OT CYBERSECURITY
THE 2023 YEAR IN REVIEWFEBRUARY 2024

OT CYBERSECURITY • YEAR IN REVIEW 2023

TAB LE OF CO NTE NTSINTRODUCTION...................................................................................................................... 3
THE RISING TIDE OF INDUSTRIAL CYBER THREAT ACTIVITY..............................................4
KEY HIGHLIGHTS: INSPIRING ACTION................................................................................... 5
L EA RN IN G FRO M ADV E RSARY-OW NED ROC KW ELL AUTOMATIONV U LN E RABIL IT IE S ........................................................................................... 6
KEY HIGHLIGHTS: BY THE NUMBERS.................................................................................... 7OT CYBER THREAT LANDSCAPE............................................................................................9
CO N FL IC T- D R IV E N T H R EAT AC TIVITY.................................................. ........... 9N EW T H REAT GRO UP AC T IV ITY. .................................................................... 1 2
U P DATE S O N S O ME O F T H E M OST AC TIVE THREAT GROUPS. ............. ......... 202023 IN D UST R IAL RANS O MWARE ANALYSIS........................................ .......... 2 2
OT VULNERABILITIES........................................................................................................... 27
V U LN E RA BIL ITY AS S E S S ME N T OVERVIEW..................................................... 27
V U LN E RA BIL ITY EXPLO ITABILITY........................................................ ......... 3 4
V U LN E RA BIL ITY T R E ND S . ................................................................... ......... 3 4
T H E R ISE O F AU T H E NT ICAT ION-REQUIRED VULNERABILITIES.................... 3 4
T R E N D A N ALYS IS BY V UL NE RA BILITY TYPE. ....................................... .......... 35
ASSESSING CYBER READINESS........................................................................................... 40

PAPER-PLANE info@dragos.com X-TWITTER @DragosInc linkedin @Dragos, Inc.

2OT CYBERSECURITY • YEAR IN REVIEW 2023

INTRODUCTION

cyber attack campaigns assessed to be aimed at long-term

In 2023, a surge in global tension resulted in an increasesignify clear objectives to identify vulnerabilities within thein cyber threat activity and disruptions in criticalcountry’s critical infrastructure that can be exploited in theinfrastructure worldwide. Escalating conflicts, including

future with destructive or disruptive cyber attacks. Dragos

those between Ukraine and Russia, Israel and Hamas,

tracked 21 threat groups targeting industrial organizations

and countries in the South China Sea, emboldened

including three new threat groups.

espionage objectives. VOLTZITE’s actions towards U.S.
electric entities, telecommunications, and GIS systems

adversaries and hacktivists to develop new capabilities
and reuse old techniques. Simultaneously, ransomware

Although threat groups and hacktivists posed significant

attacks affected more industrial organizations, with arisks in 2023, ransomware was the primary concern

nearly 50 percent increase in reported incidents. Assetfor many organizations globally. This concern is wellowners must take necessary precautions to address

founded, considering the rise in ransomware attacks

these threats or fall victim to them.

and the industrial impact observed by Dragos during
incidents this year. These trends, along with new reporting

Among the threats that organizations must consider are

requirements, saw an increased focus on response fromthe capabilities developed in conflict areas. A year after

many organizations. Regulatory changes in the United

Russia’s invasion of Ukraine, cyber threat activity in theStates, Europe, Australia, Asia, and the Middle East required

region continues to escalate. Dragos and the community

organizations to develop capabilities to meet reporting

became aware of new destructive malware capabilities as

obligations. To this end, Dragos conducted more exercises

ELECTRUM conducted targeted cyber operations againstwith a wider range of participants and industries in 2023.

Ukrainian critical infrastructure. The mixture of traditional
kinetic warfare with cyber-focused capabilities has created

Another major focus area for organizations this year wasa new testbed for increased threat capabilities worldwide.

understanding what risks vulnerabilities posed and how
best to respond to them. 2023 saw a 14 percent increase in

Similarly, the conflict that erupted in the Middle East

vulnerabilities advisories, with 31 percent of advisories that

included cyber attacks on critical infrastructure. Pro-Israeli

Dragos analyzed having incorrect data. The year also saw

hacktivists claimed responsibility for the attacks thatthe discovery of a major vulnerability impacting Rockwellclaimed to disrupt over 70 percent of the gas stations in Iran,

Automation’s ControlLogix communication modules,

while pro-Hamas hacktivists targeted Israeli-manufactured

reminiscent of the zero-day that XENOTIME exploited in theoperational technology (OT) hardware and software. The

TRISIS attack. However, this event exemplified how vendors,

impact of these attacks on industrial equipment spreadgovernments, and our community leverage communication

beyond the conflict zone and affected various sectors, suchand visibility to enable a unified, risk-based response.

as water and manufacturing, around the globe.
Dragos started the Year in Review to highlight significant
Throughout the year, Dragos continued to track threat

trends in the OT cybersecurity community. This year’sgroups as they developed capabilities and gained access.

report aims to go further by offering practitioners andMounting tensions between China and Taiwan contributed

leaders the most up-to-date data, along with perspectives

to the environment where Dragos observed VOLTZITE target

from the field, to help them better defend critical

several industrial organizations in the Asia-Pacific region,

infrastructure around the world. These perspectives are

Africa, and North America — including entities in electric,

focused on providing actionable insights that have beensatellite communications, telecommunications, emergency

tried and tested to help organizations effectively defend

management, and defense industrial base sectors — withagainst and respond to industrial cyber threats.

PAPER-PLANE info@dragos.com X-TWITTER @DragosInc linkedin @Dragos, Inc.

3

OT CYBERSECURITY • YEAR IN REVIEW 2023

THE RISING TIDE OF INDUSTRIALCYBER THREAT ACTIVITY
The Dragos Platform provides visibility and insight through OT Watch and Neighborhood Keeper data. The Dragos threat
intelligence teams assess and research vulnerabilities and actively track adversaries impacting operational technology.
Dragos consultants and responders provide frontline perspectives from various engagements, including assessments,
exercises, and incident response. Since Dragos first started gathering data for Year in Review in 2017, many trends haveremained consistent with notable milestones along the way. The data and perspectives presented in this report arefocused on the global industries that Dragos serves.

2016 – CRASHOVERRIDE Not identified
until months later, CRASHOVERRIDE
malware was used in 2016 as the firstmalicious code to attack electric substations – thefacilities and equipment that are designed to protect
bulk electric systems were manipulated to have theopposite effect. The CRASHOVERIDE legacy lives
on with a series of attacks utilizing INDUSTROYER2
malware observed as recently as October 2022.
2017 – TRISIS The threat group XENOTIME
deployed the TRISIS malware against a
Safety Instrumentation System (SIS) at a
petrochemical plant in Saudi Arabia. TRISIS represents
the expansion of malware targets and methods ofexecution, and the first time system safety features
have been targeted and compromised directly.
2018 – EXPANDED THREAT GROUPSIn 2018, Dragos expanded the number ofThreat Groups tracked from 3 to 8. This trend
continued over time — to date there are 21 Dragosdesignated Threat Groups with the intent to gain accessto OT environments and potentially disrupt them.
2019 – INCREASED RANSOMWARE IN OT
In 2019, Dragos tracked a 50 percent
uptick in ransomware within OT. The firstransomware case Dragos responded to occurred within
the electric sector also in 2019.

PAPER-PLANE info@dragos.com X-TWITTER @DragosInc linkedin @Dragos, Inc.

2020 – EKANS RANSOMWARE Dragos
analyzed EKANS malware variants withcapabilities to stop ICS-related Windows
processes before initiating encryption. This functionality
represents a natural but troubling consequence of target
expansion. Ransomware groups increase the odds ofvictims paying a ransom when business is disrupted.
2021 - RANSOMWARE ATTACK IMPACTS OT
In 2021, Colonial Pipeline was impacted
by ransomware, causing a precautionary
shutdown of OT operations. Again,
ransomware instances continued to balloon in 2023
with 905 instances, an increase of nearly 50 percent
over the last year.
2022 – ENTER CHERNOVITE In 2022
Dragos discovered the CHERNOVITE ThreatGroup, developer of the PIPEDREAM malware,a highly motivated and well-funded entity, that is skilled
in software development methods and well versed inindustrial control systems (ICS) intrusion techniques.
2023 – EVOLVING THREAT LANDSCAPE
Rising tensions and financial opportunity
continued to spur a wide variety of actors totarget industrial environments - including hactivists,
criminal gangs, and three new Dragos-designatedThreat Groups.

4

OT CYBERSECURITY • YEAR IN REVIEW 2023

KEY HIGHLIGHTS: INSPIRING ACTION
HAND-POINT-RIGHT If you haven’t assessed your external infrastructure for critical systems yet, 2024 is
the time. This includes identifying your organization’s internet routable netblocks and IP
space, including what contractors or vendors may have set up for you. Network scan yourpublic spaces and compare it against Shodan, Whois, and your documentation. Ensure
critical assets or assets connected to your process environment are not discoverable fromthe internet. Learn more about why this guidance is important from the 2023 attack on
Unitronics PLC devices by the CyberAv3ngers on page 11.
HAND-POINT-RIGHT If you haven’t segmented your network yet, the best time for that was in the 2000s; thesecond best time is now. This network segmentation includes separating devices with networkand host-based firewalls by function, not just systems from the internet, but systems fromeach other and critical processes. Do not merely focus on IPv4 when your systems also use
IPv6. When operators traverse network zones to log in using a virtual private network (VPN),
remote desktop protocol (RDP), or other remote access tools, they should leverage separate
authentication. In 2023, increased ransomware impacts on OT environments highlight thenecessity of this old but still useful guidance. Read more on Ransomware on page 21.
HAND-POINT-RIGHT Restricting and monitoring outbound communication is also important in addition tosegmentation. This includes evaluating default routes, gateways, and firewall rules to external
networks and proxy configurations. In 2023, several adversaries, such as VOLTZITE, GANANITE,
and ransomware groups, leveraged communication to external networks for command andcontrol (C2) communication, allowing exfiltration of data and remote control of network assets.
For more on this see the OT Cyber Threat Landscape section of this report on page 9.
HAND-POINT-RIGHT If your organization already regularly assesses standard guidance, such as auditing
segmentation rules and configuration, you still have work to do. As defensible architecture
continues to mature, adversary techniques shift with it. Learn which techniques our
penetration testers leverage in OT assessments in the Frontline Perspective section on page20, as well as which techniques still work for ransomware groups on page 21 and threat
groups on page 9. Understanding the attack surface is vital for prioritizing a response or
identifying adversaries within your network. Hunting for evidence of these techniques in use
within your monitoring system is the best way to identify unwanted operators hiding in yourOT environment.
HAND-POINT-RIGHT Lastly, reduce the risk of vulnerable equipment used in OT processes, but do it ina systematic way. In 2023, Dragos prioritized and wrote mitigation guidance for 531
OT-related advisories, 2010 vulnerabilities. Read more on key insights, trends, andmitigations from vulnerabilities on page 27.
PAPER-PLANE info@dragos.com X-TWITTER @DragosInc linkedin @Dragos, Inc.

