2025年运营技术（OT）威胁报告

THREATREPORTNovember 2025 EXECUTIVE SUMMARY From April 1 to September 30, 2025, operationaltechnology (OT) and industrial control systems (ICS)faced unprecedented threats from sophisticatedadversaries. Trellix telemetry detected272,512 OT/ICS- The threat landscape reveals coordinated campaignsby state-sponsored actors and ransomware groups,with the manufacturing, transportation and shipping,utilities, and energy/oil and gas sectors bearing the OT THREAT LANDSCAPE OVERVIEW The global OT threat environment has intensified significantly,driven by geopolitical tensions and the increasing digitization of industrialsystems. State-sponsored actors from Russia, Iran, and North Korea have Manufacturing emerged as the primary target, representing 41.5% of alldetections. This concentration reflects the sector’s critical role in globalsupply chains and often inadequate OT security measures. Transportation This breakdown represents threats detected primarily within ITinfrastructure of organizations operating in OT/ICS industries, ratherthan detections from OT environments themselves. These detectionsacross email (55.6%), network perimeter (25.4%), and endpoint (18.5%) Geopolitical factors significantly influenced targeting patterns. Russian-linked groups focused on Ukrainian energy infrastructure, while Iranianactors concentrated on regional petrochemical facilities. The ongoing THREAT ACTOR ACTIVITY Sandworm Team (Russia, GRU Unit 74455) Profile Sandworm Team, also known as BlackEnergy, Voodoo Bear, or Iron Viking,remains one of the most aggressive and capable state-sponsored threat actorstargeting OT environments. Operated by Russia’s GRU Main Center for Special Activity and Tactics Between 2022 and 2025, Sandworm dominated industrial threat telemetry,responsible for nearly a third of observed OT-related intrusions. They continuedsystematic campaigns against Ukrainian energy, telecommunications, andgovernment networks, deploying Industroyer2 to disrupt power substations,and multiple destructive wipers—CaddyWiper, NikoWiper, and ORCSHRED— Impact and Outlook Sandworm’s campaigns have demonstrated a repeatable, modular attackmodel for targeting ICSes, positioning them as the benchmark for nation-state-level OT threats. The group’s persistent evolution of wiper familiesand exploitation of both IT and OT protocols indicates ongoing R&D TEMP.Veles / XENOTIME (Russia-linked, Safety Systems Focus) ProfileTEMP.Veles, also tracked as XENOTIME, is an elite, possibly Russian-linked actor behind the TRITON (also known as TRISIS or HatMan) malware. They specializein compromisingsafety instrumented systems (SIS), specifically the Triconex Activity and TacticsTheir hallmark intrusion, against aSaudi Arabian petrochemical facility in 2017, aimed to reprogram safety controllers to cause physical damage or lossof life. Since then, TEMP.Veles has been observed conducting reconnaissanceand persistence operations in energy and chemical facilities worldwide. They Impact and OutlookTEMP.Veles/XENOTIME remains themost technically advanced OT adversary known, being the only actor to directly attempt to subvert safetysystems. Their ongoing reconnaissance activity suggests intent to maintaincontingency access for potential future sabotage. For defenders, this group Qilin Ransomware Group (Cybercriminal, OT-targeting Affiliate Network) Profile Qilin (also known as Agenda) represents the new generation of ransomware-as-a-service (RaaS) operations explicitly extending into industrialenvironments. While financially motivated, their operations increasingly exhibit Activity and Tactics From mid-2024 through 2025, Qilin led all ransomware activity againstindustrial entities, with 63 confirmed attacks, including against UgandaElectricity Transmission Company and several water utilities across Europeand Asia. They often deploy dual-use payloads capable of disrupting both ITand OT networks by encrypting shared engineering resources, configuration Impact and Outlook Qilin exemplifies the blurring of criminal and OT-focused threats, leveragingransomware as both extortion and disruption tools. Their success underscoreshow ransomware operators are learning to exploit availability-sensitiveenvironments for maximum leverage. Continued cross-sector collaboration APT33 and APT34 (Iran, Oil and Gas Espionage and Sabotage) ProfileAPT33 (Elfin) and APT34 (OilRig) are Iranian state-linked groups active since the mid-2010s, both heavily focused on the energy sector and regional rivalsin the Gulf. Initially known for cyber espionage and credential harvesting, both Activity and TacticsAPT33 has targeted aviation, petrochemical, and manufacturing networks to exfiltrate intellectual property and credentials for follow-on access. APT34maintains persistent footholds in energy and government environmentsthrough phishing and exploitation of web-facing infrastructure. In latercampaigns, both groups deployed Shamoon and ZeroCleare wipers to ca