New ICS Threat Activity Group: TALONITE

Dragos details TALONITE, an ICS-focused threat activity group that began targeting U.S. electric utilities in 2019 using engineering-themed spearphishing and custom RATs (LookBack and FlowCloud). The report describes TALONITE’s tactics (credential capture, persistence via modified legitimate binaries, abuse of certutil.exe and renamed Microsoft utilities), shared infrastructure and domain masquerading, notes behavioral overlap with APT10, and states there is no observed disruptive control-system attack while assessing the group as a serious, well-resourced threat to the electric sector.