5OT CYBERSECURITY • YEAR IN REVIEW 2023

LEARNING FROM ROCKWELL AUTOMATIONVULNERABILITIESIn 2023, the U.S. Government informed Rockwell Automation of two

Dragos Frontline Perspective

vulnerabilities impacting a subset of ControlLogix communication

THE VULNERABILITIES

modules. These communication modules are part of a significant Rockwell
Automation product line and assist in controlling processes in manyindustrial verticals. In coordination with their government partners,
Rockwell Automation organized a defensive working group comprisedof various vendors, including Dragos. The working group’s goal: develop
detections for these vulnerabilities and search for evidence of exploitation.
As part of the working group, Dragos analysts studied the vulnerabilities andthe impacted communications modules. With Rockwell Automation andother community members, they developed detection signatures that would
alert on artifacts specific to varying methods of potential exploitation. Dragos
vulnerability analysts deployed these signatures to Neighborhood Keeper
and OT Watch to find signs of malicious activity. They triaged any alerts,

Rockwell Automation and the
U.S. Government disclosed twovulnerabilities:
CVE-2023-3595 This vulnerability
in 1756 EN2* and 1756 EN3* products
allows a malicious user to perform
remote code execution withpersistence on the target systemthrough maliciously crafted CIP
messages.
CVE-2023-3596 In the 1756-EN4*
products, this vulnerability allows amalicious user to cause a denial ofservice through maliciously crafted
CIP messages.

paying attention to false positives and tuning signatures accordingly.
Dragos analysts passed the detection results back to the working groupso that the rest of the community could tune their signatures for theirrespective platforms. In this way, Neighborhood Keeper helped thecommunity to avoid unnecessary alerting once the detections andvulnerabilities were made public. Aside from signature tuning, Neighborhood
Keeper provided visibility into the number of vulnerable devices and how
widespread their use is in different industries and regions. Dragos passed
this information back to the working group so that they could assess the

Dragos Frontline Perspective
Dragos OT Watch customers andNeighborhood Keeper participants
were protected by monitoring for thisthreat before it was publicly announced.
If a situation like this were to happen
again, Dragos Community Defense
Program members would benefit
via the program’s emerging threat
monitoring.

vulnerabilities’ risk and potential impact.
The collaboration between the U.S. Government and Rockwell Automation,
along with the formation of a working group of security vendors to ensure
a defensive front before public release, and the coordinated publishing ofvulnerability information, represents a significant accomplishment for theindustrial control systems (ICS) community. Product owners and OEMs canlook to Rockwell Automation as an excellent example of community and13%of Rockwell Automation assets wereControlLogix communication modules,
across manufacturing, paper and pulp,
automotive, mining, chemical, food andbeverage, electric, oil and gas, etc.

defense-forward practice and consider following this path for vulnerability
disclosure. This new approach of blending U.S. Government intelligencewith security industry expertise and OEM knowledge is undoubtedly
the way forward in combating future cyber adversary threats to criticalinfrastructure.

PAPER-PLANE info@dragos.com X-TWITTER @DragosInc linkedin @Dragos, Inc.

6

OT CYBERSECURITY • YEAR IN REVIEW 2023

KEY HIGHLIGHTS: BY THE NUMBERS
Threat Group Highlights – 2023

21

Total
Threat Groups

10

ActiveThreat Groups

3 New

Threat Groups

Key Vulnerabilities Findings

80%
of vulnerabilities reside deep within
the ICS network.

16%

53%

of advisories were network
exploitable and perimeter facing
in 2023.

of the advisories that Dragos analyzed
could cause both a loss of view andloss of control, up from 51% last year.

31%of advisories contained errors in 2023.

PAPER-PLANE info@dragos.com X-TWITTER @DragosInc linkedin @Dragos, Inc.

49%
Dragos provided mitigations for
49% of the advisories that had none.

7

OT CYBERSECURITY • YEAR IN REVIEW 2023

Key Ransomware Findings↑
50%
Ransomware attacks against industrialorganizations increased
50 percent over last year.

28%
Dragos tracked 28% moreransomware groups impacting
ICS/OT in 2023.

70%

of all ransomware attacks targeted 638
manufacturing entities in 33 uniquemanufacturing subsectors.

2023 Dragos Threat Groups Summary

Three new threat groups: GANANITE,LAURIONITE and VOLTZITEELECTRUM demonstrates Stage
1 & 2 aspects of the ICS Cyber Kill
Chain

9 threat groups demonstrate at least Stage 1 of the ICS
Cyber Kill Chain: BENTONITE, ELECTRUM, GANANITE,
KAMACITE, LAURIONITE, MAGNALLIUM, PETROVITE,RASPITE, and VOLTZITE

2 threat groups, ERYTHRITE and COVELLITE,
were retired in 2023. 11 threat groups were dormant
PAPER-PLANE info@dragos.com X-TWITTER @DragosInc linkedin @Dragos, Inc.

10 active threat groups: BENTONITE, ELECTRUM,GANANITE, KAMACITE, LAURIONITE, MAGNALLIUM,PETROVITE, RASPITE, TALONITE and VOLTZITE

Threat Group Statistics from2022 Year in Review:

2 new threat groups: BENTONITE
and CHERNOVITE

8 active threat groups: BENTONITE, CHERNOVITE,
ELECTRUM, ERYTHRITE, KAMACITE, KOSTOVITE,
WASSONITE and XENOTIME8OT CYBERSECURITY • YEAR IN REVIEW 2023

OT CYBER THREAT LANDSCAPEThe OT cyber threat landscape continued to evolve in 2023, with an increase in tracked threat groups,
ransomware events, and other threat activities driven by global conflict. The adversaries involved in these
activities varied widely in terms of their level of sophistication, deployed capabilities, and intended targets.
On one end of the spectrum, some threat groups used advanced techniques, such as leveraging native
functionality, including living off the land (LOTL) techniques, to conduct reconnaissance and intelligence
operations. Conversely, some adversaries targeted low-hanging fruit such as internet-accessible devices thatlacked proper hardening, thus making them easy to damage and cause operational disruptions.
Threat groups continued to use publicly disclosed vulnerabilities and discover and develop their own capabilities. Most of
the observed threat activity targeted IT-centric devices that are commonly used in OT, such as Sierra Wireless modems or
Citrix. In 2023, Dragos worked with one of our strategic partners, Rockwell Automation, on a community response to a setof adversary-developed vulnerabilities targeting OT devices. The identified vulnerabilities have the potential to result in
loss/denial of view (T0829, T0815), denial/manipulation of control (T0813, T0831), theft of operational information (T0882),
and loss of productivity and revenue (T0828).

CONFLICT-DRIVEN THREAT ACTIVITY
The overlaps of OT cybersecurity threats with regional and global
kinetic events have never been more evident than in 2023. Cyber
adversaries with a range of capabilities have used the UkraineRussia and Israel-Hamas wars to conduct targeted operations against
critical infrastructure, and less sophisticated hacktivists have used
the same conflicts to cause panic and negatively impact public
perception of the resilience of critical services. Geopolitical tensions
worldwide, including in Asia and Africa, have also driven intelligencegathering and capability staging activity.
The Ukraine-Russia conflict drove the activity of more mature
threat groups, such as ELECTRUM, which conducted targetedcyber operations against Ukrainian critical infrastructure entities.
A new destructive wiper malware attributed to ELECTRUM wasobserved in the wild in June 2023. Later, in September 2023, Dragos
reported on a spear-phishing campaign that targeted Ukrainiancritical infrastructure organizations linked with ELECTRUM and
KAMACITE. Lastly, in November 2023, a cybersecurity vendor
published a report providing evidence of destructive malware
activity targeting Ukrainian electric substations in October 2022.
Dragos assessed with moderate confidence that ELECTRUM
conducted the October 2022 destructive malware activity.
PAPER-PLANE info@dragos.com X-TWITTER @DragosInc linkedin @Dragos, Inc.

9OT CYBERSECURITY • YEAR IN REVIEW 2023
According to multiple sources, the mounting tension between China andTaiwan also contributed to increased targeted cyber espionage attacks
against multiple industrial organizations in the Asia-Pacific region andthe United States.1 One threat group in particular, VOLTZITE, has targetednumerous critical infrastructure entities in Guam, the United States, andother countries since at least 2021. VOLTZITE overlaps with Volt Typhoon, agroup that the U.S. Government has publicly linked to the People’s Republicof China. VOLTZITE heavily uses living off the land (LOTL) techniques and,in some cases, has been observed conducting “hands-on keyboard” postcompromise actions within a victim’s networks.

Dragos Frontline Perspective
Living off the land (LOTL) describes theuse of typically pre-existing, legitimate
capabilities present on a victim host andnetwork for malicious purposes. In theinformation technology (IT) world, thismeans using native system capabilities
such as PowerShell or server message
block (SMB) as part of an attack. In
the OT world, this can mean using thenative functionality of a PLC or control
system to issue a control command.

VOLTZITE has shown continued interest in the electric andtelecommunications sectors in the United States, evidenced by the long-

Dragos Frontline Perspective

term reconnaissance of multiple electric entities. If VOLTZITE establishes

Dragos has observed multiple
operational overlaps between the Volt
Typhoon and Dragos-tracked threat
group VOLTZITE. In a collaborative
effort with the Electric Information
Sharing and Analysis Center (E-ISAC),
Our analysis revealed likely active
and ongoing VOLTZITE initiatedscanning activities against electric
sector organizations in North
America between November andDecember 2023. VOLTZITE’s persistentinterest and activities within criticalinfrastructure sectors warrant
monitoring and preparedness by ICS/OT
organizations.

an initial foothold on the network perimeter of a target, it may then be able
to pivot further into a victim’s information technology (IT) network andthen move laterally onto the victim’s OT network. Dragos has only observed
VOLTZITE operations achieving Stage 1 of the ICS Cyber Kill Chain. They
have not displayed actions or capabilities designed to disrupt, degrade, or
destroy ICS/OT assets or operations.
Dragos leverages its intelligence to drive hunting with our customer
environment and the community. This was used to track and analyze
indicators of compromise and behavioral tactics, techniques, and procedures
relevant to the VOLTZITE threat group. A significant outcome of this isfinding a high confidence indicator within a Dragos Platform customer’s

environment, allowing OT Watch to better assist the client during theirincident response efforts and providing Dragos Intelligence with real-world behavioral elements surrounding the
VOLTZITE indicator, including activity suggesting remote desktop protocol (RDP) usage and server message block (SMB)
directory traversal. Another interesting finding was VOLTZITE overlaps with infrastructure associated with the Mirai
Botnet and another activity cluster that differs from VOLTZITE but may be operationally connected.
Dragos’s analysis of VOLTZITE operations underscores the need for ongoing vigilance among organizations operatingin the global electric sector, as the observed activity suggests continued and specific interest in these networks. Further,
VOLTZITE’s actions involving prolonged surveillance and data gathering align with Volt Typhoon’s assessed objectives ofreconnaissance and gaining geopolitical advantage in the Asia-Pacific region.

1
h t t p s : // w w w. c i s a . g o v / n e w s - e v e n t s / c y b e r s e c u r i t y - a d v i s o r i e s / a a 2 3 - 1 4 4 a ; h t t p s : // w w w. m i c r o s o f t . c o m / e n - u s / s e c u r i t y /blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/

PAPER-PLANE info@dragos.com X-TWITTER @DragosInc linkedin @Dragos, Inc.

10

OT CYBERSECURITY • YEAR IN REVIEW 2023
Throughout 2023, hacktivists and other unsophisticated, opportunistic

Dragos Frontline
Perspective

threat groups have conducted widespread distributed denial ofservice (DDoS) attacks against various industrial organizations and

The hacktivists’ DDoS
attacks had minimal
impacts and primarily disrupted theorganization’s websites. In manycases, Dragos found that claims of
disruptive attacks against criticalinfrastructure were wildly exaggerated
or completely fabricated. However,most hacktivist groups aim to gain
notoriety, spread misinformation, cause
fear, uncertainty, and doubt (FUD), anddraw international media attention togeopolitical and social causes.

critical infrastructure. Pro-Russia groups like CyberArmyofRussia_

Reborn attacked industrial organizations in Europe in May 2023.
NoName057(16) attacked European and North Atlantic Treaty
Organization (NATO) aligned countries and their manufacturing
and transportation organizations. Additionally, Anonymous Sudan
was also observed attacking the United States and other NATOaligned entities. Similar activity has been observed with pro-Hamas
hacktivist groups such as the CyberAv3ngers and Team Insane

Pakistan claiming disruptive attacks against Israeli Railways, anIsraeli town’s power grid system, and an Israeli hydroelectric plant. In
late December 2023, the hacktivist group Predatory Sparrow allegedly
disrupted Iranian gas stations with an unspecified cyber attack.

Dragos Frontline Perspective
Dragos identified over 1800 internetexposed Unitronics devices, but only
0.0001 percent of Neighborhood
Keeper monitored assets are Unitronics.
Dragos assesses with moderateconfidence that Unitronics devices
are more common in environmentswith limited visibility, such as remotelocations or smaller organizations.
This type of device is often deployed
without proper visibility or hardening.
Basic hygiene and device management
are critical to stopping this activity,
including understanding what is
publicly accessible.

These operations also included the successful compromise of publicfacing OT devices, as was observed in late November with the attack
on Unitronics devices. The CyberAv3ngers successfully compromised
numerous U.S., European, and Australian industrial companies using
internet-accessible Unitronics PLC devices. Dragos assesses withmoderate confidence that the adversaries scanned the open internet to
identify publicly accessible Unitronics devices and then attempted to log
into the devices using the Unitronics default password. This adversary
appears not to possess OT capabilities; however, this attack still led to a
Loss of View and Control (T0829, T0827) for some of those impacted.

