Group: ALLANITE, Palmetto Fusion

ALLANITE, Palmetto Fusion
Group
ID	G0009
Associated Groups	ALLANITE, Palmetto Fusion
External Contributors	Dragos Threat Intelligence

ALLANITE is a suspected Russian cyber espionage group, that has primarily targeted the electric utility sector within the United States and United Kingdom. The group's tactics and techniques are reportedly similar to Dragonfly / Dragonfly 2.0, although ALLANITE’s technical capabilities have not exhibited disruptive or destructive abilities. It has been suggested that the group maintains a presence in ICS for the purpose of gaining understanding of processes and to maintain persistence.1

Associated Group Descriptions

• ALLANITE - 1
• Palmetto Fusion - 12

Techniques Used

• Drive-by Compromise - ALLANITE leverages watering hole attacks to gain access into electric utilities.3

• Screen Capture - ALLANITE has been identified to collect and distribute screenshots of ICS systems such as HMIs.12

• Spearphishing Attachment - ALLANITE utilized spear phishing to gain access into energy sector environments.4

• Valid Accounts - ALLANITE utilized credentials collected through phishing and watering hole attacks.1

References

1. a b c d e  Dragos. (n.d.). Allanite. Retrieved October 27, 2019.
2. a b  ICS-CERT. (2017, October 21). Advanced Persistent Threat Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved October 23, 2017.

3. ^  Eduard Kovacs. (2018, May 10). 'Allanite' Group Targets ICS Networks at Electric Utilities in US, UK. Retrieved January 3, 2020.
4. ^  Jeff Jones. (2018, May 10). Dragos Releases Details on Suspected Russian Infrastructure Hacking Team ALLANITE. Retrieved January 3, 2020.