Dragos Report Details Voltzite Activity and Three New OT Threat Groups
Summary
Dragos’ 2025 report says three new OT-focused groups emerged and Voltzite, highly correlated with Volt Typhoon, continued activity in US utilities. It details access, reconnaissance and supply-chain operations, while noting some scanning had no confirmed exploitation.
Key points
- Dragos tracked 26 OT-focused threat groups worldwide in 2025, including 11 active groups and three newly tracked groups.
- Dragos said Voltzite, which it describes as highly correlated with Volt Typhoon, continued embedding malware in utility infrastructure for long-term persistence and potential disruption.
- In a pipeline-related campaign, Dragos observed Voltzite compromising Sierra Wireless AirLink devices to access OT networks, exfiltrate operational and sensor data, and steal engineering workstation configuration files and alarm data.
- Dragos said Voltzite used the JDY botnet to scan public IP ranges and VPN appliances; it confirmed no exploitation during this phase and assessed with moderate confidence that the activity appeared to prepare for future intrusions.
- Dragos described Sylvanite as an initial access broker exploiting known vulnerabilities in F5, Ivanti and SAP products to provide access for deeper OT intrusions.
- The report attributed long-term OT access and operational-file exfiltration to Azurite, and supply-chain-leveraged attacks to Pyroxene.
- Dragos reported Kamacite reconnaissance against exposed industrial devices in US water, energy and manufacturing sectors, but found no evidence of successful exploitation during the observed period.
Article Details
- Publisher
- Dragos
- Report Period
- 2025
- Scope
- OT-focused threat activity targeting critical infrastructure, including energy, water, manufacturing, and defense sectors.
- Sample Size
- 26 tracked OT threat groups globally, including 11 active in 2025.
- Key Statistics
- Three new OT-focused threat groups emerged in 2025.
- Dragos tracked 26 OT threat groups globally, of which 11 were active in 2025.
- Kamacite conducted reconnaissance against internet-exposed industrial devices in US water, energy, and manufacturing sectors from March to July 2025.
- Dragos said Sylvanite was reverse engineering vulnerabilities and targeting affected devices within 48 hours of disclosure.
MITRE ATT&CK
T1190 · Exploit Public-Facing ApplicationDragos reported that Sylvanite exploited known vulnerabilities in internet-facing products to provide access for deeper OT intrusions.T1595.001 · Scanning IP BlocksDragos reported that Voltzite used the JDY botnet to scan public-facing IP address ranges and VPN appliances, and that Kamacite performed reconnaissance against internet-exposed industrial devices.
People
Threat Actors
AZURITEDragos reported that Azurite seeks long-term access to OT engineering workstations and exfiltrates operational files. Its activity overlaps with China’s Flax Typhoon.ELECTRUMDragos blamed the December 2025 cyberattacks against Poland’s power grid on Electrum. Its activity overlaps with Sandworm.Flax TyphoonDragos reported that Azurite's activity overlaps with Flax Typhoon.Imperial KittenDragos said Pyroxene's activity overlaps with activity attributed to Imperial Kitten, which the article identifies as also known as APT35.KAMACITEDragos tracks Kamacite as Electrum's initial access provider and reported that it conducted reconnaissance against vulnerable internet-exposed industrial devices in US water, energy, and manufacturing sectors.PARISITEDragos tracks Parisite as an initial access provider into critical infrastructure organizations and reported that it collaborated with Pyroxene in an intrusion.PYROXENEDragos reported that Pyroxene conducted supply-chain-leveraged attacks and used recruitment-themed social engineering to deliver backdoors and other malware. Its activity overlaps with activity attributed to Imperial Kitten.RICH IONThe article identifies APT35 as another name for Imperial Kitten; Dragos reported that Pyroxene's activity overlaps with activity attributed to Imperial Kitten.SandwormThe article describes Sandworm as a GRU-run offensive cyber unit and says Electrum's activity overlaps with it.SYLVANITEDragos tracks Sylvanite as an initial access broker that exploits vulnerabilities in internet-facing products and hands access to Voltzite for deeper OT intrusions.Volt TyphoonDragos reported that Voltzite embedded malware in US utility control systems, compromised Sierra Wireless AirLink devices, and accessed operational data. Dragos described it as highly correlated with Volt Typhoon.
Vendors
F5Sylvanite functions as an initial access broker exploiting F5, Ivanti, and SAP vulnerabilities to hand off access for deeper OT intrusions.IvantiSylvanite functions as an initial access broker exploiting F5, Ivanti, and SAP vulnerabilities to hand off access for deeper OT intrusions.SAPSylvanite functions as an initial access broker exploiting F5, Ivanti, and SAP vulnerabilities to hand off access for deeper OT intrusions.Sierra WirelessThe report details Voltzite’s long-term embedding in utility control systems, use of Sierra Wireless AirLink devices and the JDY botnet, and the roles of Sylvanite, Azurite, Pyroxene, Electrum, and Kamacite in expanded
Products
Tools
Countries
ChinaA second group that emerged during 2025, Azurite, overlaps with China’s Flax Typhoon and focuses on gaining long-term access to OT engineering workstations and exfiltrating operational files including network diagrams,IranIn June 2025, Dragos said the group deployed data-wiping malware against “multiple undisclosed organizations” in Israel around the time of the military conflict between Iran, Israel, and the US.IsraelIn June 2025, Dragos said the group deployed data-wiping malware against “multiple undisclosed organizations” in Israel around the time of the military conflict between Iran, Israel, and the US.PolandHowever, earlier this year, it blamed the December 2025 cyberattacks against Poland’s power grid on a group it tracks as Electrum.RussiaDon’t discount RussiaUkraineRussia also poses a threat to Western water and utilities – along with any nations helping Ukraine in its ongoing war against the Kremlin’s occupation.United StatesThis is the Beijing goon squad that the US government has accused of burrowing into critical American networks for years and readying destructive cyberattacks against those targets.
Industries
AutomotiveThis group targets manufacturing, defense, automotive, electric power, oil and gas, and government organizations across the US, Europe, and the Asia-Pacific region.DefenseIn another Voltzite-linked campaign, Dragos spotted the crew using the JDY botnet to scan for public-facing Internet Protocol (IP) address ranges and VPN appliances across energy, oil, gas, and defense sectors.Electric powervulnerabilities in internet-facing products from F5, Ivanti, and SAP to provide Voltzite access into electric power generation, transmission and distribution, water, sewage, and oil and gas organizations across NorthManufacturingDragos specializes in operational technology (OT) security, and as such, its customers include energy, water, manufacturing, transportation, and other critical industries.Oil and gasVoltzite access into electric power generation, transmission and distribution, water, sewage, and oil and gas organizations across North America, the UK, Europe, Asia and the Middle East.