60%
square Informational square Low square Medium square High square Critical - Avg. Severity

PERCENT OF FINDINGS

50%
40%
30%
20%
10%

Chemical

Data
CenterElectric

Manufacturing

Metals/MiningOil & Gas

Pulp &
Paper

Transportation

Water

F i g u r e 1 : F i n d i n g s S e v e r i t y p e r Ve r t i c a l
PAPER-PLANE info@dragos.com X-TWITTER @DragosInc linkedin @Dragos, Inc.

11

NEW THREAT GROUP ACTIVITY
Dragos observed 10 active Threat Groups during 2023, including three new Dragos-identified Threat Groups: GANANITE,
VOLTZITE, and LAURIONITE. These new threat groups conduct primarily long-term reconnaissance and intellectual
property theft operations. Of the three, VOLTZITE has
been most active in targeting critical infrastructureorganizations. Dragos has not identified VOLTZITE,GANANITE, or LAURIONITE utilizing any ICS-specificcapabilities; however, their persistent interest andactivities within critical infrastructure sectors warrant
monitoring and preparedness by ICS/OT organizations.
Dragos observed all three threat groups conducting diverse
operations against various organizations, including
cybersecurity research firms, government and military
defense entities, rail, manufacturing, automotive, andDragos Frontline Perspective
Dragos observed threat groups, including
GANANITE and LAURIONITE, targeting some ofthese sectors with the least mature environments(transport, manufacturing, water utilities). Dragos
assesses a sector’s level of maturity based on
the number and severity of findings observed by
Dragos during its assessment in those respective
environments. Organizations in these sectors should
understand the elevated risk this presents. Threat
groups have been observed using certain MITRE
ATT&CK techniques. Dragos uses these TTPs tocorrelate threat actor behavior with field observations.

utilities. GANANITE and LAURIONITE have exhibited an
opportunistic approach to their initial access operations;
Valid Accounts

60%

espionage and reconnaissance objectives in the Asia-

Explicit Public-Facing
Application

4%

Pacific region and the United States – particularly theExternal Remote
Services

13%

All three newly identified threat groups possess
capabilities that target and exploit public-facing
infrastructure used or owned by victim organizations.

Domain Accounts

5%Standard Application
Layer Protocol

13%

Commonly Used Port

5%

More Severe

VO
LT
ZIT

Types of infrastructure included but were not limited totargeting public internet-facing Sierra Wireless Airlink
devices, Fortinet FortiGate, VPN infrastructure, andOracle eBusiness Suite iSupplier Web Services.

Dragos Frontline Perspective
Exploiting public-facing devices and external services is
a common technique that Dragos observed four ThreatGroups utilizing in 2023. A defensible architecture to protect
against this technique includes multiple layers of defense,
secure remote access setup with MFA, and monitoring.

PAPER-PLANE info@dragos.com X-TWITTER @DragosInc linkedin @Dragos, Inc.

AV
G.
SE
VE
RIT
Y
FIN
DI
NG
S%
BE
NT
ON
ITE
EL
EC
TR
UM
GA
NA
NI
TE
KA
MA
CIT
E
TA
LO
NI
TE

electric sector.

E

however, VOLTZITE’s operations strongly indicate

Less Severe

Figure 2: Findings and MITRE TTPs by Threat Groups Using Public Exploits

20%
Dragos issued
findings related toexternally facing
networks such as
the internet in
20 percent of engagement reports.

28%
Dragos foundinadequately
configured firewalls
protecting OT
environments in
28 percent of engagements in 2023.

12

OT CYBERSECURITY • YEAR IN REVIEW 2023

VOLTZITETARGETS: UNITED STATES,
ASIA, AFRICA

VOLTZITE, a Dragos-tracked threat group thatKEY HIGHLIGHTS

has operational overlaps with Volt Typhoon• Heavily utilized living off the land techniques to inhibit
the potential identification of malicious activity.

(first reported on by the U.S. Cybersecurity
and Infrastructure Security Agency andMicrosoft in May 2023), was performing
reconnaissance and enumeration of multiple
US-based electric companies, and since thenhas been observed targeting electric powertransmission and distribution, emergency
services, telecommunications, defense industrial
bases, and satellite services. VOLTZITE’s actions
towards US electric entities, telecommunications,• Conducts offensive operations with a significant focus
on detection evasion and sophisticated operational
security tradecraft.
• Conducts slow and steady reconnaissance against atarget focusing on credential theft, lateral movement,
and long-term espionage.
• Exploits internet accessible SOHO routers, using themas intermediary hops back to adversary controlled
infrastructure.

and GIS systems signify clear objectives to
identify vulnerability within the country’s criticalinfrastructure that can be exploited in the future

NOTABLE ACTIVITY

with destructive or disruptive cyber attacks.
While VOLTZITE has traditionally targeted US

June
2023

July
2023

November
2023

Compromise of networkand video surveillancethrough Sierra WirelessAirlink

Exploitation attempts
against African electric
entityEnumeration of U.S.
Energy Organizations

facilities, we also are aware of the group targetingorganizations in Africa and Southeast Asia.
This group heavily uses living off the land
(LOTL) techniques, which can make detection
and response efforts more difficult. This strategy,
paired with slow and steady reconnaissance,
enables VOLTZITE to avoid detection fromsecurity teams.
Impact and Implications
VOLTZITE conducts enumeration against
victims’ internet-facing assets in a slow and• VOLTZITE exploited public internet-facing Sierra WirelessAirlink devices of a U.S. emergency management andtraffic monitoring entity in a June 2023 campaign.
• Possible exploitation attempts in July 2023 against an
African electric transmission, distribution, and retailer
entity.
• VOLTZITE conducted extensive reconnaissance of U.S.
energy organizations in November 2023.

sustained fashion, likely to lessen the chanceof being detected. Once they have exploited
a victim’s internet-facing asset, they exhibit
consistent use of living off the land techniques, making detection more difficult for defenders. VOLTZITE’s 2023
behavior suggested operational objectives of espionage and information gathering. Data stolen from operational
technology (OT) networks may result in unintended disruption to critical industrial processes or provide the adversary
with crucial intelligence to aid in follow-up offensive tool development or attacks against ICS networks.

PAPER-PLANE info@dragos.com X-TWITTER @DragosInc linkedin @Dragos, Inc.

13

OT Watch Threat Hunting Uncovers VOLTZITE• The Dragos Intelligence team started tracking VOLTZITE’s activities at the
beginning of 2023.
• A new utility customer deployed the Dragos Platform in response to a pre-existing
network compromise with a potential ICS/OT impact. The platform was positioned

This case study breaks
down a VOLTZITE
persistent threat hunt
executed by Dragos
OT Watch utilizing
the Platform, ThreatIntelligence and
Neighborhood Keeper at aU.S. based electric utility.

to monitor the IT-OT interface (Level 3-4) and OT-OT communications (Level 2).
• Following deployment, Dragos OT Watch utilized the Dragos Platform to identify malicious activity within theenvironment working with Dragos Intelligence using tactics, techniques, and procedures (TTPs) and threat huntanalytics.
• The threat hunt confirmed adversary evidence adjacent to the OT network; and incident response analysis foundevidence of adversary discovery actions with a focus on SCADA related information. This was seen in the Dragos
Platform as server message block (SMB) traversal with the group pivoting within the environment, and likely, looking
for information about the environment as a further means of persistence.
• Consistent with OT Watch operations, findings were promptly escalated to the customer with a full summary of all
threat hunt findings after the full investigation. The recommendations further empowered the customer’s incident
response efforts in cleaning up the incident to eliminate the adversary from the environment. The environment
continues to be monitored via the Dragos Platform and OT Watch.
• Taking the success of the threat hunt and the detailed understanding on the tactics of this threat group provided by
the Dragos Intelligence team, OT Watch extended the hunt across all relevant OT Watch customers.
• The Dragos Intelligence team enhanced the effort by analyzing Neighborhood Keeper data for indications of
VOLTZITE behaviors and then notifying impacted parties anonymously. With these findings, Dragos threat
detections engineers developed high-fidelity detections back into the Platform deployed via Dragos Knowledge Packs
for continuous monitoring.
The overall response to the VOLTZITE threat highlights the importance of coordinated efforts and the advantage of
ICS/OT capabilities unique to Dragos. This engagement not only addressed a complex threat but also strengthened theprotective measures across critical infrastructure customers.
PAPER-PLANE info@dragos.com X-TWITTER @DragosInc linkedin @Dragos, Inc.

14

OT CYBERSECURITY • YEAR IN REVIEW 2023

Dragos Frontline Perspective
Asset owners often deploy cellular gateways such as the Sierra Wireless devices in remote locations where wired connections
are not practical or economical. These gateways are usually connected directly to OT devices, exposing those devices to
misconfiguration or vulnerabilities of the gateway. Given the limited visibility and reliance on a single layer of protection when agateway and connected device are compromised, long adversary dwell times are possible.

Data Logger

Protective
Relay

PLC

CellularGateway

RTU

Dragos has seen these devices used by utilities for pole-top deployments connected to CAP banks and reclosers and at remote
pump stations, storage tanks, and lift stations. Further, Dragos has seen their use in MET towers, small hydro, distributed solar,
and storage in generation environments. The most concerning instances are when Dragos has found cellular gateways connectedto larger control systems such as a DCS or PLC Process Control Network (PCN) as a remote access mechanism that bypasses
standard security controls. Organizations must have an accurate asset inventory and visibility to protect against the risk thatthese types of devices introduce to an industrial environment.

PAPER-PLANE info@dragos.com X-TWITTER @DragosInc linkedin @Dragos, Inc.

15

OT CYBERSECURITY • YEAR IN REVIEW 2023

GANANITEGANANITE is a Dragos-designated ThreatGroup that targets critical infrastructure and

TARGETS: ASIA

KEY HIGHLIGHTSGANANITE focuses on espionage and data theft,• Leveraged publicly available proof of concept (POC)
exploits for internet-exposed endpoints, along withmany remote access trojans (RAT), such as Stink Rat,
LodaRAT, WarzoneRAT, and JLORAT.

with the possibility of handing off initial access• Use of energy -focused phishing lures.

government entities in the Commonwealth of
Independent States and Central Asian nations.

to other threat groups. GANANITE focuses
persistently on its target sets by employing
many known tools to infiltrate its victims.
Building on the use of StinkRAT and publicly
available proof of concept exploits for internetexposed endpoints, GANANITE also exhibits
use of tooling such as TELEMIRIS and JLORAT,• Exfiltrated web browser information from victim
machines using Telegram in addition to traditional C2
methods over HTTP and HTTPS.
• Conducted in-depth reconnaissance of target organizations
through Shodan and FOFA to build a profile of the target
and potential vulnerabilities of the exposed asset.

which has been attributed by Kasperky as being
exclusively used by a threat group under the
direction of or working with TURLA.
Impact and Implications
GANANITE has been observed conducting
multiple attacks against key personnel
related to ICS operations management in aprominent European oil and gas company,
rail organizations in Turkey and Azerbaijan,
multiple transportation and logistics companies,
an automotive machinery company, and at least
one European government entity overseeing
public water utilities. Although GANANITE
has not yet shown evidence of moving into OT
networks or an elevated capability resembling
Stage 2 actions, their assessed capabilities show
efficient use of multiple phases across Stage 1 of

NOTABLE ACTIVITY
January
2023

May
2023

Recon and infiltration of EU
critical infrastructure orgs

CIS Targeting withespionage and data theft• On January 13, 2023, TR-2023-01 documented
reconnaissance against and infiltrated various European
critical infrastructure organizations. Along withcredential capture via masqueraded domain phishingpages, the adversary utilizes an open-source Python RAT
named Stink.
• In May of 2023, GANANITE continued targetinggovernment and industrial organizations in the
Commonwealth of Independent States with a focus onespionage and data theft, with the potential to hand off
initial access to other threat groups.

the ICS Cyber Kill Chain.
Dragos Frontline Perspective
ICS attacks comprise of two parts: a penetration of the enterprise
IT environment (Stage 1) which allows for a crossing into the ICS
network, culminating in final reconnaissance and penetration ofcontrol system resources (Stage 2). It’s worth noting that Stage 1
does not always take place in a victim’s IT environment, but thecompromise may be in a vendor’s environment that has access to theenterprise’s OT environment.
PAPER-PLANE info@dragos.com X-TWITTER @DragosInc linkedin @Dragos, Inc.

