State-sponsored group targeting US electric utilities and critical infrastructure. Uses living-off-the-land techniques to maintain persistent access to OT networks. Pre-positioning for potential disruptive/destructive attacks on the power grid.

Russia's most capable OT-focused threat group. Responsible for Ukraine power grid attacks (2015, 2016) and NotPetya. Develops custom ICS malware including Industroyer/CrashOverride and CaddyWiper.

Developers of PIPEDREAM/INCONTROLLER — the most dangerous ICS malware framework ever discovered. Modular toolkit targeting Schneider Electric, Omron, and OPC UA systems. Can manipulate PLCs, disrupt safety systems, and cause physical destruction across multiple ICS vendors.

Focused on electric sector ICS/SCADA systems. Developed and deployed Industroyer malware capable of directly interacting with IEC 101, IEC 104, IEC 61850, and OPC DA protocols to manipulate power grid equipment.

Iran-linked group targeting oil & gas and manufacturing OT environments. Known for destructive attacks using wiper malware and exploiting IT-OT convergence points. Opportunistic but increasingly sophisticated in OT targeting.

Targets energy sector organizations for espionage and pre-positioning. Focuses on IT networks adjacent to OT for intelligence gathering. May hand off OT access to more specialized groups like KAMACITE/ELECTRUM.

Targets electric utility organizations primarily for espionage. Focuses on gaining access to OT network architecture documentation, SCADA configurations, and engineering drawings rather than immediate disruption.

North Korea-linked group targeting nuclear and energy facilities. Primary objective appears to be technology theft and espionage, with secondary capability for disruptive attacks.