Threat Proliferation in ICS Cybersecurity: XENOTIME Now Targeting Electric Sector, in Addition to Oil and Gas

**XENOTIME expansion and ICS risk:** Dragos reports that XENOTIME — the group behind the TRISIS destructive ICS malware — has expanded targeting beyond oil & gas into electric utilities, conducting persistent reconnaissance, network enumeration, and credential-stuffing attempts; the group has previously compromised vendors and targeted safety instrumented systems (SIS), demonstrating capability and intent to cause disruptive or destructive effects, so ICS operators should increase visibility, detection, incident response planning, and cross-sector collaboration.