16

OT CYBERSECURITY • YEAR IN REVIEW 2023

Dragos Frontline Perspective
Adversaries use command andcontrol (C2) to communicate withand control compromised systems
by leveraging standard protocols
like HTTP, HTTPS, or DNS for
communication channels. C2capabilities have progressed to thepoint where some frameworks canintegrate third-party applications or
non-traditional network protocols
to facilitate or hide C2 traffic. Dragos
researches how threat groups
use common OT protocols for C2
operations and develop capabilities
as part of a proof of concept.
Dragos focused on open platform
communication unified architecture(OPC UA) and DNP3, given its
widespread utilization across a rangeof critical industrial environments
and the availability of robust opensource libraries for each protocol.
These OT C2 capabilities enabledthe Dragos penetration testing team
to operate covertly in industrial
environments by blending in withnormal OT network traffic.

PAPER-PLANE info@dragos.com X-TWITTER @DragosInc linkedin @Dragos, Inc.

Further, GANANITE’s operations have displayed extensive
research and use of known exploits against the external
perimeter of its targets. GANANITE uses tools such as
Shodan and FOFA search engines that contain data about
internet-facing assets to build a profile of its target. After
identifying the IP netblocks of its target, they then utilize
data from Shodan and FOFA to identify any presenceof devices exhibiting known exploitable vulnerabilities.
GANANITE then moves on to exploit those vulnerabilities
with publicly available exploits. For those reasons,industrial organizations in Europe and Central Asia facea significant risk from GANANITE due to their initial
intrusion capabilities, post-compromise espionage TTPs,
and intellectual property theft, all of which can be used infollow-on attacks against the victim organizations.

17

OT CYBERSECURITY • YEAR IN REVIEW 2023

LAURIONITETARGETS: UNITED STATES,
AUSTRALIA, EUROPE, MIDDLE EASTLAURIONITE was first discovered actively

KEY HIGHLIGHTS

targeting and exploiting Oracle E-Business Suite• Leveraged CVE-2022-21587 and CVE-2022-21589 to
exploit Oracle iSupplier instances.

iSupplier web services and assets across several
industries, including aviation, automotive,
manufacturing, and government. This
group utilizes a combination of open-source
offensive security tooling and public proof ofconcepts to aid in their exploitation of common
vulnerabilities.
LAURIONITE has demonstrated the ability to
conduct the complete attack cycle of offensive• Utilized LOLBins or LOTL Binaries to maintain a stealthierprofile. Uses these tools to exploit system vulnerabilities,
establish persistence, conduct lateral movement, perform
internal reconnaissance, and exfiltrate victim data.
• Utilized Behinder and Godzilla webshells and opensource security tools such as netcat, proxychains, NeoreGeorg, and Pwncat-cs.
• Performed offensive operations against other targets
from compromised victim infrastructure.

cyber operations that achieve Stage 1 of the ICS
Cyber Kill Chain from Reconnaissance to Actions
on the Objective. The adversary operators show

NOTABLE ACTIVITY

expertise in various offensive cyber operation
skills in navigating target systems, exploiting
vulnerabilities, maintaining persistence,
conducting lateral movement, internal
reconnaissance, defense evasion, and exfiltration.
Oracle E-Business Suite is one of the mostwidely used enterprise solutions for integrated
business processes, including numerous
industrial organizations such as United States

March
2023

Targeting and exploitationof Oracle iSupplier• As early as March 5, 2023, LAURIONITE was observed
targeting and exploiting Oracle E-Business Suite
iSupplier web services.

Steel and Unifi textile manufacturing.
By utilizing compromised infrastructure,
LAURIONITE can remain undetected oroverlooked due to its origin being fromtrusted or known organizations.

PAPER-PLANE info@dragos.com X-TWITTER @DragosInc linkedin @Dragos, Inc.

18

OT CYBERSECURITY • YEAR IN REVIEW 2023

Impact and Implications
While current observationsand visibility of LAURIONITE
operations do not indicate theadversary seeks to advance to OT
networks, Dragos cannot discount
this as a possible course of action
the adversary may select in the
future. LAURIONITE actively seeks
out iSupplier instances with asignificant presence across manyindustry verticals and sectors,
including industrial organizations
such as manufacturing.
Targeting companies that
use Oracle’s E-Suite iSuppliertechnology may not inherently
impact OT assets; however, thenature of enterprise resource
planning software such as
iSupplier could allow adversaries
like LAURIONITE to gain
visibility into third-party vendor
relationships, which can lead tofollow-on intrusion operations.

Dragos Frontline Perspective
Dragos often finds that during tabletop exercises,organizations don’t fully understand how OT
processes depend on business systems. A
compromise of a critical business system can impact
operations unless the asset owner understands thesedependencies and puts sufficient mitigations in place.
This risk was highlighted in the 2021 ransomware
attack against Colonial Pipeline, in which cyberattacks against enterprise business applications
resulted in significant downstream impacts on
industrial operations.

PAPER-PLANE info@dragos.com X-TWITTER @DragosInc linkedin @Dragos, Inc.

19

OT CYBERSECURITY • YEAR IN REVIEW 2023

UPDATES ON SOME OF THE MOST ACTIVE THREAT GROUPSELECTRUM
ELECTRUM, a Dragos-tracked threat group that overlaps with Sandworm, was highly active throughout 2023 and theiroperations were largely influenced by the Ukraine-Russia conflict. For example, a new wiper malware was identified inJune 2023 with characteristics similar to RoarBat and was used to target Windows operating systems. ELECTRUM has
used wiper malware previously, such as AcidRain and CaddyWiper, which was previously part of the INDUSTROYER2event. Another noteworthy ELECTRUM observation involving wiper malware came in November 2023 when Mandiantpublished a report about disruptive cyber attacks against a Ukrainian electric substation in October 2022. In that attack,
ELECTRUM exploited a vulnerable hypervisor running end-of-life MicroSCADA software in the OT environment and useda (then) new version of CaddyWiper malware.

RASPITE & MAGNALLIUM
Dragos also observed that threat groups such as RASPITE andMAGNALLIUM conducted widespread campaigns scanning forvulnerable SMB devices and using password-spraying techniques
against various industry sectors, including defense and mining.
Interestingly, MAGNALLIUM is a Dragos-tracked threat groupthat had seemingly disappeared for nearly a year until they began
their password-spraying operations again in July 2023 against
multiple defense and mining organizations. Prior MAGNALLIUM
cyber operations have included initial access and reconnaissanceactions before deploying destructive wiper malware on thevictim’s IT networks.

Dragos Frontline Perspective
Dragos’s tracked threat groups are basedon clusters of activity relevant to assessedcapabilities, intent, victimology, andinfrastructure. From our perspective, it iscommon for Dragos-tracked threat groups to
go into periods of dormancy. This dormancy canbe because their operational objectives haveshifted, they are conducting more IT-oriented
cyber attacks against a broader range of entities
that do not fall within the industrial organization
category, or they are developing new tools andstanding up new infrastructure to stay ahead of
security researchers and law enforcement.

KAMACITE
In addition to the ELECTRUM activity, KAMACITE continued

Dragos Frontline Perspective

targeting Ukrainian telecommunications entities through

The DarkCrystal remote access trojan (a.k.a.
DCRat) is a widely available remote access trojan
first observed in 2018 and has been used bynumerous adversaries with varying levels of
sophistication and capabilities. DarkCrystal RAT isoften available through Darknet criminal forums
and marketplaces and can be used to remotely
access compromised networks, steal informationsuch as user credentials from victim networks,
and collect network information.

early 2023 using spearphishing and the DarkCrystal remote
access trojan and then leveraging LOTL techniques within
victim networks. This activity continues a multi-year trendof KAMACITE conducting initial intrusion operations against
Ukraine entities and, more broadly, reconnaissance operations
against global industrial entities likely in pursuit of enabling
follow-on intrusion operations from threat groups like
ELECTRUM.

PAPER-PLANE info@dragos.com X-TWITTER @DragosInc linkedin @Dragos, Inc.

20

OT CYBERSECURITY • YEAR IN REVIEW 2023

Dragos Frontline Perspective
Dragos leveraged its visibility of adversary activity to mirror
commonly used and emerging tactics, techniques, andprocedures (TTPs) when conducting penetration testing. This
includes using public-facing reconnaissance and open-source
intelligence (OSINT) to understand exploitation paths into an
environment. Once initial access was established, the focus
shifted to establishing persistence, expanding access, andcompromising the OT objectives.
Throughout 2023, Dragos leveraged common MITRE ATT&CK
information-gathering tactics, including Reconnaissance(TA0043), Discovery (TA0102), and Initial Access (TA0108) to
identify potential accounts and assets that could be exploited.
This included finding internet-accessible OT assets (5 percent
in 2023, up slightly from the 4 percent observed in 2022),
identifying domain trusts between IT and OT (9 percent in 2023,
down 13 percent from 22 percent in 2022), and remote services
between the same security zones (34 percent in 2023, a slightincrease from 23 percent observed in 2022).
34%
23%

22%
4%

5%

InternetAccessible OT
Devices9%
Identification of
Domain Trusts
between IT & OT

Remote Services
Between Same
Security Zones
square 2022 square 2023

Once the Dragos team gained initial access, the priority became
gaining Persistence (TA0110) where applicable and Laterally Move(TA0109) throughout the target environment, inching closer to OT
Crown Jewels. The Dragos team identified many lateral movement
techniques in 2023 but often leveraged common avenues toillustrate security gaps between IT and OT environments.
In 2023, on almost 5 percent of network penetration tests, theDragos team moved laterally throughout an OT environment
using Default Credentials (T0812). They also found that
Hardcoded Credentials (T0891) can lead to the same result oreven increased access. Dragos identified custom Python andPowerShell scripts that perform automated functions acrossdomains, networks, and assets in multiple assessments. These
cleartext and default credentials were collected and tested acrossthe in-scope assets to identify credential reuse or misuse.

PAPER-PLANE info@dragos.com X-TWITTER @DragosInc linkedin @Dragos, Inc.

21

OT CYBERSECURITY • YEAR IN REVIEW 2023

2023 INDUSTRIAL RANSOMWARE ANALYSISINCREASE IN RANSOMWARE ACTIVITY
Dragos observed 50 active ransomware groups impacting industrialorganizations in 2023 out of 77 groups that have historically attacked
industrial organizations and infrastructure. This represents a 28 percent

49.5%
increasefrom 2022

905

Reported
Ransomware
incidents
in 2023

increase over last year. Dragos tracked 905 reported ransomware
incidents impacting industrial organizations in 2023, a 49.5 percent
increase from 2022. Industrial organizations have much to lose because
operational disruptions can carry significant financial and reputationalcosts. Further, there can be numerous cascading impacts on downstream
businesses and outputs. This leads to high-leverage situations.

square 2022 square 2023

Ransomware adversaries and their activity vary widely in techniques

Dragos Frontline Perspective

employed and sophistication demonstrated – and they have

ALPHV, BlackCat, and Darkside (theperpetrators of the Colonial Pipeline attack)are evidence of this type of ransomware
rebranding and codesharing. All threegroups share commonalities in code,
infrastructure, and TTPs, and some aspects
can be traced back to an older group, REvil.

impacted a broad range of industrial targets in 2023. Hundreds ofransomware variants exist in the wild, such as LockBit, ALPHV,
Hunters International, Rhysida, and NoEscape. Although there are moreransomware groups in the wild than were active in 2023, it is importantto remember that a widespread practice within the criminal ecosystem
is for groups to rebrand and create offshoot ransomware variants.

Dragos Frontline Perspective

INDUSTRIAL RANSOMWARE ATTACKSLockBit ransomware was the most-used ransomware variant against
industrial organizations throughout 2023. Specifically, LockBit
operations accounted for 25 percent of the total ransomware incidents
against industrial organizations in 2023, with ALPHV and BlackBastaaccounting for 9 percent each. LockBit, like many ransomware groups,
operates as a Ransomware-as-a-Service (RaaS) provider.
LockBit operators capitalize on extortion tactics to increase theprobability of the victim paying the ransom. One such tactic is stealing
sensitive data, including industrial data from victim organizations, with

Ransomware-as-a-Service is a model
where ransomware purveyors “rent”
access to their proprietary ransomware
infrastructure, which creates a lowbarrier-of-entry option for lesser-skilledadversaries wishing to profit fromransomware operations. The ransomware
purveyors’ profit from affiliates renting
their infrastructure, and they also get apercentage of any successful ransomware
operations. Affiliates that rent access to
the ransomware purveyor’s infrastructure
benefit from not having to develop theirown custom ransomware tooling.

StealBit, an information stealing tool created by the LockBit developers
and typically deployed before LockBit encrypts compromised systems.
If the victim doesn’t pay the ransom, the stolen data is posted to the
LockBit dark web resources, which other adversaries can leverage.

