Understanding ICS Malware: Defining a Credible Threat to Industrial Infrastructure

When cyber criminals shift from stealing data to shutting down critical infrastructure, we’re dealing with a fundamentally different threat. Industrial control systems (ICS) malware is specifically designed to disrupt or manipulate the physical processes underlying operational technology (OT) environments. But what qualifies as ICS malware — and what doesn’t?

This whitepaper delivers a precise, evidence-based definition built on three critical properties: ICS capability, malicious intent, and ability to cause adverse OT impact. Through real-world case studies like TRISIS, FrostyGoop, and IOControl, Dragos reveals how to distinguish true ICS malware from red team tools, incidental infections, and standard IT threats.

Whether you’re protecting critical infrastructure or analyzing emerging threats, this framework helps you:

• Accurately classify ICS-specific threats
• Prioritize resources based on actual risk
• Build defenses tailored to industrial environments

Get further insights from our threat intelligence experts. Dragos experts Jimmy Wylie and Matthew Pahl break down real ICS-specific threats, why your current detection misses them, and what actually works to protect critical systems. Join the webinar on July 17th.