Volume 2Oil and Gas edition2025Last verified 10 sources, 7 primarySingle-vendor reporting
In 2025 one group scanned internet-exposed US plant equipment, screen to drive to meter to gateway, and another reached pipeline engineering workstations to learn what stops a process. One vendor's report. No attack on record.
One report, two rungs of the ladder. KAMACITE sits on reconnaissance: March to July 2025, Dragos says, it scanned internet-exposed US devices across whole control loops, and trade reporting says Dragos found no evidence of successful exploitation. VOLTZITE sits higher: Dragos says it came in through cellular gateways and made engineering workstation software give up configuration files and alarm data. Stage 2 is Dragos's name for that capability, not an attack on the record. Our candidate list paired them under one heading; Dragos never links them. The error was ours.
Pre-positioning is the one phase where prevention is still on the table. A scan records only what replies. That is BlastWave's analysis, with a limit: silence stops discovery, not an intruder already holding a reachable door. By Dragos's account VOLTZITE's door was a cellular gateway, a device class on KAMACITE's scan list. We read that as a device worth hiding, not a link between the groups.
What is not known: Which devices were scanned, how many and whose is undisclosed, as is how Dragos observed the scanning. No victim is named, no government document addresses this 2025 activity and no second vendor has published on it. For VOLTZITE the months, the number of pipeline operators, the gateway flaw used and whether access remains are undisclosed. Dragos does no political attribution. Whether the scanning fed any later intrusion is unknown. The full report is gated and was not read.
Recommendation
Take the path away from the field Nothing in the field answers the internet: no public address or listening interface on a drive, meter, HMI or gateway. Remote sites reach out through a brokered path.
Remove standing access to engineering A compromised gateway should not be a key. Engineering workstations, and every path to them, require a verified identity per session, not a password or network position.
Make read-only consumers read one way Alarm data, configuration exports and sensor data that must leave the plant leave one way, so nothing that receives them can reach back to the workstation.
Sources: Dragos press release, 17 Feb 2026; Dragos 2026 Year in Review oil and gas executive briefing; Dragos threat group pages, KAMACITE and VOLTZITE; Dragos blog, 16 Apr 2026; Help Net Security, 17 Feb 2026. Full list with links.
Soft Spots: One vendor; the full report is gated and unread. “No evidence of successful exploitation” is Help Net Security's sentence, found in no Dragos text we could read. The silence argument and the shared gateway class are BlastWave's analysis.
The full record
Every claim numbered to its source. Last updated .
One group scanned internet-exposed US plant equipment from outside; a second reached pipeline engineering workstations to learn what stops a process. Both come from one vendor's report. What is verified, what is only reported, and what is still unknown.
Summary
In 2025, according to the OT security firm Dragos, a group it calls KAMACITE scanned internet-exposed US industrial devices from March to July, and a separate group, VOLTZITE, compromised cellular gateways to reach US pipeline engineering workstations and extract configuration files and alarm data. No attack, shutdown, victim or attribution is on the record; every claim rests on one vendor.1
Timeline of KAMACITE and VOLTZITE activity
Every date is tied to a source. Press reporting appears only as evidence of what was said.
CISA's advisory AA24-038A lists Voltzite among Volt Typhoon's aliases. It predates, and does not address, anything Dragos describes for 2025.8
KAMACITE expands from Ukraine-focused targeting to a European supply chain campaign, Dragos says.1Industrial Cyber's account of the report dates the campaign from late 2024 and says it continued at least through March 2025, after which KAMACITE likely abandoned the infrastructure dedicated to it.6
KAMACITE conducts sustained reconnaissance of US internet-exposed industrial devices: HMIs, variable frequency drives, metering modules and cellular gateways, according to Dragos.1,3
VOLTZITE compromises Sierra Wireless AirLink cellular gateways to access US midstream pipeline operations, then pivots to engineering workstations, according to Dragos.1
Dragos publishes its 2026 OT Cybersecurity Year in Review with a press release and launch blog, and states that VOLTZITE was elevated to Stage 2 of the ICS Cyber Kill Chain.1,2Trade coverage the same day reports the findings; Help Net Security writes that Dragos found no evidence of successful exploitation during the scanning.5,6,9
A Dragos blog on oil and gas operations says "VOLTZITE was inside U.S. pipeline operations in 2025, learning what would cause them to stop."7
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
Question
What the record says
Status
Who reported this activity?