PAPER-PLANE info@dragos.com X-TWITTER @DragosInc linkedin @Dragos, Inc.

22

OT CYBERSECURITY • YEAR IN REVIEW 2023

32%

44%

13%

Europe285 incidents

North America
397 incidents2%

Africa22 incidents

5%South America
42 incidentsAsia
119 incidents

3%Middle East
27 incidents

1%

Australia
13 incidents

Ransomware is a global t hreat; however, t he major ity of ransomware attac ks impac ted organizat ions in Nor t h Amer ica with 44
percent of incidents, with Europe being the second most common target with 32 percent.
Figure 4: Ransomware Incidents by Continent • 2023

638

Manufacturing

115

Industrial
Control Systems

20

Electric

13

Mining1065

Water, Renewables

30

Government, Defense

Transportation
Oil & Gas

2

The most common sector impacted in 2023 was manufacturing, with 71 percent of ransomware incidents.
The industrial control systems sector, which is made up of companies that develop OT equipment and applications, was the second most impacted sector with 13 percent.
Figure 5: Ransomware Incidents by Se ctor • 2023

PAPER-PLANE info@dragos.com X-TWITTER @DragosInc linkedin @Dragos, Inc.

23

OT CYBERSECURITY • YEAR IN REVIEW 2023

INDUSTRIAL RANSOMWARE TRENDS

Dragos Frontline Perspective
Dragos Incident Responders observed this exploit
impacting industrial customers during their work thisyear. In one case, the Dragos responders identified
that Citrix Bleed vulnerability was the initial attack
vector after a reconnaissance phase where thevictims’ external infrastructure was scanned.

EXPLOITING KNOWN VULNERABILITIES
Ransomware operators’ primary methods to gain initial accessto victims’ networks have remained steady in 2023, including
collaborating with initial access brokers,2 phishing, and exploiting
publicly accessible network assets, such as VPNs and RDP servers.
Dragos also observed ransomware campaigns exploiting public-

facing services such as Citrix using the Citrix Bleed vulnerabilities. These ransomware groups include Lockbit, BlackBasta,
and ALPHV. Ransomware operators are highly adept at capitalizing on recently disclosed vulnerabilities like Citrix Bleed.
They often quickly develop or use available exploitation capabilities against those vulnerable technologies and integratethat exploitation code into their ransomware operational framework. The timeline for the rapid spread of Citrix Bleed
activity, which impacted numerous industrial organizations is shown below.
Date

Event

10 October

Citrix discloses CVE-2023-4966 and CVE-2023-4967

17 October

Mandiant reports in-the-wild zero-day exploitation since at least late August 2023

23 October

Proof-of-Concept (PoC) code to exploit the vulnerability published to GitHub

24 October

GreyNoise starts detecting in-the-wild exploitation exploits

27 October

Mass exploitation of vulnerability underway. Suspected exploitation by Ransomware
group. Boeing added to LockBit 3.0 leak site.

10 November

LockBit 3.0 ransomware attack against the Industrial and Commercial Bankof China (ICBC) and DP World

11 November

Evidence of Lockbit 3.0 victim running vulnerable Citrix appliances

16 November

Medusa ransomware attack against Toyota Financial Services —suspected access via German office running a vulnerable Citrix appliance

21 November

Joint Cybersecurity Advisory released

Another example of this type of activity is from May
2023, following the public disclosure of a MOVEit zeroday vulnerability. The Cl0p ransomware group leveraged
this vulnerability to gain initial access and claimed
numerous victims. Some of these victims include criticalinfrastructure organizations, government entities related
to critical infrastructure, and organizations that support
essential infrastructure operations. The impact of vendors
and service providers can be especially problematic, given
their role in supporting control systems.

Dragos Frontline Perspective
Investigation and analysis by Dragos have yielded some
important insights into Cl0p’s activities. Notably, Dragos
was able to recover targeted process names associatedwith specific hash values embedded in a Cl0p sample. Whilemost of these are IT-related processes, Cl0p ransomware
does contain targeting of OT-related processes found on
Windows operating systems. However, it does not use
or target OT-specific protocols. Cl0p has the ability tostop many running computer programs associated with
OT vendors such as Honeywell, IBM, Mitsubishi Electric,
Rockwell, Schneider Electric, Siemens, and more.

Initial Access Brokers (IABs) are cyber adversaries that oppor tunistically attack organizations to gain access into their networks
usually through exploiting weak credentials, phishing, and watering hole techniques, and then sell that access to other cyberthreats on Darknet marketplaces and forums.

2

PAPER-PLANE info@dragos.com X-TWITTER @DragosInc linkedin @Dragos, Inc.

24

OT CYBERSECURITY • YEAR IN REVIEW 2023

LACK OF SUFFICIENT SECURITY CONTROLS
Regardless of the methods used to gain access to a victim’s environment, the ransomware groups’ ability to impact
industrial environments depends largely on the types of security controls network defenders have in place. For most of
the environments that Dragos works within, assets are not directly connected to a public-facing network but are insteadbehind at least a single layer of defense, such as a firewall or a proxy. The effectiveness of these security controls varies
greatly, and organizations should not assume that a single layer is sufficient protection.
Dragos issued findings on segmentation issues or improperly configured firewalls in 28 percent of our engagements
in 2023. Like many observations, this varies significantly across industries. Dragos continues to observe network
segmentation issues in transportation and manufacturing more frequently than other industries for instance.

28%
Dragos issued findings on segmentation issues or improperly configured firewalls in 28% of our engagements in 2023

14%

Water

16%
36%

Transportation

47%

22%
23%

Oil & Gas
Manufacturing

58%

45%

Electric

13%

22%

14%
14%

Chemical
0%

10%

20%

30%

40%

50%

60%
square 2023 square 2022

Figure 6: Reports Containing Segmentation Findings

Dragos Frontline Perspective
In 2023, Dragos observed that approximately 70 percent of OT-related incidents originated from within the IT
environment. Network segmentation and separate domains are key architectural changes recommended as
mitigations for these incidents.

PAPER-PLANE info@dragos.com X-TWITTER @DragosInc linkedin @Dragos, Inc.

70%
of OT-related
incidents originate
from within the
IT environment25

OT CYBERSECURITY • YEAR IN REVIEW 2023

LEVERAGING LIVING OFF THE LANDTECHNIQUES TO FURTHER ACCESS

Dragos Frontline Perspective

Post-compromise TTPs will vary slightly between
ransomware groups and their affiliates, but most leverage
LOTL techniques. This includes using native tools like
PsExec and PowerShell to move laterally through thevictim’s network and discover highly desirable targets. Afterestablishing remote access to one of these targets, threat
groups continue to leverage LOTL tools to escalate privileges(Task Manager, BitsAdmin, and WMIC), gain persistence(Scheduled Tasks), and establish command-and-control (SSH
and Rundll32) channels.

Dragos utilized these same LOTL techniques effectively in
63 percent of its penetration testing engagements acrossboth Stage 1 and Stage 2 of the ICS Cyber Kill Chain. Of
the LOTL techniques used by Dragos for penetration
testing, Lateral Tool Transfer (T0867) accounted for 39
percent, followed by OS Credential Dumping (T1003) at
29 percent and Security Account Manager (T1047) at 13
percent. Four other LOTL TTPs account for the remaining
19 percent: Command and Scripting Interpreter (T1059),
PowerShell (T1086), Ingress Tool Transfer (T1105), andUser Execution (T1204).

LOTL TTPs Used by PenTest TeamThe figure at right shows the LOTL TTPs used by thedifferent pen test teams. In addition to using LOTL,OS Credential
Dumping

adversaries will also use non-native tools. Over the

Lateral Tool
Transfer

29%

year, Dragos OT Watch threat hunters found unexpected

39%

remote access tools running in over 10 percent of
User
Executioncustomer OT environments. Ransomware groups use
these tools and associated TTPs to move throughout an1%

environment and compromise systems. Microsoft Active

Ingress
Tool Transfer

Directory often becomes a primary target. Ransomware
groups have been observed using tools as well as LOTL

5%

techniques to compromise Active Directory to gain

Powershell

access to valid accounts.

Dragos Frontline Perspective
To combat this, common TTP of Valid Account(T1078) compromise defenders must implement
preventative security controls, including Privileged
Account Management (M0926 and M1026), user
account management, multi-factor authentication, andpassword policies. However, most importantly, IT and OT
environments should not share an authentication domain.

PAPER-PLANE info@dragos.com X-TWITTER @DragosInc linkedin @Dragos, Inc.

6%

Command andScripting Interpreter

8%

Security AccountManager

13%

54%
Half of these
are critical orhigh severity
Dragos found remote accesssecurity issues in 54 percent
of penetration tests.

Dragos found that 1 in 10 industrial
environments have a shared domainarchitecture.

26

OT CYBERSECURITY • YEAR IN REVIEW 2023

OT VULNERABILITIESVULNERABILITY ASSESSMENT OVERVIEW
Vulnerability advisories provide information on common hardware andsoftware vulnerabilities and exposures (CVEs). Dragos analyzes vulnerability
advisories associated with ICS/OT environments and prioritizes them sothat asset owners of industrial organizations do not have to.
The difference between IT and OT environments is pronounced whenassessing vulnerabilities. The type of devices, systems, and protocols

Dragos Frontline Perspective
Dragos predicts the number ofvulnerability advisories relevant toindustrial operations will double in thenext five years. This rapid growth invulnerabilities is attributed to vendors
and researchers being more focused on
OT and because Dragos is tracking an
increasing number of sources.

used within OT environments, the network architecture of typical OT
networks, and the impact vulnerabilities can have on normal operations
14% increase

and the physical world drive these differences. OT Vulnerabilities should
be mitigated and addressed differently than IT vulnerabilities based on
the strict operational requirements of OT systems (e.g., system uptime and465

advisories

531

advisories

vendor qualification processes).
Many vulnerability management programs focus their remediation on‘Critical’ vulnerabilities with a CVSS of 9.0 or higher. That is, programs
specify that these vulnerabilities should be mitigated with urgency. There31%

had incorrect
CVSS datasquare 2022 square 2023

2,170

CVEs analyzed

7% decrease

2,010

CVEs analyzed

are three problems with this approach.
• First: Researchers often have no input to the final copy of a public
advisory and Common Vulnerability Scoring System (CVSS) scores may
be inaccurate. The reliance on industrial OEMs, which differ in maturity
levels, makes it difficult for the industrial community to have consistent14%

had incorrect
numeric
scores,incorrect
vectors
or bothscoring and severity guidance. Because of this, the vulnerability
advisories issued by the vendors and other CVE Numbering Authorities(CNA) are often incorrect and vague.
• Second: CVSS does not account for typical OT network architecture.
Network-exploitable vulnerabilities are often given a critical score evenwhen the service is not immediately exploitable in a well-architected
network.

square 2022 square 2023
In 2023, Dragos analyzed 2010 CVEs
contained in 531 advisories. This is a 14
percent increase in advisories and a 7
percent decrease in CVEs from 2022. As areminder, Dragos tracked 465 advisories
and 2170 CVEs in 2022.

• Third: Advisories often lack practical steps besides ‘apply the patch.’
Patching OT software, especially firmware, may be difficult or impossible
for many organizations. Occasionally, advisories are even released
with no patch and no other mitigation advice, making them uselessdocuments for defenders.
Instead, an approach that considers OT environments and requirements yields a better result. This is born out in ananalysis of the data at the end of each year.
PAPER-PLANE info@dragos.com X-TWITTER @DragosInc linkedin @Dragos, Inc.

27

OT CYBERSECURITY • YEAR IN REVIEW 2023

VULNERABILITY ACCURACY

16%

Advisories with no patch
when announced

Advisories with noalternate mitigation
99%

28%
Advisories that had a patch

Advisories with a patch
and no mitigation

72%
16% of advisories were network
exploitable and perimeter facing

54%
Advisories that had
no mitigation at all

Advisories with nopatch and no mitigation

74%

23%

19%
Advisories with novendor mitigation

Advisories for which
Dragos provided missing
mitigation advice

73%

Dragos identifies and makes
recommendations on vulnerabilitiesin 23% of its engagements.

Errors could cause asset owners andoperators to waste resources on
low-risk vulnerabilities over more
severe ones

49%
Figure 7: Advisories with Errors and Lacking in Ac tionable Guidance

14% of the 2010 CVEs analyzed by Dragos had errors associatedwith the advisories with incorrect data. Dragos assessed theseCVEs to correct the CVSS scores with the below results.

