Security Report · raw.githubusercontent.com

Dragos 2026 OT Security Report Details Threat Groups Mapping Industrial Control Loops

Oct 21, 2026 · Original Report (PDF) ↗

Report discovered via Awesome Annual Security Reports.

Summary

Dragos's 2026 OT/ICS report identifies three new threat groups and describes adversaries mapping industrial control loops. Its 2025 findings highlight access handoffs, operational data theft, ransomware disruption, and widespread monitoring gaps.

Key points

Dragos identified AZURITE, PYROXENE, and SYLVANITE in 2025, bringing its tracked OT-focused threat groups to 26; eleven were active during the year.
AZURITE stole operational data from engineering workstations, including project files and alarm information. Dragos has not observed it manipulating, stopping, or modifying OT-specific software.
PYROXENE used recruitment-themed social engineering, watering holes, and credential harvesting. Dragos observed wiper deployments against Israeli organizations and assesses with moderate confidence that the group is positioning for future ICS-impacting operations.
SYLVANITE exploited internet-facing systems, harvested credentials and tokens, and handed access to VOLTZITE. VOLTZITE compromised Sierra Wireless AirLink gateways and manipulated engineering workstation software to extract configuration and alarm data.
KAMACITE scanned exposed U.S. industrial devices from March through July 2025 in a pattern Dragos interprets as control-loop mapping; Dragos found no evidence of successful exploitation during that period.
Dragos tracked 119 ransomware groups affecting 3,300 industrial organizations in 2025, with manufacturing accounting for more than two-thirds of observed victims. All its OT ransomware response cases that year involved significant operational disruption.
Dragos estimates fewer than 10 percent of OT networks worldwide have visibility and monitoring, limiting the report's coverage. It recommends ICS-aware monitoring, strict IT/OT segmentation, governed remote access, and timely patching of exposed systems.

Article Details

Publisher: Dragos
Report Period: 2025-01-01 to 2025-12-31
Scope: Global OT/ICS threats, industrial ransomware, ICS-relevant vulnerabilities, and findings from Dragos security engagements.
Key Statistics: Dragos tracked 26 OT-focused threat groups; 11 were active in 2025, including three newly designated groups.
Dragos tracked 119 ransomware groups impacting approximately 3,300 industrial organizations in 2025; actual incidence is likely higher because of unreported or undetected incidents.
Dragos estimates that fewer than 10 percent of OT networks worldwide have visibility and monitoring; the report represents a minimum view of observed activity.
Four percent of ICS-relevant vulnerabilities had a public proof of concept and were actively exploited in 2025.
Dragos Architecture Reviews identified substantial OT/ICS visibility and monitoring deficiencies in 46 percent of 2025 assessments.
Recommendations: Eliminate direct internet exposure of OT devices and management interfaces; enforce IT/OT segmentation, monitored DMZs, and explicitly permitted communication paths.
Maintain accurate asset inventories and collect centralized network and device telemetry, including ICS-aware monitoring, remote-access audit trails, and PowerShell execution logs.
Require MFA and least-privilege access across remote-access pathways; govern vendor access, remove shared or default credentials, and review privileged sessions.
Prioritize remediation using exploitability, external exposure, operational consequences, and observed targeting rather than CVSS alone; apply compensating controls where patching is impractical.
Exercise ICS incident-response plans covering loss of view, control, and availability, including manual-operation decisions, controller integrity validation, safe isolation, and coordinated engineering, operations, safety, and cybersecurity response.