One vendor: Dragos, in its 2026 OT Cybersecurity Year in Review, published 17 February 20261
Schneider Altivar drives, Smart HMIs, Accuenergy AXM metering modules and Sierra Wireless AirLink gateways3
Verified (Dragos's account)
Did KAMACITE get into any control network?
No entry is claimed by anyone. Help Net Security reports that Dragos found no evidence of successful exploitation5
Reported (trade press, of Dragos's finding)
Was KAMACITE "mapping control loops"?
Dragos's reading of an observed scanning sequence, not a separate observation1,2
Researcher interpretation
How did VOLTZITE get in?
By compromising Sierra Wireless AirLink RV50/RV55 cellular gateways. The flaw used is not named1,3
Verified (Dragos's account)
What did VOLTZITE do on the workstations?
Extracted configuration files and alarm data to learn what would trigger process shutdowns1
Verified (Dragos's account)
Did anything shut down?
No shutdown or process effect is reported by Dragos or anyone else, as of September 20261
Verified (time-bound)
Are the two groups linked?
Dragos does not link them. They are separate groups described in the same report1,2
Verified (as published)
Who is behind either group?
Not attributed. Dragos does not conduct political attribution, and no government document addresses this 2025 activity4
Undisclosed
Which operators were affected?
None is named, for either group
Undisclosed
What did KAMACITE do in the United States in 2025?
By Dragos's account, KAMACITE scanned internet-exposed US industrial devices from March to July 2025, and no entry into any control network is claimed. Dragos's press release puts it this way:
"sustained reconnaissance of U.S. industrial devices from March through July 2025, systematically scanning entire control loops including HMIs, variable frequency drives, metering modules, and cellular gateways."
Dragos's oil and gas executive briefing names the device types: Schneider Altivar variable frequency drives, Smart HMIs, Accuenergy AXM modules and Sierra Wireless AirLink gateways, and says the devices were internet-exposed.3 Help Net Security, reporting the report, says "Dragos found no evidence of successful exploitation during the scanning activity."5 That is the outlet's sentence; it does not appear in any Dragos text we could read, but it matches Dragos's own framing of the activity as reconnaissance, and no one claims an entry.
"Mapping control loops" is Dragos's interpretation, and a reasonable one. What was observed is scanning of particular device types in a sequence: operator screens, drives, meters and gateways. Dragos's launch blog describes "mapping control loops by targeting operator interfaces (HMIs), actuators (VFDs), meters, and remote gateways together."2 Help Net Security writes that "the sequencing suggested deliberate mapping."5
"Adversaries are mapping how control systems work, understanding where commands originate, how they propagate, and where physical effects can be induced."
The dates describe two activities, not a contradiction. Dragos's press release says KAMACITE "expanded from Ukraine-focused targeting to a European supply chain campaign before" the US reconnaissance.1 Industrial Cyber's account of the report says the European campaign "continued at least through March 2025"6, and Help Net Security begins the US scanning "After that campaign."5 March is the month one activity gave way to the next. The same Dragos press release also says KAMACITE mapped control loops "throughout 2025"; this entry uses the dated range, March to July.1 The full report, where the exact sentence lives, is behind a registration form and was not read for this entry.
Did VOLTZITE attack a US pipeline?
No attack, shutdown or process effect is on the record. Dragos says VOLTZITE compromised Sierra Wireless AirLink cellular gateways to access US midstream pipeline operations and then pivoted to engineering workstations.1 Its oil and gas briefing lists "Sierra Wireless Airlink RV50/RV55 exploitation" and extends the activity across upstream and downstream pipeline operations.3 What Dragos says it saw on the workstations:
"Dragos observed the group manipulating engineering workstation software to extract configuration files and alarm data, specifically investigating what operational conditions would trigger process shutdowns."
