Russia-Linked Threats to Operational Technology

This report analyzes Russia-linked threat activity against operational technology over the past 12 months, detailing coordinated campaigns (Sandworm, APT29), OT-targeted malware (Industroyer, Industroyer2, COSMICENERGY), ransomware incidents (DarkSide, Black Basta), exploited CVEs (including JetBrains TeamCity and Zyxel firewall flaws), and observed TTPs used to pivot from IT to OT. It provides detection rules, IoC integration guidance, and practical mitigation recommendations (network segregation, MFA, patching, access controls) aimed at reducing risk to OT environments.