Malware variants that target operational tech systems are very rare – but 2 were found last year

The report describes Dragos' 2024 OT/ICS review: two new ICS-specific malware families (Fuxnet and FrostyGoop) were observed disrupting sensor networks and municipal heating in Ukraine, ransomware against OT rose sharply (87% year-on-year to 1,693 infections), and two new threat groups (Bauxite and Graphite) with links to state-backed actors were identified; the use of Modbus commands and Meter-bus DoS demonstrates new, high-consequence TTPs and raises the risk of proliferation to other actors.