United States

United States

Obtain hands-on, practical skills from the world's best instructors by taking a SANS course at SANS ICS Security Summit 2026.

An analysis of the destructive malware reveals extensive living-off-the-land (LotL) techniques and detailed strategies for the widespread data deletion.

Dragos analyzed ZionSiphon and assessed it as non-functional OT malware. Here's why it poses no credible threat to dam desalination or critical infrastructure

How easy or hard is it for an attacker to build an OT attack platform such as FrostyGoop? Jimmy Wylie answered this question by developing, with the help of AI, a FrostyGoop attack platform. There were two caveats to this effort: 1. He built this from scratch without reusing any of the FrostyGoop

Our new blog post explores the ‘cognitive rust belt’ — how AI friction masks skill loss and why organizations must act now.

Free educational content on reverse engineering and malware analysis from the FLARE team - mandiant/flare-learning-hub

Get the latest OT threats, vulnerabilities, and lessons learned from real-world incidents in this year’s 2026 OT Cybersecurity Report.

CERT Polska presents a report on the analysis of an incident in the energy sector that occurred on 29 December 2025. The attacks were destructive in nature and targeted wind and photovoltaic farms, a large combined heat and power plant, and a company from the manufacturing sector. The publication aims to raise awareness of the risks associated with sabotage in cyberspace.

A 2025 cyber attack on Poland’s electric system highlights both risk and resilience in modern power grids. Download the report →

YouTube video by Black Hat

Hanover, MD

Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control system...

Discover the relationship between the Modbus address used by TOP Server and the physical offset in a device when enabling/disabling Zero-Based Addressing.

Powershell Linter. Contribute to airbus-cert/minusone development by creating an account on GitHub.

A scalable file analysis and data generation platform that allows users to easily orchestrate arbitrary docker/vm/shell tools at scale. - cisagov/thorium

Click here to buy our delicious popcorn and 50% of your purchase benefits this fundraiser. #doublegood #dgpopup

CS Malware is rare. Yet, ICS Malware like FrostyGoop and TRISIS, and related discoveries like COSMICENERGY, were all found on VirusTotal, so analysts still hunt for novel ICS Malware in public malware repositories. In the process, they discover all kinds of tools: research, CTFs, obfuscated nonsense

10 track album

These are the people and organizations acknowledged by the SANS Institute for their oustanding contributions to cyber security each year.