Critical Infrastructure — Cyber Threat Activity

Threat actors, incidents and malware targeting the Critical Infrastructure sector — 1 recorded incident and 37 tracked groups.

• Recorded incidents: 1
• Incidents, trailing 180 days: 0
• Tracked threat actors: 37
• Malware families: 62

All sectors

Threat actors targeting Critical Infrastructure

• Volt Typhoon 1 incident
• RansomHub researched targeting
• Black Basta researched targeting
• BlackSuit researched targeting
• Conti researched targeting
• Cyber Av3ngers researched targeting
• DarkSide researched targeting
• Dragonfly researched targeting
• Sandworm Team researched targeting
• Qilin researched targeting
• DragonForce researched targeting
• MedusaLocker researched targeting
• Brain Cipher researched targeting
• Interlock researched targeting
• NoName057(16) researched targeting
• BlackJack researched targeting
• Cardinal researched targeting
• Cyber Army of Russia Reborn researched targeting
• Cyber Islamic Resistance researched targeting
• Cyber Support Front researched targeting
• Dark Angels researched targeting
• Dark Storm Team researched targeting
• DoppelPaymer researched targeting
• Edalat-e Ali researched targeting

Malware used against Critical Infrastructure

Families used by the threat actors that target this sector, derived from actor tooling rather than observed in these incidents directly.

• Cobalt Strike Malware
• Conti Malware
• Emotet Malware
• Impacket Tool
• Mimikatz Tool
• NotPetya Malware
• PsExec Tool
• Ryuk Malware
• TrickBot Malware
• AdFind Tool
• BlackEnergy Malware
• BloodHound Tool

Where these victims are

• United States 1

Recent incidents

• US Critical Infrastructure (multiple sectors) 2024-01-31

Coverage. 76.7% of incidents in our log carry a sector classification; the remainder name a victim we have not placed in an industry. Counts here are a floor, not a total, and are not comparable between sectors of different sizes.

Read the full analysis on IntelFusions