Threat taxonomy
medium activityCritical Infra ICS/SCADAFirst seen 2022
GridHaze
Aliases: OT reconnaissance cluster
Reconnaissance and pre-positioning activity against power transmission and distribution operators, with no observed destructive payload but persistent access attempts.
Attribution
State-aligned pre-positioning
Primary targets
- — Power utilities
- — Telecom transmission
- — Data centre facilities
Observed tactics
- Scanning for exposed engineering workstations
- Default credential use on controllers
- Collection of network and topology documentation
Regional relevance
Financial service availability depends on regional grid and transmission stability; outages cascade into payment downtime.
Detection guidance
- Remove OT management interfaces from public addressing
- Monitor for protocol traffic crossing IT/OT boundaries
- Test generator and failover procedures quarterly
Related feed reporting
- medium30 Aug 2026
Exposed industrial controllers found on power feeds serving data centres