"Manipulating" here means making the software give up configuration files and alarm data. It does not mean changing the process. On that basis Dragos elevated VOLTZITE to Stage 2 of the ICS Cyber Kill Chain.1 Stage 2 is the part of that model where attacks on the process are developed and executed; the designation rests on observed capability. It is not a report that an attack happened, and no shutdown, process effect or physical consequence is on the record.
"Inside" is Dragos's word. A later Dragos blog says "VOLTZITE was inside U.S. pipeline operations in 2025, learning what would cause them to stop."7 No operator confirms it, no operator is named, and no count of operators is given. Dragos names no CVE for the gateway compromise in any text we could read.3
Are KAMACITE and VOLTZITE the same campaign?
No. They are two groups that Dragos tracks separately, described in the same report, and Dragos does not link them. The mapping is KAMACITE's; the engineering workstations are VOLTZITE's.1 Dragos does not say KAMACITE handed anything to VOLTZITE.1,2,3
Read together as one story, the two findings suggest a campaign that mapped the loops and then took the controls. No document describes that. One group scanned from outside, with no exploitation reported; the other reached engineering workstations and read data rather than moving anything.
The same class of device, the Sierra Wireless AirLink cellular gateway, appears on KAMACITE's scan list and as VOLTZITE's way in.1,3 That is BlastWave's observation, not a link between the groups: it marks a device class worth hiding.
Who is behind KAMACITE and VOLTZITE?
No one is attributed. KAMACITE and VOLTZITE are Dragos designations, and Dragos's threat group pages state its policy:
"Dragos does not corroborate nor conduct political attribution to threat activity."
Dragos's KAMACITE page lists overlap with SANDWORM activity and describes KAMACITE enabling other entities, such as ELECTRUM.4 For VOLTZITE, Dragos lists overlaps with VOLT TYPHOON, BRONZE SILHOUETTE, VANGUARD PANDA and INSIDIOUS TAURUS.3,4 CISA's February 2024 advisory AA24-038A lists Voltzite among Volt Typhoon's aliases, but it predates and does not address anything Dragos describes for 2025.8
Carrying either overlap through to a government's attribution is a step no document takes for this activity, and this entry does not take it either. No government document addresses the 2025 activity, no second vendor has published on it, and no victim has made a statement, as of late September 2026.
Would this scanning stand out in a plant's logs?
Not necessarily. Dragos's manufacturing executive briefing says "KAMACITE VFD scanning looks like standard system enumeration."10 Every device on the internet is scanned constantly, and a scan that resembles routine enumeration does not announce its purpose.
BlastWave's view, not a disclosed finding: the expensive step for an adversary used to be turning a scan into a model of the target, working out which device is which, how they chain, and what a meter reading means for a drive. Automation makes that step cheaper, which is why the phase before an attack deserves more attention than its quiet record suggests.
What is still not known about KAMACITE / VOLTZITE
Which devices were scanned, how many, and whose. How Dragos observed the scanning is also undisclosed.
Who the victims are. No victim is named for either group.
Any second account. No government document addresses this 2025 activity and no second vendor has published on it, as of late September 2026.
For VOLTZITE: the months of activity, the number of pipeline operators reached, the gateway flaw used and whether access remains.3
Who runs either group. Dragos does not conduct political attribution, so it is not on the record.4
Whether the scanning fed any later intrusion.
What the full report says in its own words. It is behind a registration form and was not read for this entry, including its exact date wording and whether it states the no-exploitation finding in Dragos's own sentence.
Claims about KAMACITE / VOLTZITE the record does not support
Widely repeated claim
What the record says
"KAMACITE is a Russia-linked group."
That is SecurityWeek's label, not Dragos's.9 Dragos "does not corroborate nor conduct political attribution to threat activity," and its KAMACITE page records an overlap with SANDWORM activity, not an attribution.4 No government document addresses this 2025 activity.
