How Adversaries See Your Extended Operational Technology (xOT) Environment

This Dragos analysis describes how sophisticated adversaries perform patient reconnaissance to build operational models in extended OT (xOT) environments, illustrating risks with examples such as VOLTZITE (reconnaissance collecting GIS/SCADA/config data), Akira ransomware activity leveraging credential abuse and unmanaged IoT (628 incidents tracked into 2025–2026), and the FrostyGoop attack that manipulated controllers to affect physical heating systems; the report emphasizes weak OT hygiene, visibility gaps, and the need for defenders to understand operational dependencies to detect and mitigate threats.