New ICS Threat Activity Group: VANADINITE

Dragos details VANADINITE, an activity group targeting ICS/OT environments across North America, Europe and APAC that gains initial access by exploiting public vulnerabilities in external-facing network devices (notably Citrix CVE-2020-8193) and using adversary-controlled or compromised VPS hosting (Choopa/Vultr). The report covers observed espionage-focused intrusions, possible use of ColdLock ransomware causing IT disruption, overlaps with Winnti/LEAD activity, and provides TTPs, detection guidance, and mitigation recommendations (patching, MFA, segmentation, monitoring).