Pyroxene
Pyroxene is a threat group tracked by Dragos as OT-relevant and linked to Iran’s Islamic Revolutionary Guard Corps (IRGC). Dragos reports Pyroxene conducts supply chain-leveraged attacks and social-engineering-driven intrusions targeting defense, critical infrastructure, and industrial sectors, with observed activity expanding from the Middle East into North America and Western Europe. Pyroxene has been reported deploying data-wiping malware against organizations in Israel. Dragos also notes Pyroxene overlaps with activity attributed to Imperial Kitten (aka APT35), described as the cyber arm of the IRGC, and that Pyroxene often leverages initial access provided by an entity referred to as PARISITE to move from IT into OT networks. Known alias: Pyroxene.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Capital Goods
Tradecraft
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Recent activity
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Supply-chain-leveraged intrusions against defense/critical infrastructure/industrial targets, with an IT-to-OT pivot enabled by initial access; overlaps with activity attributed to Imperial Kitten.
Iran-linked (IRGC-associated) cluster conducting supply-chain attacks enabled by social engineering and deploying data-wiping malware against Israeli organizations.
Named by Dragos as a newly identified (2025) threat group targeting OT environments; no additional activity details provided in the content.
Iran-aligned cluster conducting supply-chain-leveraged operations against defense/critical infrastructure/industrial targets, using recruitment-themed social engineering to deliver backdoors and other malware; also associated with data-wiping activity in Israel.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.