Industrial cybersecurity company Dragos on Tuesday published its 2025 OT/ICS Cybersecurity Report, which provides insights on the threat activity and trends observed last year.
Dragos tracks a total of 23 threat groups that have targeted OT organizations over the past years, and nine of them were active in 2024.
Two of them are newly added groups. One of them has been named Bauxite, which has been linked to Iran. Operating under the hacktivist persona CyberAv3ngers, Bauxite has targeted organizations in the US, Europe, Australia and the Middle East, including sectors such as energy, water, food and beverage, and chemical manufacturing.
The hackers were recently seen using a custom-built malware named IOCONTROL to target IoT and OT devices in the US and Israel.
The second group added to Dragos’ list has been named Graphite. This Russia-linked threat actor is also known as APT28 and it has mainly targeted entities related to the Ukraine military conflict.
Save the date: 2025 ICS Cyber Security Conference – October 27-30, Atlanta
Of the nine groups that were active in OT operations in 2024, four are known to have ICS Cyber Kill Chain Stage 2 capabilities, which indicates that they can develop and test specific and meaningful attacks on industrial control systems.
In addition to Bauxite, the list of groups with Stage 2 capabilities includes Chernovite (the group behind the Pipedream/Incontroller attack), Voltzite (aka Volt Typhoon, which exfiltrated sensitive OT data), and Electrum (aka Sandworm, which developed a new wiper capability named AcidPour).
Dragos noted that AcidPour can target OT devices and has the potential to cause significant damage and disruption.
The ICS/OT security firm has also tracked ransomware attacks on industrial organizations, which surged last year. Dragos saw 80 groups targeting industrial organizations, up from 50 groups in 2023, and an overall increase of 87% in ransomware activity compared to the previous year.
The company noted that it did not see any ICS-specific ransomware, but these types of threats did cause disruptions and allowed the exfiltration of sensitive data that could be used for further malicious activity.
Two new pieces of ICS malware came to light in 2024: Fuxnet, a destructive malware used by Ukraine against Russian infrastructure, and FrostyGoop, which left a Ukrainian city’s residents without heating.
The full Dragos 2025 OT/ICS Cybersecurity Report is available in PDF format.
Related: Free Diagram Tool Aids Management of Complex ICS/OT Cybersecurity Decisions
Related: Orthanc Server Vulnerability Poses Risk to Medical Data, Healthcare Operations
Related: Cyber Insights 2025: OT Security
