Kamacite
KAMACITE is an OT-focused threat group tracked by Dragos that overlaps with the Sandworm cluster, also referred to as APT44 and Seashell Blizzard. The content describes KAMACITE as an access development and initial access group supporting ELECTRUM, with a division of labor in which KAMACITE establishes and maintains access and ELECTRUM conducts OT/ICS-impacting operations. KAMACITE is linked in the content to the actors behind the 2015 and 2016 Ukraine power incidents alongside ELECTRUM, and the reporting characterizes this activity as Russia-linked and part of the Sandworm ecosystem. According to the content, KAMACITE focuses on establishing and maintaining initial access to targeted organizations using spear-phishing, stolen credentials, and exploitation of exposed services. It is described as conducting reconnaissance and persistence over extended periods, enabling pivots toward OT networks and execution of Stage 1 of the ICS Cyber Kill Chain. The content also states that KAMACITE has leveraged spearphishing, exploitation of SOHO routers, and custom capabilities to enable ELECTRUM operations. Recent activity in the content includes expansion beyond Ukraine into the European OT supply chain from late 2024 through early 2025, including spear-phishing aimed at engineering and vendor personnel and long-running conversations using industry-specific terminology. Between March and July 2025, KAMACITE conducted sustained reconnaissance against internet-exposed industrial devices in the United States, including devices in the water, energy, and manufacturing sectors. Reported scanning targets included Schneider Electric Altivar variable frequency drives, Smart HMIs, Accuenergy AXM modules, and Sierra Wireless AirLink gateways. The content states Dragos found no evidence of successful exploitation in that scanning activity and assessed exposed edge devices were being treated as operational intelligence sources for future disruption planning. The content also states that in early 2022 KAMACITE targeted vulnerabilities in WatchGuard and ASUS firewall and router devices with CYCLOPS BLINK malware. In later reporting on the Polish power-grid attack, KAMACITE is described as using spear-phishing, stolen credentials, and exploitation of exposed services to establish access, while ELECTRUM carried out the OT-focused actions. Known alias in the provided content: kamacite.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Utilities
Where they target
Geographies tied to known operations.
- 🇺🇦 Ukraine
Tradecraft
6 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Recent activity
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Access development and reconnaissance group historically supporting ELECTRUM; conducted spear-phishing against OT supply-chain personnel and later performed targeted scanning/reconnaissance of exposed industrial edge devices consistent with control-loop mapping.
Initial access provider for Electrum; conducted reconnaissance/scanning of vulnerable internet-exposed industrial devices in US water, energy, and manufacturing sectors.
Initial access/reconnaissance activity supporting Electrum, characterized by precision scanning of internet-exposed industrial devices in US critical infrastructure sectors.
Access-enablement cluster supporting OT intrusions: establishes and maintains initial access, performs reconnaissance and persistence over extended periods to burrow into OT environments and remain low profile; conducts scanning of industrial devices (noted against U.S.-located devices) to identify/position access that can later be operationalized for OT impact by ELECTRUM.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.