Infrastructure Destruction SquadThreat actor
- dark engine
Dark Engine has emerged as a significant threat actor targeting industrial control systems and SCADA systems in sectors such as metallurgy and food processing. The group has conducted multiple ICS-targeted incidents, with a pronounced operational surge in June 2025.From MISP Galaxy
Last reported 27 days ago, by CERT-EU1 report
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1036Masquerading
“Attributed to threat actor idbzoomh, the campaign used a malicious archive masquerading as leaked source code to deliver Vidar v18.7, an information stealer, and GhostSocks, a SOCKS proxy trojan.”
- T1195Supply Chain Compromise
“On April 25, a supply-chain compromise reportedly targeted the elementary-data project, where a forged release was published to PyPI and a matching trojanised container image was pushed to the GitHub Container Registry.”
- T1555.005Password Managers
“The campaign impersonated legitimate developer tooling to deliver RAT-enabled infostealers targeting credentials, browser data, password managers, and cryptocurrency wallets.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Cyber Brief 26-05 - April 2026“On April 12, a researcher reported that threat actors using the names Infrastructure Destruction Squad and Dark Engine claimed to have breached Venice’s San Marco flood defence pump system.”
Thanks — we review every report.