Infrastructure Destruction Squad
Aliases: Dark Engine
- Origin
- RU
- Primary motivation
- sabotage
- Sophistication
- advanced
- Resource level
- organization
- Actor type
- nation-state
- Profile updated
- 2026-07-07 12:26:01
Targeted industries: manufacturing energy-and-utilities
Targeted regions: country_code:us
Context
Dark Engine has emerged as a significant threat actor targeting industrial control systems and SCADA systems in sectors such as metallurgy and food processing. The group has conducted multiple ICS-targeted incidents, with a pronounced operational surge in June 2025. Additionally, Dark Engine is involved in a campaign that embeds fraudulent CAPTCHA prompts into legitimate WordPress sites, utilizing SEO poisoning to harvest login credentials. Reports also indicate a data leak from Dark Engine that exposed sensitive phone data in the U.S.
Reports & references
- cloud.google.com — Threats To Defense Industrial Base (report)
- securitybrief.com.au — Fake Captcha Scam Targets 2 353 Wordpress Sites Warns Cybercx (report)