Article

Dragos has reported three new threat groups targeting ICS/OT in 2025: Sylvanite, Azurite, and Pyroxene. Sylvanite facilitates access to critical infrastructure for Voltzite, exploiting vulnerabilities rapidly.

Azurite has stolen operational data from multiple sectors across the US, Taiwan, Japan, South Korea, Australia, and Europe. Pyroxene specializes in cross-domain access and employs social engineering tactics.

Additionally, the Russia-linked Kamacite group has expanded its reconnaissance efforts, scanning industrial devices in the US and targeting Poland's power grid. Threat actors are increasingly focused on data theft and disruption.