ELECTRUM and KAMACITE are two long-running Dragos-tracked threat groups whose operations have defined much of the ICS threat landscape over the past decade. KAMACITE primarily conducts operations focused on Stage 1 of the ICS Cyber Kill Chain – initial access, enterprise compromise, and preparation for an OT pivot – while ELECTRUM executes ICS-specific actions that can lead to operational disruption and destruction. Their activity, which overlaps historically with operations attributed to Sandworm, offers critical insights into how well-resourced adversaries target operational technology (OT) environments today.
In this webinar, Dragos adversary hunters break down the OT intrusion lifecycle across primary ICS-impacting operations, highlight evolving tradecraft patterns, and share what recent activity reveals capabilities emerging now. Attendees will gain a clear understanding of how ELECTRUM and KAMACITE operate, and which behaviors most reliably signal progression toward OT impact.
