mandiant said financially motivated groups are increasingly using tradecraft associated with more advanced intrusions, and cited prior CLOP activity linked to FIN11 that used a process kill list containing OT-related processes. That overlap suggests ransomware operators may be capable of disrupting or encrypting critical OT functions without needing deep, specialized OT expertise.
Get the actors, campaigns, and ATT&CK mapping behind it.
2 events from the most recent confirmed update back to the earliest known activity.
Mandiant published a report concluding that OT environments remain at risk from financially motivated actors using ransomware tradecraft similar to advanced intrusion activity. The report also cited prior FIN11-linked CLOP activity that used a process kill list including some OT-related processes, underscoring potential disruption to critical OT functions.
Mandiant carried out a red team engagement for a European engineering organization to test whether ransomware-operator tactics could move from a standard corporate endpoint into operational technology environments. The exercise demonstrated a path from ordinary employee credentials to domain administrator access, data theft, and access to OT servers.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google-owned Mandiant reported that **FIN11** is using widespread email campaigns as an initial access method ahead of ransomware deployment and data theft operations. The activity links high-volume phishing and malicious email delivery to later-stage intrusions, showing how the financially motivated group continues to blend spam-driven access with hands-on post-compromise actions to monetize victims through both encryption and extortion. The reporting indicates that FIN11’s email operations are not isolated nuisance activity but part of a broader intrusion chain that can culminate in **ransomware** and **data exfiltration**. For defenders, the campaign underscores the need to treat large-scale malicious email waves as potential precursors to major incidents, with priority placed on email security controls, rapid investigation of phishing-driven access, and monitoring for follow-on lateral movement, staging, and theft activity after initial compromise.
Jul 12, 2026
Security reporting and expert commentary warn that **operational technology (OT)** environments remain highly exposed due to fragile access controls and that attacker capability is trending toward more dangerous, process-aware operations. Lessons drawn from the 2015 **Ukraine power grid** disruption emphasize that remote connectivity, vendor access, and broad VPN permissions can become the “soft underbelly” of critical infrastructure, with recurring real-world examples of disruption tied to **misused remote access and stolen credentials** (including the **Colonial Pipeline** shutdown following a compromised password). The core takeaway is that OT systems are no longer “too specialized” to be targeted, and that common enterprise intrusion paths—credential compromise and remote access abuse—continue to translate into operational impact when they bridge into industrial environments. Separately, OT-focused threat analysis highlights early signs that attackers are gaining the “process comprehension” historically missing from many intrusions into industrial systems. A forthcoming RSA Conference 2026 presentation is expected to demonstrate **“living-off-the-plant”** techniques—analogous to living-off-the-land in IT—where adversaries leverage native industrial tooling and legitimate functions inside plants to blend in and potentially manipulate physical processes. The reporting argues that “security by obscurity” (attackers’ unfamiliarity with bespoke/legacy OT) has limited the severity of many incidents so far, but that this advantage is eroding as adversaries become more comfortable operating within industrial environments, increasing the risk of more consequential OT attacks.
Jun 29, 2026
Security researchers reported that malware targeting operational technology is broader than rare, bespoke ICS implants alone. Mandiant detailed **COSMICENERGY**, an OT-focused malware framework with similarities to **INDUSTROYER**, **TRITON**, and **INCONTROLLER**, built around insecure industrial protocols such as `IEC-104` and packaged with common Python tooling. Separate Mandiant reporting on **INCONTROLLER** described modular tools including **TAGRUN** for OPC UA reconnaissance, **CODECALL** for Modbus and Schneider Electric PLC interaction, and **OMSHELL** for gaining shell access to Omron PLC environments, enabling actions ranging from tag manipulation and credential attacks to file transfer, traffic capture, and program-memory wiping. At the same time, Forescout found that generic malware families are increasingly reaching into OT environments through exposed devices and weak credentials rather than highly tailored tradecraft. In a VirusTotal hunt, researchers identified botnet-linked samples tied to **Aisuru**, **Kaiten**, and **Gafgyt** that attempted logins against PLCs and other OT products using default credentials, with some samples trying to wipe directories such as `/mnt/modbus_rtu`; affected technologies included devices from Modicon, Siemens, Emerson, Avocent, and Sierra Wireless. Dragos also documented trojanized "password recovery" tools for industrial assets, including one for Automation Direct DirectLogic 06 PLCs that exploited **CVE-2022-2003** to retrieve passwords while infecting engineering workstations with **Sality**, underscoring that OT operators face both purpose-built ICS malware and commodity malware abusing industrial access paths.
Aug 15, 2026