New ICS Threat Activity Group: STIBNITE

Dragos details STIBNITE, a threat activity group that conducted targeted intrusion campaigns in Azerbaijan (late 2019–2020) focusing on wind generation and government entities. STIBNITE uses spearphishing and credential-theft websites to deliver PoetRAT and leverages credential-harvesting tools (PypyKatz, LaZagne), DDNS/common-port C2, and infrastructure reuse; while currently IT-focused (Stage 1), stolen credentials and gathered network information could enable follow-on ICS/OT compromise.