43%
38%
34%

31%

9%

Dragos foundto be MORE
SEVERE than the
CVSS score
2020

2021

2022

4%

Dragos found to
be LESS SEVERE

1%

were the same

2023

Dragos analyzed 531 advisories

31% had incorrect data

PAPER-PLANE info@dragos.com X-TWITTER @DragosInc linkedin @Dragos, Inc.

F i g u r e 8 : T h e S t a t e o f I C S / OT Vu l n e r a b i l i t i e s

28

OT CYBERSECURITY • YEAR IN REVIEW 2023

CVSS misapplication is the most common form of error encountered invulnerability advisories. Dragos corrects CVSS scores and often directly
contacts the vendors and researchers for clarification on how anadversary might exploit a given vulnerability.
Dragos found 9 percent of CVEs in security advisories were more severe
according to the CVSS calculator3 than reported originally. Note that arise in score should not alarm asset owners as CVSS was not built withindustrial control systems in mind. Proper urgency is better defined with
“Now, Next, Never” prioritization, which is defined more in depth later.
After correction, only 1 percent of the advisories had the exact same score.

3

h t t p s : // n v d . n i s t . g o v / v u l n - m e t r i c s / c v s s / v 3 - c a l c u l a t o r

Dragos Frontline Perspective
Dragos predicts the number of vulnerability
advisories relevant to industrial operations
will double in the next five years. This
rapid growth in vulnerabilities is attributed
to vendors and researchers being more
focused on OT and because Dragos is
tracking an increasing number of sources.

OT CYBERSECURITY • YEAR IN REVIEW 2023

VULNERABILITY RISK MITIGATIONPatching every vulnerability is difficult in OT environments and may not improve OT network security. In fact, patchingunnecessarily may bring its own risk – unsuccessful patch application may cause unwanted downtime. In addition,
many OT devices and software have “foreverday” vulnerabilities and are insecure by design. This means patching asystem to close a vulnerability may do nothing to improve the security of affected components, as underlying design
flaws are still present. A far better approach is to focus remediation and mitigation on items that positively impact theoverall hygiene of the industrial process.
Addressing vulnerabilities generally means deploying updates or applying security controls that do not already exist.
Patching within an OT environment must be done in a way that ensures that normal, safe operations are maintained.
Often, this results in patches being delayed until a maintenance window. For this reason, it is important to have alternate
methods to mitigate vulnerabilities in an advisory.

Fast patching can be impractical in ICS/OT due to safety & production
requirements. Alternative mitigation is key.

72%

Advisories with a patch54%

no practicalmitigation

28%

Advisories with no patch
when announceed19%

no patch,no mitigation

F i g u r e 9 : P r a c t i c a l R i s k M i t i g a t i o n i n I C S / OT73%

OVERALLNO PRACTICALMITIGATION FOR
ICS/OT FROMVENDOR OR CNA

In 2023, 72 percent of the advisories Dragos analyzed came with a patch, but 54 percent of those advisories with apatch contained no mitigation advice. This is a +1 percent change from last year for patches and +1 percent change for
mitigation advice. Dragos provided mitigations for the 49 percent of the advisories that had no mitigations from anyother source. Advisories with no patch when announced, accounted for 28 percent of all advisories in 2023, and roughly
19 percent of those without a patch had no mitigation at all. This leaves OT network defenders without many options
when often some of the simplest changes in behavior and tooling can have the most significant impact.

PAPER-PLANE info@dragos.com X-TWITTER @DragosInc linkedin @Dragos, Inc.

30

OT CYBERSECURITY • YEAR IN REVIEW 2023

NOW, NEXT, NEVER PRIORITIZATION
Prioritizing vulnerabilities into actionable categories saves asset owners and operators from wasting time andresources on vulnerabilities with little or no impact on their operations. To prioritize and get from the noise of the 2010
vulnerabilities to the signal of the ones you should care about, Dragos follows the Computer Emergency Response
Coordination Center’s (CERT/CC) Now, Next, Never methodology.
This methodology prioritizes the vulnerabilities that defenders should mitigate immediately and places them in the Now
category. Vulnerabilities in the Next category can be mitigated through firewall rules and good network hygiene. Thissecond group could be patched on the next maintenance cycle but should be monitored for abnormal network activity or
exploitation. Lastly, vulnerabilities that do not increase the inherent risk of the device fall into the Never category.
This prioritization considers if the vulnerability is perimeter-facing and easily exploitable, like a VPN bypass, a data
historian that may be used as a pivot point, or other weaknesses in a remote access service. These issues could enable
an adversary to obtain access to the network. Prioritization also focuses on the vulnerabilities being actively exploited bythreat groups today. Dragos looks for advisories with a public POC, making the barrier to entry lower to exploit.
Another priority must be life-safety systems. If a vulnerability introduces the capability to modify the logic on a safetysystem, that would belong in the Now category.
Using the above as the main criteria for ‘now’ vulnerabilities,
Dragos found that only 3 percent of vulnerabilities analyzed in
2023 fell into the Now category. Of the 3 percent, 17 percent are
given this rating because it’s on the network edge and 83 percent
because of the vulnerability’s capabilities.
In 2022, Dragos became a CNA (CVE Number Authority). A benefit

Of the 2010 vulnerabilities in 2023, Dragos
found that 3 percent required immediate
action. A full 68 percent can be addressed by
network monitoring, network segmentation,or MFA. And 29 percent require no immediate
action but should be monitored for signs ofpossible exploitation.

of Dragos being a CNA is that it allows Dragos to work closelywith vendors and OEMs to arrive at accurate CVSS scoring, proper
mitigations, and prioritization without giving vulnerabilities abrand name. CNAs can also ensure that timely information isreleased to end users, especially for design flaws where a vendor

NOW: Requires
immediate action

Never: No action
Required3%

29%

may require years to redesign the system and close the flaw.
Being a CNA gives the researcher freedom to publish mitigation
information in these cases.
In 2023, 35 of Dragos-discovered CVEs were publicly disclosed.
Eighteen of these CVEs were managed by Dragos as a CNA. These
included primarily network-facing vulnerabilities that should notnormally be exposed to corporate or internet networks, as well

NEXT: Restrict
access and monitor

68%

as several file format vulnerabilities that are likely to disclose
credentials or overwrite files. None were considered Now-levelvulnerabilities, despite several having ‘Critical’ CVSS scores.
PAPER-PLANE info@dragos.com X-TWITTER @DragosInc linkedin @Dragos, Inc.

31

OT CYBERSECURITY • YEAR IN REVIEW 2023

VULNERABILITY SEVERITY

Loss of view:

Loss of control and loss of view of the industrial process are among the worst

1%

scenarios in an ICS environment. The ability of operations to safely and reliably
operate a system depends on an accurate view and control of the industrial
process. Dragos investigates the possible impact of vulnerabilities to helporganizations focus on the most impactful ones.

Loss of control:

0%

In 2023, 53 percent of the advisories Dragos analyzed vulnerabilities that could
cause both a loss of view and control of the process through a vulnerable OT
system. This was a shift of +3 percent from 2022. A full 46 percent of all thevulnerabilities have no ability to impact the control or visibility of the industrial

Loss of both:process. Of these vulnerabilities, 1 percent could only cause loss of view without

53%

impacting loss of control.

WHERE THE VULNERABILITIES RESIDE IN THE NETWORK

Loss of neither
view or control:

There are different threat profiles for vulnerable assets deep within the ICS

46%

network than those at the enterprise’s border. A PLC protected by a firewall isless at risk than one directly on the internet. When prioritizing vulnerability
mitigation, organizations should consider the network landscape and where
vulnerable systems reside in their architecture.

F I g u r e 1 0 : L o s s o f v i e w, l o s s o fcontrol, or both

Dragos Frontline Perspective
Dragos found that many sectors continue to havechallenges regarding defensible architecture.
Based on report findings this year, manufacturingcontinues to struggle the most with segmentation,a core component of defensible architecture.
Following are the percentage of engagements byindustry that struggled with segmentation.

22%
Oil & Gas

51%
Manufacturing43%
Tr a n s p o r t a t i o n

PAPER-PLANE info@dragos.com X-TWITTER @DragosInc linkedin @Dragos, Inc.

15%
Wa t e r

13%
Metals/Mining

17%
Electric

14%
Chemical30%
Pulp/Paper

33%
Datacenter32

OT CYBERSECURITY • YEAR IN REVIEW 2023
Advisories ‘deep within’control network

Dragos provides expected Purdue levels per advisory
assessment based on common placement in a well-designed

80%

environment. In a well-designed network, adversaries must
compromise multiple layers before impacting industrial

Vulnerabilities at Purdue levels
0 to 362%

processes. This attack path includes gaining initial accessto enterprise networks before pivoting to OT networks tocompromise systems deep within the ICS network. This

Advisories that impact
the border19%

makes the opportunity to exploit vulnerabilities deep within
the network more challenging.

Advisories with medium
border likelihood0%

In 2023, 19 percent of these vulnerabilities were remote
access vulnerabilities bordering the enterprise, while 80
percent resided deep within the ICS network. 62 percent

Advisories that had
no Purdue level0%

pertains to vulnerabilities found at levels 0 to 3 of the Purdue
Model, which should have restricted access, among other
hardening configurations. This includes restricting access

Vulnerabilities in ICS-specificfiles or protocols

to engineering workstations, PLCs, and sensors, which can
impact the industrial process.

15%
Vulnerabilities pertaining toEngineering Workstation &Operation software
62%
Figure 11: Where do vulnerabilities
reside?

Adversaries need initial accessto OT networks to compromise
vulnerabilities deep within the
ICS network

46%
49%

Neither loss of viewnor loss of control

Loss of View andControl19%

Bordering theenterprise
Loss of Control only

80%

Deep within
ICS network

Figure 12: Where the Vulnerabilities Reside

PAPER-PLANE info@dragos.com X-TWITTER @DragosInc linkedin @Dragos, Inc.

Loss of View only

35%
36%

0%
0%
0.4%
1%

1%
1%
1.2%
1%

63%
62%

53%
50%

Network segmentation with
MFA helps avoid worst-casescenarios

square 2023 square 2022 square 2021 square 2020

33

OT CYBERSECURITY • YEAR IN REVIEW 2023

VULNERABILITY EXPLOITABILITY
Dragos continually looks for evidence of exploitation in the wild. Asset owners with vulnerable assets actively being
exploited in the wild by adversaries or proven through a penetration test have an increased urgency to mitigate. Becauseof this, exploitation is factored into the Now, Next, Never prioritization.
In 2023, 5 percent of advisories included vulnerabilities being actively exploited. Recall that only 3 percent of all advisories
are given Now priority for remediation – active campaigns make up the bulk of the highest priority remediations.
Public proof of concepts (PoCs) are examples of exploitation code available for public use. Example code may be specificto a product’s implementation and configuration, but it is meant to prove the presence of a vulnerability. PoCs can beweaponized as a stand-alone exploit or incorporated into an exploitation framework. The existence of a PoC lowers thebarrier of entry for adversaries to exploit vulnerabilities. Twenty-three percent of advisories Dragos assessed in 2023 hadpublic PoCs available at the time of disclosure.

VULNERABILITY TRENDS
Dragos observed several vulnerability trends in 2023.

THE RISE OF AUTHENTICATION-REQUIRED VULNERABILITIES
2023 saw a significant increase in the number of vulnerabilities that require authentication to exploit. Dragos first noticed atrend of high-profile vulnerabilities, which garnered a large amount of press. These vulnerabilities all had the curious aspectof requiring existing, often administrative access, to the victim’s device in order for an adversary to achieve any effect.
Based on the 2023 data andprior years, a definite surge in

25%

688
CVEs

28%

1,530
CVEs

22%

2,170
CVEs

34%

2,010
CVEs

vulnerabilities is reported, requiring
some authentication. This represents
a significant increase both in number
and percentages.

2020

2021

2022

2023

While the exact cause of such a surge is difficult to pinpoint,
there are several factors:• More devices and protocols under research areincorporating authentication. This is a positive sign.
• There is an uptick in authentication-required rootkit
exploitation, for example, against Cisco and other remoteavailability services.
• Low-hanging fruit vulnerabilities and everyday
vulnerabilities in legacy protocols have already been

Dragos Frontline Perspective
Dragos expects this trend to continue. CISA
advisories advocating for secure-by-design
development processes4 should put pressure on
vendors to provide authentication by default. It is
important that end users cite such reports during
the requirements building and procurement phasesof new installations.

uncovered and assigned CVEs (sometimes multiple times),
forcing researchers to look elsewhere.
4

Secure By Design – CISA.gov

PAPER-PLANE info@dragos.com X-TWITTER @DragosInc linkedin @Dragos, Inc.

