FREE REPORT 

ELECTRUM and KAMACITE have driven some of the most consequential ICS attacks observed over the past decade, including the 2015 and 2016 Ukraine power grid disruptions and the development and deployment of purpose-built ICS malware such as CRASHOVERRIDE.

These two threat groups have demonstrated a repeatable path from enterprise compromise to OT impact and established techniques later employed by other threat groups. KAMACITE enables initial access and movement toward OT boundaries, while ELECTRUM executes ICS-specific actions that result in physical-world consequences. Their activity overlaps with operations attributed to Sandworm.