"KAMACITE systematically mapped control loops across U.S. infrastructure throughout 2025."
The wording is in Dragos's own press release, but the same release, its blog and its briefing date the US reconnaissance March to July 2025. What was observed is scanning in a sequence; "mapping" is Dragos's reading of it, and trade reporting says Dragos found no evidence of successful exploitation.1,2,3,5
BlastWave analysis: a scan only finds what answers
Analysis, not a disclosed fact
This entry is two rungs of this volume's consequence ladder printed in one report. KAMACITE sits on external reconnaissance; VOLTZITE sits a rung higher, on OT-adjacent access and capability development.1 Pre-positioning is the only phase where prevention is still on the table, and nearly every other entry in the book begins after something answered. A scan is a question sent to every address at once, and it records only what replies. A drive or a meter that does not answer a stranger never becomes a mark on anyone's list. That is BlastWave's analysis rather than a disclosed fact, and it has a limit: silence stops discovery, not an intruder who already holds a reachable door.
By Dragos's account VOLTZITE's door was a cellular gateway, and the same class of gateway is on KAMACITE's scan list.1,3 We read that as a device class worth hiding, not as a link between the groups. No operator is named, and none should be blamed; these devices were bought to run plants, and they do. The record is thin: one vendor's annual report, with no victim, no government corroboration and no second vendor. It is also serious, and it describes the part of an attack where prevention still comes first.
Podcast: “The Metal Detector” (9:14). Joe Baxter and Cam Cullen on why a scan only finds what answers, and why the phase before an attack is the one still open to prevention.
Video: KAMACITE / VOLTZITE Short (60 to 90 seconds).
Frequently asked questions
What are KAMACITE and VOLTZITE?
KAMACITE and VOLTZITE are names the OT security firm Dragos gives to two separate threat groups it tracks. Both appear in Dragos's 2026 OT Cybersecurity Year in Review, published on 17 February 2026. Dragos says KAMACITE scanned internet-exposed US industrial devices in 2025 and VOLTZITE reached US pipeline engineering workstations. They are vendor designations, not government attributions, and Dragos does not link the two groups.
What did KAMACITE do in 2025?
Dragos said in February 2026 that from March through July 2025 KAMACITE conducted sustained reconnaissance of internet-exposed US industrial devices, including HMIs, variable frequency drives, metering modules and cellular gateways. Dragos reads the sequence as mapping entire control loops. Help Net Security reported that Dragos found no evidence of successful exploitation during the scanning, and no entry into any control network is claimed.
Did VOLTZITE attack a US pipeline?
No attack, shutdown or process effect is on the record. Dragos said in February 2026 that VOLTZITE compromised Sierra Wireless AirLink cellular gateways to access US midstream pipeline operations, then extracted configuration files and alarm data from engineering workstation software to learn what would trigger process shutdowns. Dragos elevated it to Stage 2 of the ICS Cyber Kill Chain, a capability designation, not a report of an attack.
Who is behind KAMACITE and VOLTZITE?
No one is attributed. Dragos's threat group pages state that Dragos does not corroborate nor conduct political attribution to threat activity. Dragos records overlaps with other tracked activity for both groups, but no government document addresses the 2025 activity it describes. Some trade coverage attached a country to KAMACITE; that label is the outlet's, not the record's.
Is VOLTZITE the same as Volt Typhoon?
Dragos lists overlaps between VOLTZITE and Volt Typhoon, and CISA's advisory AA24-038A of February 2024 lists Voltzite among Volt Typhoon's aliases. That advisory predates the 2025 activity Dragos describes and does not address it. No government document covers VOLTZITE's 2025 gateway and workstation activity, so the alias list does not settle who carried it out.
Are KAMACITE and VOLTZITE part of one campaign?