34

OT CYBERSECURITY • YEAR IN REVIEW 2023
It is worth noting that while a privilege requirement in a vulnerability is a good thing for defenders, it is not an excuse
to label a device secure just because it has a password set. Adversaries can often find ways to obtain credentials, either
via brute force attacks, social engineering, or simply knowing default credentials for a product. For some systems,
authentication may be disabled entirely by the end user, and such a decision will not be reflected in the CVSS score.

TREND ANALYSIS BY VULNERABILITY TYPE
Common Weakness Enumeration (CWE) identifiers play a crucialrole in classifying vulnerabilities, allowing the community to relay
vulnerabilities in a shared language. They are assigned to CVEs to describe
the underlying cause of the vulnerability. In 2023, Dragos assessed eachvulnerability impacting ICS and found several noteworthy CWEs based on
their use in the wild.
OUT-OF-BOUND READ/WRITE - CWE-787/CWE-125
Out-of-bounds read and write vulnerabilities consistently rank among
the most exploited and disclosed CWEs year after year. This trend can be
attributed to the complexity of developing intricate systems with tens of
thousands of data structures and hundreds of third-party dependencies.
Such vulnerabilities exploit the way data structures are implemented andaccessed. Developers commonly use data structures to organize and store

STATISTICS
CWE-787 and CWE-125 consistently rank at
the top with the most CVEs, the most public
proof of concepts, and the most actively
exploited vulnerabilities reported year overyear. In 2023 alone, advisories reported
twelve CVEs related to CWE-787 that havebeen exploited. This figure surpasses the
CWE-787 and CWE-125 CVEs reported overthe preceding three years of ten.
Advisories containing CVEs withCWE-787/CWE-125 (combined)
2022

2023

% of advisories

54

67

12.6%

Number of CVEs withCWE-787/CWE-125

information systematically. The most basic example of this is an array, a

Year

CWE-787

CWE-125

Combined

numbered list where you can store and manage multiple pieces of information,

2022

180

94

274

making it easy to access each piece by its specific position. Issues arise when

2023

187

134

321

code can read or write beyond the predefined bounds of these structures.
Consider a scenario where a vendor employs a proprietary industrial control
system (ICS) protocol, enabling engineering workstation (EWS) software to

16% OF ALL CVEs
Number of CVEs with CWE-787/CWE-125
and a public proof of concept (+ exploits)

assign a name to a PLC. Internally, the PLC may store this data in an array

Year

CWE-787

CWE-125

Combined

within its memory, with reserved regions explicitly designated for this2022

40 of 180

27 of 94

67 of 274

purpose. Should the protocol code fail to impose character restrictions within2023

60 of 187

51 of 134

111 of 321

the array’s size, adversaries can exploit this vulnerability to write information
beyond the array’s intended memory space. An adversary, for instance, could

Notable impacted products in 2023

send a request with a name surpassing the array’s supported size, potentially• CODESYS Runtime• PHOENIX CONTACT PLCnext Firmware• Hitachi Energy’s SDM600• Rockwell Automation 1756-EN2T

resulting in loss of view and control. Ensuring secure bounds checking for alldata accesses, adopting secure programming practices, and comprehensive
code security reviews are crucial for preventing buffer overflows. The prevalentuse of third-party libraries in modern software introduces an additional
potential vulnerability avenue that may go unnoticed by developers. Therefore,
it is essential for vendors to track all software dependencies. This can beaccomplished through manual tracking or utilizing a software bill of materials

PAPER-PLANE info@dragos.com X-TWITTER @DragosInc linkedin @Dragos, Inc.

35

OT CYBERSECURITY • YEAR IN REVIEW 2023
(SBOM) service, ensuring a proactive approach to identifying and managing potential security risks associated with thirdparty components.
EXPLOITATION
Out-of-bounds read and write commands are commonly exploited by threat groups. A notable case is the TRISIS
malware, utilizing an out-of-bounds write to compromise a Triconex Safety Instrumented System. Also, this year, it
was discovered that a threat group had developed capabilities around CVE-2023-3595. This particular CVE affected the
Rockwell Automation 1756 Ethernet modules and was categorized as an out-of-bounds write vulnerability.

OS COMMAND INJECTION - CWE-78
Improper Neutralization of Special Elements used in a Command, also known
as Command Injection, is a security vulnerability that occurs when an
application does not properly handle user-supplied data within a command
it executes. In its simplest form, this vulnerability allows an adversary to
manipulate the input in such a way that the application unwittingly executes
unintended commands on the system. Adversaries do this by using special
characters to break out of the original command and execute additionalcommands.
Issues like these are common in networking devices, particularly thoseequipped with network troubleshooting tools like ping. Typically, these tools
take a user-provided IP address and insert it into a ping command in theunderlying operating system. If the device fails to properly check or validate
this input, a user with malicious intent could input something like 8.8.8.8;cat/etc/passwd. Without proper validation, the ping tool might execute thecommand ping 8.8.8.8;cat /etc/passwd on the operating system, inadvertently
exposing sensitive information like the password file to the user.
To prevent Command Injection vulnerabilities, vendors must employ secure
coding practices, including robust input validation and sanitization, usingparameterized queries, and avoiding the direct construction of systemcommands from user input.
EXPLOITATION
Palo Alto Networks reported that CVE-2022-29303 was used to spread a varietyof the Mirai botnet. This particular CVE impacted the CONTEC SolarView
Compact power monitoring system. This device has a web server that included
an emailing service which did not properly validate the email address provided
by the user. Threat groups were able to craft a malicious command injection
request that downloaded a variant of Mirai5 on to the device.

5

M i r a i - h t t p s : // u n i t 4 2 . p a l o a l t o n e t w o r k s . c o m / m i r a i - v a r i a n t - t a r g e t s - i o t - e x p l o i t s

PAPER-PLANE info@dragos.com X-TWITTER @DragosInc linkedin @Dragos, Inc.

STATISTICS
In 2023, OS Command Injection emerged as
the second most actively exploited CWE,
maintaining its consistent presence among
the top three most exploited vulnerabilities
over the past four years. This persistentprevalence can be attributed to a significant
factor: one-third of its CVEs over the last four
years have had public proof of concept. The
availability of these public proofs of concept
lowers the bar for exploitation, making OS
Command Injection an attractive target foradversaries. The accessibility of such readily
available methods reduces the effort required
for exploitation. For this reason and others,
Dragos prohibits the public disclosure of any
POCs developed by Dragos and encourages
other security vendors to do the same.
Number of advisories containing
CVEs with CWE-78
2023

2022

2021

2020

17

9

10

4

Number of CVEs with CWE-78
2023

2022

47

23

Number of CVEs with CWE-78 and apublic proof of concept (+ exploits)
2023

2022

13 of 47

3 of 23

Notable impacted products in 2023
• Siemens RUGGEDCOM ROX• Delta Electronics DVW-W02W2-E2• PHOENIX CONTACT WP• Multiple WAGO controllers and HMI36

OT CYBERSECURITY • YEAR IN REVIEW 2023
USE OF HARD-CODED CREDENTIALS – CWE-798
Vendors frequently embed credentials directly into the source code
or include static access accounts within the shipped file systems of
their products. These accounts typically remain unchangeable, leaving
product owners with no means to modify them. Attackers discoveror crack these passwords and use them to gain privileged access. In
ICS/OT, this is a common issue since many vendors ship products withmaintenance interfaces that are not mentioned to asset owners.
EXPLOITATIONBADOMEN, a PIPEDREAM6 malware module designed to target
Omron PLCs, exploited CVE-2022-34151. This CVE is associated withhardcoded credentials and encryption keys statically programmed
into the Sysmac Studio EWS software for communicating with Omron
NX/NJ PLCs. Likely by reverse engineering Sysmac Studio, the threat
group CHERNOVITE uncovered these credentials and utilized them todevelop BADOMEN. Later, the same credentials were publicly disclosed
when a project called ICS Forensics Tools7 was uploaded to Git Huband presented at Black Hat Europe by Microsoft’s Cyberx researchteam. Thankfully, shortly after the project was uploaded, the module
containing CVE-2022-34151 was removed.

STATISTICS
Since 2019, the incidence of Hard-Coded
Credentials CVEs has demonstrated anaverage annual increase of 133 percent.
However, a significant shift occurred in
2023, marking the first year new HardCoded Credentials CVEs have declined. This
year, Dragos identified 23 CVEs related tohard-coded credentials, the lowest countsince 2020 and a substantial decrease fromthe previous year’s 40 CVEs. This reduction
is possibly attributable to heightened
security awareness surrounding thesevulnerabilities. In addition, many popular
systems with hard-coded credentials havealready been uncovered and disclosed.
While relatively easy to prevent, the impactof hard-coded credentials vulnerabilities
is substantial, often leading to highly
privileged access.
Number of advisories containing
CVEs with Hard-Coded Credentials
2023

2022

17

23

CVEs with Hard-Coded Credentials
2023

2022

23

40

Number of CVEs with Hard-Coded
Credentials and a public proof of conceptthat had exploits
2023

2022

3 of 23

1 of 40

Notable impacted products in 2023

Dragos Frontline Perspective
Dragos found default credentials in 43 percent ofpenetration tests in 2023, yet only 4 percent ofarchitecture reviews. This disparity shows that
default credentials are very common to encounter, yetsystems owners are often unaware of their presence.

6
7• Moxa NPort IAW5000A-I/O Series• Siemens SICAM A8000• Schweitzer Engineering Laboratories
SEL-5037 SEL Grid Configurator• PHOENIX CONTACT WP 6xxx

P I P D R E A M — h t t p s : // w w w. d r a g o s . c o m / b l o g / i n d u s t r y - n e w s / c h e r n o v i t e - p i p e d r e a m - m a l w a r e - t a r g e t i n g - i n d u s t r i a l - c o n t r o l - s y s t e m s /I C S F o r e n s i c s To o l s — h t t p s : // g i t h u b . c o m / m i c r o s o f t / i c s - f o r e n s i c s - t o o l s

PAPER-PLANE info@dragos.com X-TWITTER @DragosInc linkedin @Dragos, Inc.

37

OT CYBERSECURITY • YEAR IN REVIEW 2023
STATISTICS

PATH TRAVERSAL – CWE-22
Path traversal vulnerabilities were among the most prevalent
types of vulnerabilities analyzed by Dragos in 2023. Typically, thesevulnerabilities affect web servers and other applications that interact
with the local file system of a device, host, or server. They also frequently
impact engineering software, where project files contain file paths as apart of the archive.
Exploiting such vulnerabilities often results in adversaries gaining
unauthorized access to restricted or unintended areas within the filesystem. These issues typically arise when user input is not properly
validated or sanitized when constructing file paths or accessing files on
the file system.
For example, consider a web server that serves images at the universal
resource locator (URL): https://x.y.z/images/johndoe.jpeg. An adversary
could craft a malicious URL using escape characters to access sensitive
files. It’s important to note that URL paths are not the only vectors forthese types of attacks. Any process that relies on user input to access

Path traversal remains consistently among
the most common vulnerabilities year afteryear, averaging 54 CVEs annually over the
past three years, placing it among the top
5 most prevalent vulnerabilities. What’s
particularly concerning is that this CWE22 has become the second most actively
exploited in 2023, following the use ofthis technique in PIPEDREAM in 2022 andagainst FortiOS by PARISITE in 2019 and
VANADINITE in 2020, and has consistently
ranked in the top 5 most exploited CWEs
since 2020. Despite this, path traversal
vulnerabilities are relatively straightforward
to prevent. By implementing proper user
input validation, these issues can be entirely
avoided. In the coming years, efforts toaddress and mitigate this vulnerability typewill hopefully lead to a positive trend in the
opposite direction.
Number of advisories containing
CVEs with Path Traversal

files could potentially be vulnerable to path traversal attacks. In addition

2023

2022

to this, various techniques, including zipslips and universal naming

23

26

9

convention (UNC) path injection, can also be used to exploit path

4% OF ALL ADVISORIES

traversal vulnerabilities.
Number of CVEs with Path Traversal

EXPLOITATION

2023

2022

CVE-2018-13379 is a path traversal vulnerability that impacts FortiOS,

55

53

the operating system used by Fortinet’s FortiGate Firewall. Dragos has
observed adversaries conducting exploitation against CVE-2018-13379
against industrial or ICS entities using Fortinet devices, including
PARISITE and VANADINITE.
CVE-2022-33971 is a blank CVE covering a number of individual issues
in Omron PLCs, including a path traversal flaw in the embedded web
application. The BADOMEN tool allows for file listings, retrieval, andoverwrite on the PLC firmware using the file APIs.

