Dragos released its 2026 OT/ICS Cybersecurity Year in Review, naming three new industrial threat groups: Azurite, Pyroxene, and Sylvanite. With these additions, Dragos now tracks 26 active groups targeting operational technology environments. All three new groups are already past the initial reconnaissance phase.
Azurite: inside the network, watching the machines
Azurite is classified as Stage 2, meaning it has demonstrated the ability to operate inside OT environments rather than just reaching them. It overlaps with the cluster tracked publicly as Flax Typhoon, a Chinese nexus group. Azurite uses engineering workstations as staging points to collect and exfiltrate OT-specific data: process historian exports, HMI configurations, network diagrams. No process manipulation has been observed yet. Dragos assesses this as pre-positioning: the group is learning the environment before it acts.
Target sectors include manufacturing, automotive, electric, oil and gas, pharmaceutical, defense industrial base, and government. Geography spans the US, Australia, Europe, Japan, South Korea, and Taiwan.
Pyroxene: getting in through the supplier
Pyroxene is also Stage 2. It overlaps with UNC1549, an Iran-nexus cluster. Its distinguishing feature is initial access methodology: Pyroxene does not attack the target organization directly. It targets the suppliers, contractors, and integrators who have legitimate network access to the target. Once inside a supplier, it uses that trusted relationship as the on-ramp.
Dragos links Pyroxene to an initial access provider called Parisite. Target sectors are aviation, aerospace, defense, and maritime. Target geographies include the US, Western Europe, Israel, and the UAE.
Sylvanite: fast and feeding
Sylvanite is Stage 1, meaning it focuses on gaining and maintaining footholds in IT and OT-adjacent environments rather than directly operating within OT. Its role in the threat ecosystem is to move quickly on newly disclosed edge device vulnerabilities and hand those footholds to Stage 2 actors, specifically Voltzite, within days of vulnerability disclosure. The speed is the point: Sylvanite's value is converting new CVEs into established access before defenders can patch.
Target sectors include electric power, water, oil and gas, manufacturing, and public administration. Target geography is North America, Europe, and Asia-Pacific broadly.
Shared TTPs across all three groups
Dragos documents several tools and techniques appearing across multiple new groups. Edge device exploitation targets F5 BIG-IP, Palo Alto GlobalProtect, and Citrix VPN appliances, consistent with the broader 2026 trend of OT-adjacent perimeter compromise. Post-access tooling includes Cobalt Strike and a loader called JoJoLoader.
Two OT-specific tools are particularly notable. PLC_Controller.exe forces Siemens S7-300 and S7-400 PLCs into STOP mode using the S7comm and COTP protocols, halting industrial processes. Exploit.ps1 overwrites Modbus holding registers, corrupting the values that control physical processes. Neither tool is theoretical; both have been observed in campaigns. Additionally, Dragos confirmed AI-assisted attack tooling in one campaign, though the specific capability was not detailed publicly.
The pattern: reconnaissance is over, disruption is starting
The 2026 report's framing is significant. Dragos describes a shift from adversaries using OT access for intelligence collection and pre-positioning toward adversaries willing to cause real-world operational disruption. The PLC_Controller.exe and exploit.ps1 tools are not reconnaissance tools; they are designed to stop processes and corrupt control data. The Stage 1 to Stage 2 pipeline that Sylvanite and groups like it enable makes this escalation faster.
For operators of industrial environments: if you have F5, Palo Alto, or Citrix edge devices at the IT/OT boundary, your patch cadence for those devices directly affects your OT exposure. The supply chain vector Pyroxene uses means your patch posture is only as good as your suppliers' patch posture. And if you have Siemens S7-series PLCs on networks that are not fully air-gapped from internet-connected systems, PLC_Controller.exe is a relevant threat.