Cyber threat groups around the world continued to expand their capabilities in 2025, while their targets in developed countries largely failed to keep pace, cybersecurity firm Dragos warned in its Year In Review report released Feb. 17.
Multiple threat groups “crossed a line” by taking steps toward active disruption of victims’ operational technology and industrial control systems assets, rather than “simply gaining access and waiting,” Dragos said. The firm called this action “the removal of the last practical barrier between having access and being able to cause physical consequences” and a sign that malicious actors are preparing to act against their targets.
Dragos used multiple sources to compile the report, including its monitoring resources inside clients’ OT environments, trusted partners and third-party datasets. The firm considers its information “the world’s largest dataset on OT security … threats and vulnerabilities” but warned that “no government, vendor or other entity can have” a complete view of the threat landscape.
Among the 26 threat groups Dragos tracks, 11 were active in 2025. The active groups included Electrum, blamed by Dragos for an attack against Poland’s power grid Dec. 29. (See Dragos Blames Electrum Group for Poland Grid Cyberattack.) The company has a policy against identifying threat actors with specific countries, but the Cybersecurity and Infrastructure Security Agency has linked Electrum to Unit 74455 of Russian military intelligence. The group has also been linked with cyberattacks against Ukraine’s energy grid in 2015 and 2017.
Dragos has called the December event “the first major coordinated attack targeting distributed energy resources at scale.” Attackers targeted systems managing communications and control between grid operators and DERs, gaining access to OT systems with direct access to generation assets.
Although communication was lost, no outages occurred because the default behavior of the affected devices was to remain on. Dragos also wrote in its report on the incident that the relatively large percentage of inertial generation on Poland’s grid — with coal-fired plants representing more than 50% of the generation fleet — made the attack “unlikely to cause a nationwide blackout” in the country.
In a press conference accompanying the release of the report, Dragos CEO Robert M. Lee said the Poland attack should set off alarms in countries that have moved more aggressively to transition to DERs.
“These are usually remote assets. … Because they’re not big, they generally don’t have the same level of budget [as coal and nuclear plants]; therefore, they’re not getting … the security, which we wish was better, for even those facilities,” Lee said. “But they’re making up more and more of the energy portfolio. [It] used to [be], going after a wind farm … we can cover it. But if 25% of your electric system is wind farms and somebody goes after them, it could be impactful to you.”
Lee said utilities should take the event as a sign that threat actors have recognized the growing importance of DERs on the system. He also emphasized that while there is no evidence that the attackers tried to use the compromised communications equipment to misoperate the connected DERs, this reflects a lack of visibility into the system and should cause concern rather than relief.
“I can’t say with confidence that the attacker wasn’t inside the control loop. … When I talk to governments … I don’t love being in the position to tell them, ‘We’re not actually sure if the adversary is there or not, but the power is on,’” Lee said. “That’s not a very comfortable place to be for a lot of folks. What I can tell you is that [with] the access they had, they absolutely could have gone further. … It wouldn’t have been rocket science to go the extra step.”
Lee praised FERC and NERC for adding requirements to the ERO’s Critical Infrastructure Protection standards in 2025 that electric utilities implement internal network security monitoring at many grid-connected cyber systems to detect intrusions into their OT networks. (See FERC Responds to ERO’s INSM Clarification Filing.) However, he urged utilities to get their monitoring in place ahead of the deadline, saying that the Poland attack shows attackers are already willing and able to infiltrate them.
New Attackers Identified
Three of the other threat actors observed in 2025, named Azurite, Pyroxene and Sylvanite by Dragos, were newly identified last year, although they are believed to have been active for longer.
All three have targeted victims in the U.S., among other countries, and Azurite and Sylvanite are both known to have targeted the electric industry.
On a technical level, Azurite’s attacks share similar techniques with the Flax Typhoon threat group. Microsoft has claimed that Flax Typhoon is based in China and primarily operates against targets in Taiwan.
Dragos wrote that Azurite’s activities have demonstrated the ability to reach Stage 2 of the ICS kill chain, defined by SANS Institute as a capability to meaningfully attack the ICS, as opposed to espionage or intelligence gathering. The organization clarified that it has not yet observed Azurite manipulate or modify OT software, but the threat group has been seen to operate in OT environments using lateral movement and has demonstrated “knowledge of OT-centric software.”
Pyroxene has also demonstrated Stage 2 capabilities, Dragos wrote. The group has overlaps with APT35, a cyber actor linked with the government of Iran and also known as Charming Kitten, Phosphorus and Mint Sandstorm.
Pyroxene’s targets to date have been in the utility, telecommunications, technology, manufacturing and logistics space, including a water utility serving the port of Haifa in Israel. Other victims have been in the Middle East, U.S. and Europe.
Sylvanite has demonstrated only Stage 1 capabilities, specializing in gaining initial access that it then hands off to other actors for further exploitation. The group’s partners include Voltzite, which Dragos reported had gained Stage 2 capability in 2024. (See Dragos: Attacks on ICS Increased in 2024.) Dragos found “extensive technical overlaps” between Voltzite and Volt Typhoon, the China-connected group that has been accused of embedding itself in the information technology networks of U.S. critical infrastructure organizations for more than five years.