3% OF ALL CVEs
Number of CVEs with Path Traversal
and a public proof of concept that had
exploits
2023

2022

10 of 55

10 of 53

Notable impacted products in 2023
• Omron Sysmac Studio and NX-IO
Configurator (EWS Software)• Schweitzer Engineering Laboratories
SEL-5033 and SEL-5036 (EWS Software)• Fortinet FortiOS (networking devices)• Siemens SICAM A8000 Devices(Remote Terminal Unit)

9

Z i p S l i p - h t t p s : // s e c u r i t y. s n y k . i o / r e s e a r c h / z i p - s l i p - v u l n e r a b i l i t y

PAPER-PLANE info@dragos.com X-TWITTER @DragosInc linkedin @Dragos, Inc.

38

OT CYBERSECURITY • YEAR IN REVIEW 2023
NEIGHBORHOOD KEEPER VULNERABILITY DATA
In 2023, Dragos added vulnerability tagging to its Neighborhood Keeper
program. This presents both Neighborhood Keeper users and Dragos# of CVEs present on Neighborhood
Keeper participant networks
by CVE year

analysts with data regarding vulnerabilities on Neighborhood Keeper

2010

•

participants’ networks.

2011

••
•
•••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••

2012
This data provides an interesting glimpse at what products are most2013

often left unpatched on industrial networks.

2014

Perhaps unsurprisingly: PLCs, industrial computers marketed for use as
HMIs, industrial network switches, and remote IO devices, make up thebulk of vulnerable components.

2015
2016
2017
2018

What is surprising about the vulnerable components is how long2019

equipment is often left unpatched. It is not possible to gather complete

2020

numbers for vulnerable components due to the anonymous nature of

2021

Neighborhood Keeper participation at present, however the data can

2022

be broken down by CVE year. When counted simply for number ofoccurrences of a particular CVE on a network, by year, the following data

2023

••

••
••
••
••
••
••
••
••
••
•
••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••••
•••
•••
•

is shown at right.
Again, it can be misleading to read too much into Neighborhood Keeper data. Visibility biases are present in the data,
both in terms of where Neighborhood Keeper sensors are deployed an in terms of what vulnerabilities can be identified
by Neighborhood Keeper sensors. For an example of the latter: vulnerabilities in engineering software with file format
issues, are almost certainly not observable by Neighborhood Keeper…unless the software also broadcasts a very obvious
network to identify itself, these vulnerabilities could only be discovered with a more thorough assessment that includes
inspecting individual host filesystems.
The data does, however, show some interesting characteristics. Specifically: many control systems networks go
unpatched for long periods of time. Fully half of the identified vulnerability years are CVEs dating 2016-2017, meaningthat vulnerabilities patched 6-7 years prior were extremely prevalent on networks in 2023.
A key takeaway from this analysis is that advisories absolutely must come with alternate mitigation advice: many end
users may fail to apply patches for years after they become available. Indeed, many end users may NEVER apply patches,
even when those patches are deemed of critical importance. Thankfully, these end users take other steps to defend thevulnerable components.
Looking at Neighborhood Keeper data from different angles: of the vulnerabilities which occurred most frequently in
the Neighborhood Keeper dataset, none were labeled of immediate importance. Of the 493 CVEs that Dragos tracks as
Now, meaning that immediate action should be taken by owners to remediate the vulnerability, only 86 are observedon Neighborhood Keeper participant networks. Some of these 86 vulnerabilities are widespread across Neighborhood
Keeper participants.

PAPER-PLANE info@dragos.com X-TWITTER @DragosInc linkedin @Dragos, Inc.

39

OT CYBERSECURITY • YEAR IN REVIEW 2023
The prevalence of a vulnerability within the community is part of the analysis that Dragos uses to prioritize exploitation
detection development. That is, some vulnerabilities are likely to go years or decades without patching. When thesevulnerabilities are deemed critical – because known threat groups target the component, or because public PoC exploits
are readily available – and the observation is made that most users do not apply patches for the vulnerability, then adetection for exploitation becomes much more important.

ASSESSING CYBER READINESSIn 2023, we saw major regulatory shifts for critical infrastructure asset owners, resulting in organizations devoting moretime and resources to preparing for a cybersecurity event. This included updates for U.S. pipeline operators in North
America with TSA Pipeline-2021-02D (SD-02D). In Europe, it was the Network and Information Systems Directive (NIS2);
in Australia, the Security of Critical Infrastructure SOCI Act; and, the Essential Cybersecurity Controls (ECC) ECC in theKingdom of Saudi Arabia. One of the most significant changes was not targeted at critical infrastructure but at firms
publicly traded in the U.S.: the new Securities and Exchange Commission (SEC) Cybersecurity Risk Management Rules.
These rules apply to many OT asset owners, including investor-owned utilities and manufacturing firms.
Dragos observed organizations growing their cybersecurity capabilities, defining or refining processes, and exercisingplans. Organizations leading in this area are shifting from a reactive mindset that leverages break-glass retainers toa holistic approach for incident response that includes multiple levels within organizations supported by detection
capabilities, training, and external experts.
Developing resiliency is a focal aspect of the 5 Critical2023 Service Engagements with 5CC Findings

Controls for OT Cybersecurity.10 Of all Dragos services
engagements in 2023, 94 percent had a finding relating

Vulnerability Mgmt

to one of these controls. Improving ICS network visibility

Secure Remote Accesstops the list appearing in more than half of our reports.

Asset Visibility

Limited logging and monitoring, weak segmentation,

Defensible Architecture

and lack of asset inventories were some of the other top

Incident Response Plan

41%
29%
61%
46%
38%

recurring findings Dragos issued that were relevant to thefive critical controls.
Dragos has observed this shift through findings identified
while working on tabletop exercises with customers.
In 2023, the quantity, type, and scope of the exercisesthat Dragos facilitated changed. The number of 2023
tabletop exercises doubled from 2022, and executive andboard-level tabletop exercises tripled. This highlights
organizations’ increased focus, rooted in executive
management, on being prepared for a cybersecurity event.
10

Dragos Frontline Perspective
Dragos executed its largest exercise in 2023 in partnershipwith a longtime customer. The exercise included over 350
participants across multiple levels parts of the business. The
exercise allowed responders, operators, adjacent business
units, partners, and leadership to practice responding toa large-scale cybersecurity event using incident response,
business continuity, and crisis management plans. The
exercise was modeled on threat group activity and capabilities
observed in 2023.

h t t p s : // h u b . d r a g o s . c o m / g u i d e / 5 - c r i t i c a l - c o n t r o l s

PAPER-PLANE info@dragos.com X-TWITTER @DragosInc linkedin @Dragos, Inc.

40

OT CYBERSECURITY • YEAR IN REVIEW 2023
2023 Tabletop Exercise Share Growthper Industry (2022–23)

This shift was not perceived equally across industry verticals, but nearly all
verticals increased focus on tabletop exercises. The most significant increase
was seen in the electric sector, where the tabletop exercises’ share of reports

104%

in that sector increased 104 percent year over year. Throughout the industrial
37%

Oil & Gas

Even when regulations don’t require organizations to perform exercises,

38%

Manufacturing

67%

space, teams are shifting focus toward tabletop exercises.
20%

25%

38%

registrants to disclose an event within four business days after a registrant
determines that a cybersecurity incident is material. It also requires that

Water

Pulp & Paper

the SEC Cybersecurity Risk Management Rules. The SEC ruling requires

Electric

is the case with one of the most significant changes in regulation this year:

Data Center

Chemicalmany willingly conduct them to increase awareness and preparedness. This

organizations describe how they will assess, identify, and manage material
risks from cybersecurity threats and how their boards will provide oversight.
Tabletop exercises’ findings and associated recommendations are

Dragos Frontline Perspective

organized by core capabilities for ICS/OT cybersecurity readiness and

SEC 8K regulatory requirements havebecome a major theme during most
exercises involving public companies that
operate in the United States. Executive
leadership and boards have taken a more
active role in managing and governing
cybersecurity risks.

incident response. These are detect, communicate, activate, respond,
contain, document, and recover. Core capabilities map to standard incident
response processes regardless of whether the organization favors thefour-step National Institute of Standards and Technology (NIST) process,
SANS Preparation - Identification - Containment – Eradication - Recovery- Lessons Learned (PICERL), or some variation. Regardless of how theincident response plan is structured, these capabilities are needed to handle
a cybersecurity event successfully.
The core capabilities tested with the lowest aggregate score wasCommunicate, although scores across all capabilities fell in 2023, with theContain capability falling by 19 percent year over year. The Contain corecapability requires organizations to understand the scope and impact of anevent before taking appropriate action.

Core Capability

2022 Score

2023 Score

ChangeDetect

73%

65%

-8

Activate/Elevate

81%

67%

-14

Respond

76%

62%

-14

Contain

81%

64%

-17

Communicate

76%

57%

-19

Document

73%

65%

-8

Remediate/Recover

81%

61%

-20

Metrics are as follows
square Performed without Challenges
80-100square Performed with Some Challenges
66–79
square Performed with Major Challenges
50–65
square Unable to Perform 0–49

F i g u r e 1 3 : Av e r a g e Ta b l e t o p E x e r c i s e S c o r e s ( A l l O T )PAPER-PLANE info@dragos.com X-TWITTER @DragosInc linkedin @Dragos, Inc.

41

OT CYBERSECURITY • YEAR IN REVIEW 2023

Dragos Frontline Perspective
Dragos tabletop exercise facilitators
observed that even matureorganizations with well-developed
detection capabilities and processes
often overlook the expertise thatsystem operators and engineers canprovide. Integrating cybersecurity
awareness into daily practices, especiallytroubleshooting, can result in valuable
human detection capabilities.

Not every sector performs the same. During 2023, the electric sector
scored the lowest, with an aggregated score of 59 percent across all corecapabilities.

Electric

Oil & Gas

Manufacturing

PharmaDetect

61%

68%

63%

69%

Activate/Elevate

63%

65%

69%

69%

Respond

60%

70%

60%

56%

Contain

61%

65%

60%

69%

Communicate

51%

68%

52%

56%

Document

58%

63%

69%

69%

Remediate/Recover

61%

70%

63%

50%

Core Capability

square Performed without Challenges 80-100		square Performed with Some Challenges 66–79

square Performed with Major Challenges 50–65

square Unable to Perform 0-49

F i g u r e 1 4 : Av e r a g e Ta b l e t o p E x e r c i s e S c o r e s b y I n d u s t r y

PAPER-PLANE info@dragos.com X-TWITTER @DragosInc linkedin @Dragos, Inc.

42

OT CYBERSECURITY • YEAR IN REVIEW 2023
Ransomware remains the most common
scenario in 2023, accounting for 50
percent of scenarios. The scores against
ransomware were lower in every
capability than the average scores that
included all scenarios.
Core Capability

Score

Detect61%

Activate/Elevate

72%

Respond67%

Contain59%

Communicate

60%

Document

66%

Remediate/Recover

67%

Dragos Frontline Perspective
Dragos found that organizations that have developed andutilized OT-specific incident response plans and ransomware
playbooks during exercise perform better. Unfortunately,
there is still a significant gap in organizations implementing
these. Dragos found that 27 percent of engagements included
a finding indicative of a weakness in the organization’s
incident response plan, and 12 percent that were completely
lacking an OT incident response plan. This is not evenly
distributed across verticals, with manufacturing and chemical
having the most incident response plan findings as apercentage of sector engagements.

Manufacturing

53%

Chemical

50%

Electric

38%

Data Center

33%

Transportation

22%

Oil & Gas

21%

Figure 15: Incident response planning findings
by industry

PAPER-PLANE info@dragos.com X-TWITTER @DragosInc linkedin @Dragos, Inc.

43

Dragos is an industrial (ICS/OT) cybersecurity
company on a mission to safeguard civilization.
Dragos is privately held and headquartered in
the Washington, D.C. area with regional presencearound the world, including Canada, Australia,
New Zealand, Europe, and the Middle East.
Dragos.com

X-TWITTER

facebook

linkedin

Copyright © 2024 Dragos, Inc. All Rights Reserved.