Loading threat actor…
TALONITE is an ICS/OT-focused threat activity group tracked since 2019 for campaigns centered on initial access and information gathering against the electric sector, especially in the United States. Its operations have shown a near-exclusive focus on electric utilities, with additional earlier evidence of targeting entities in Japan and Taiwan. TALONITE is assessed as a serious threat to electric-sector organizations because it appears designed to establish footholds in enterprise environments that could enable follow-on operations against operationally sensitive networks. TALONITE primarily gains access through spearphishing campaigns using engineering-themed lures and malicious documents or executables. The group has used custom malware families known as LookBack and FlowCloud, both functioning as remote access trojans with persistence mechanisms and host-data collection capabilities. Reported functionality includes credential capture, persistence, and collection of system and host information. The group also abuses or modifies legitimate binaries to conceal malicious activity and blends adversary-controlled with occasionally compromised infrastructure to complicate tracking and containment. Observed activity supports TALONITE as an initial-access and post-compromise collection actor rather than a confirmed disruptive ICS operator. There is no confirmed evidence that it penetrated control system networks or executed disruptive operations in victim environments. Although direct lateral movement was not observed, available malware capabilities support an assessment that the group likely could leverage stolen or reused credentials for follow-on movement. Behavioral and tooling overlap has been noted with activity tracked by some organizations as APT10, also known as menuPass or Stone Panda, but no definitive attribution to a known intrusion set or state sponsor has been established.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
15 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 malware families attributed to this actor across reporting.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
ICS/OT-focused threat activity group conducting initial access and information-gathering operations against electric utilities, primarily in the U.S., using spear-phishing and custom RAT malware.
Uses spearphishing with malicious documents or executables to gain initial access.
Initial-access focused intrusion activity against electric utilities using spearphishing with malicious documents/executables, followed by custom malware deployment and information gathering to enable further operations in the electric sector.
Uses spearphishing with malicious documents or executables to gain initial access.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.