No document says so. Dragos describes them as two groups in the same report and does not say KAMACITE handed anything to VOLTZITE. The same class of device, a Sierra Wireless AirLink cellular gateway, appears on KAMACITE's scan list and as VOLTZITE's way in, but BlastWave reads that as a device class worth hiding, not as a link between the groups.
How can operators keep field devices from being found by scans like this?
In BlastWave's analysis, a scan only finds what answers. Field devices such as drives, meters, HMIs and cellular gateways should have no public address and no listening management interface, and remote sites should reach out through a brokered, authenticated path. That stops discovery, but not an intruder who already holds a reachable door, so access to engineering workstations should also require a verified identity per session.
There is no victim statement, no government document on this activity and no second vendor, so the primary sources are Dragos's own published material on its 2026 Year in Review; press is cited only as evidence of what was said about the report.
ResearcherDragos, press release, "Dragos OT Cybersecurity Report: Adversaries Increase Real-World Impact, Map Control Loops Across Industrial Infrastructure," Business Wire, 17 February 2026; also on dragos.com as "Dragos 2026 OT Report Shows Surge in Threat Groups and Ransomware." dragos.com · Business Wire
ResearcherDragos, "Dragos 2026 OT Cybersecurity Year in Review Now Available," launch blog, 17 February 2026. dragos.com
ResearcherDragos, 2026 OT Cybersecurity Year in Review executive briefing, oil and gas edition, 2026. PDF
ResearcherDragos, threat group pages, KAMACITE and VOLTZITE. KAMACITE · VOLTZITE
PressAnamarija Pogorelec, "OT teams are losing the time advantage against industrial threat actors," Help Net Security, 17 February 2026. The outlet's account of the report; cited as evidence of what was said. helpnetsecurity.com
PressAnna Ribeiro, "Dragos tracks three new OT threat groups as industrial adversaries move toward real-world disruption," Industrial Cyber, 17 February 2026. The outlet's account of the report; cited as evidence of what was said. industrialcyber.co
ResearcherDanielle Gauthier, "Securing Oil and Gas OT Operations in 2026," Dragos blog, 16 April 2026. dragos.com
FederalCISA, Cybersecurity Advisory AA24-038A, 7 February 2024 (the federal Volt Typhoon advisory). Cited only for its list of Volt Typhoon's aliases. cisa.gov
PressEduard Kovacs, "3 Threat Groups Started Targeting ICS/OT in 2025: Dragos," SecurityWeek, 17 February 2026. Cited as evidence of what was said, not of what is attributed. securityweek.com
ResearcherDragos, 2026 OT Cybersecurity Year in Review executive briefing, manufacturing edition, 2026. PDF
Cite this page
BlastWave. “KAMACITE and VOLTZITE OT Threat Activity (2025): What Is Verified.” Hackopedia, Volume 2, FILE 050. Last verified 28 September 2026. https://hackopedia.blastwave.com/oil-and-gas/kamacite-voltzite-2026/
Revision history
Date
Change
6 Oct 2026
Numbered FILE 050 in Hackopedia Volume 2, in the Oil and Gas edition.
28 Sep 2026
Consistency check against the related Volt Typhoon, Havex and Pipedream entries: statements about those entries agree, and the description of the Volt Typhoon alias list uses the same wording across the book. Facts unchanged.
26 Sep 2026
Full validation: every quotation re-checked against Dragos's press release, launch blog, executive briefings, threat group pages and 16 April 2026 blog, CISA's AA24-038A and the trade coverage. Confirmed that no Dragos text we could read links KAMACITE to VOLTZITE, and that Dragos's own wording is "the ICS Cyber Kill Chain."
25 Sep 2026
Second verification. Corrected three points: KAMACITE's sector (Dragos's oil and gas briefing says oil and gas infrastructure was directly in scope); the "no evidence of successful exploitation" finding, now attributed to Help Net Security's reporting because no Dragos text we could read carries it; and the RV50/RV55 gateway models, which Dragos names itself.
24 Sep 2026
Volume 2 entry built from Dragos's published material on its 2026 Year in Review and the same week's trade coverage. There is no Volume 1 entry.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
