Dragos Reports Rise in Geopolitically Driven Attacks, Ransomware

New threat groups, state actors and hacktivist groups gained ground, but there's positive movement as well.

Feb 29, 2024

Dragos Inc., the global leader in cybersecurity for operational technology (OT) environments, recently released its sixth annual Dragos OT Cybersecurity Year in Review report. It report named the emergence of three new threat groups, including VOLTZITE linked to Volt Typhoon, and found that ransomware continued to be the most reported cyber threat among industrial organizations - with a nearly 50 percent increase in reported incidents. 2

“OT cyber threats reached a tipping point in 2023,” said Robert M. Lee, Co-founder and CEO of Dragos. “Industial and critical infrastructure has been moving away from highly customized facilities to ones that—for good economic and productivity reasons—share the same industrial devices, technologies, and facility designs across sites and sectors.

"Unfortunately, adversaries are now leveraging these homogenous infrastructures to scale attacks. They also target weaknesses in environments that pushed digital transformation without adequate cybersecurity measures. These factors contributed to an environment in 2023 in which organizations were challenged with a range of threats, including increasingly sophisticated state actors, hacktivists praying on pervasive security weaknesses, and a growing barrage of ransomware attacks.

“There were positive developments for OT cybersecurity too,” continued Lee. “We saw vendors, governments, and the community collaborate to enable a unified, risk-based response to threats, as was the case with the ControlLogix vulnerabilities disclosed by Rockwell Automation.” Additional details of the report include:

Dragos identified three new OT Threat Groups—VOLTZITE, GANANITE, and LAURIONITE. Dragos analysts now track 21 Threat Groups worldwide that have been observed as being engaged in OT operations in 2023.

VOLTZITE overlaps with Volt Typhoon, a group that the U.S. Government has publicly linked to the People’s Republic of China. The group’s threat activities include living off the land (LOTL) techniques, prolonged surveillance, and data gathering aligned with Volt Typhoon’s assessed objectives of reconnaissance and gaining geopolitical advantage in the Asia-Pacific region.

GANANITE targets critical infrastructure and government entities in the Commonwealth of Independent States and Central Asian nations. The group leverages publicly available proof of concept (POC) exploits for internet-exposed endpoints and focuses on espionage and data theft.

LAURIONITE targets and exploits Oracle E-Business Suite iSupplier web services and assets across aviation, automotive, and manufacturing industries. The group utilizes a combination of open-source offensive security tooling and public proof of concepts to aid in their exploitation of common vulnerabilities.

Geopolitical conflicts drove threat activity with regional and global kinetic events overlapping with OT cybersecurity threats. The Ukraine-Russia conflict prompted more mature threat groups, such as ELECTRUM, to increase activity, while tensions between China and Taiwan contributed to increased targeted cyber espionage attacks against industrial organizations in the Asia-Pacific region and the United States.

Hacktivists for the first time achieved Stage 2 of the ICS Cyber Kill Chain, when CyberAv3ngers attacked programmable logic controllers (PLCs) used by water utilities across North America and Europe with an anti-Israel message. While hacktivist groups typically conduct distributed denial of service (DDoS) attacks with minimal impact, this attack demonstrated the ability to disrupt OT systems by using unsophisticated methods with weak security controls.

Ransomware remains the number one attack in the industrial sector increasing 50 percent from 2022. Manufacturing continues to be the primary target of ransomware and accounted for 71 percent of all ransomware attacks.

The number of vulnerabilities that require authentication to exploit is rising, pointing to a positive trend for OT defenders. In 2023, 34 percent of CVEs required some authentication, compared to 25 percent in 2020.