The PolySwarm Blog

Verticals Targeted: Energy

Executive Summary

Cactus is a ransomware family that has been active since at least March 2023 and has been gaining momentum in recent months. Cactus recently claimed an attack on Schneider Electric.

Verticals Targeted: Government

Executive Summary

Volt Typhoon was observed compromising Cisco RV325 devices with KV-Botnet.

Verticals Targeted: Critical Infrastructure, Information Technology

Executive Summary

Cuba ransomware was observed using the Veeam vulnerability (CVE-2023-27532) in June to target critical infrastructure and IT entities in the US and Latin America.

Related Families: SystemBC
Verticals Targeted: Energy

Executive Summary

An African energy sector entity was recently targeted using DroxiDat, a variant of SystemBC.

Verticals Targeted: Utilities, Energy, Water, Critical Infrastructure

Verticals Targeted: Energy, Critical Infrastructure

Executive Summary

CosmicEnergy is a novel malware targeting operational technology (OT) and ICS.

Verticals Targeted: Critical Infrastructure, Communications, Manufacturing, Utility, Transportation, Construction, Maritime, Government, Information Technology, Education

Executive Summary

Volt Typhoon was discovered targeting critical infrastructure entities in the US mainland and Guam. Volt Typhoon maintained stealth throughout this espionage campaign.

Related Families: DboxShell, PowerMagic
Verticals Targeted: Defense, Critical Infrastructure, Transportation 

Executive Summary

RedStinger, a relatively unknown threat actor group, targeted multiple entities in Ukraine, including those in the defense, transportation, and critical infrastructure verticals.