Threat Actor Characterization
ALLANITE
ID: 0b50c970769040ce210e8cfe2bfb607296649| Palmetto Fusion | — | — | — |
Actor Network Graph
Open Network GraphMITRE ATT&CK®
ALLANITE (a.k.a. Palmetto Fusion) — suspected Russia-nexus espionage group targeting US/UK electric utilities since at least 2017 with watering holes, spearphishing, malware-less LOLBins, and ICS reconnaissance (including screenshot collection); no destructive actions observed.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1189 | Drive-by Compromise | TA0001 | |
| T1566 | Phishing | TA0001 |
|
| T1078 | Valid Accounts | TA0001 TA0003 TA0004 TA0005 |
|
| T1113 | Screen Capture | TA0009 |
|
| T1041 | Exfiltration Over C2 Channel | TA0010 |
|
CLASSIFICATION: Unclassified / Open Source
Executive Summary
ALLANITE is a suspected Russia-nexus cyber-espionage group that has primarily targeted the electric utility sector in the United States and United Kingdom. Public sources assess that its tactics resemble Dragonfly (Energetic Bear) but, to date, no destructive/disruptive capabilities have been demonstrated. Reporting indicates watering-hole and spearphishing activity used to harvest credentials, followed by “malware-less” operations leveraging built-in Windows tooling to conduct ICS reconnaissance, including collection and distribution of ICS screenshots. Dragos links ALLANITE’s tradecraft to the Palmetto Fusion activity described by DHS in 2017, and dates activity to at least May 2017. Confidence: high on targeting and TTPs, medium on Russia nexus (Dragos does not corroborate national attribution).
Operationally focused on intelligence collection against energy-sector business networks and ICS/OT environments. Public-sector and private analyses suggest Russian strategic interests, but Dragos explicitly avoids political attribution while acknowledging third-party assessments.