File · RASPITE · Unknown · misp-galaxy + mitre-attack · refreshed 2026-10-06
attack rose · 17 techniques across 8 tactics
Analyst brief
misp-galaxy + mitre-attackDragos has identified a new activity group targeting access operations in the electric utility sector. We call this activity group RASPITE. Analysis of RASPITE tactics, techniques, and procedures (TTPs) indicate the group has been active in some form since early- to mid-2017.
RASPITE targeting includes entities in the US, Middle East, Europe, and East Asia. Operations against electric utility organizations appear limited to the US at this time. RASPITE leverages strategic website compromise to gain initial access to target networks.
RASPITE uses the same methodology as DYMALLOY and ALLANITE in embedding a link to a resource to prompt an SMB connection, from which it harvests Windows credentials. The group then deploys install scripts for a malicious service to beacon back to RASPITE-controlled infrastructure, allowing the adversary to remotely access the victim machine.
Observed targets (as stated by the sources)
0 countries · 1 sectorsassessed originnot stated by sourcesobserved targets · 0
sectors · 1
- Electric
as stated by MISP galaxy / ransomware.live — not inferred
Kill chain
MITRE ATT&CK Enterprise · tap a technique17 techniques · 8 of 15 tactics
Resource development
1 techniqueInitial access
1 techniqueExecution
1 techniquePersistence
1 techniqueStealth
2 techniquesCredential access
7 techniquesDiscovery
3 techniquesCollection
1 technique
select a technique
Arsenal
4 toolsas stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id
Take it with you
keyless · no signupReferences
6 sourcesTrack RASPITE on the wire.
This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.