Actor designator
SLATE FERROUS
Designated by Cassandra Quill · First observed November 2025
Summary
SLATE FERROUS has been conducting sustained reconnaissance against industrial control system networks across three sectors. The operator is reading process telemetry, batch records, and operator-to-supervisor command traffic that, in the right hands, models production capacity, supply-chain dependencies, and operational decision-making at the targeted enterprises.
Sector
Mid-tier municipal utilities, specialty chemical manufacturers, discrete-process industrial producers with export exposure
Region
United States
Attribution
State-affiliated industrial intelligence collector or strategic disruption pre-positioning; consistent with either or both
First observed
November 2025
Defensive ask
Baseline ICS protocol command distribution, instrument the ICS-to-IT bridge with egress monitoring equivalent to enterprise perimeter, and audit engineering-workstation credentials for rotation against documented policy. The internet-exposed ATG and PLC patterns are documented in FBI/CISA advisory cycles.
SLATE FERROUS — frequently asked
Defender-facing questions answered from the public record on this designator. Operationally sensitive details — vendor + build of affected products with unshipped patches, proof-of-concept code, IOC-grade indicators on active operator infrastructure — are withheld by editorial policy. See editorial standards.
- Who is SLATE FERROUS?
- SLATE FERROUS has been conducting sustained reconnaissance against industrial control system networks across three sectors. The operator is reading process telemetry, batch records, and operator-to-supervisor command traffic that, in the right hands, models production capacity, supply-chain dependencies, and operational decision-making at the targeted enterprises.
- When was SLATE FERROUS first observed?
- November 2025. The Alamo Post tracks SLATE FERROUS as a distinct actor cluster from that point forward.
- What sectors does SLATE FERROUS target?
- Mid-tier municipal utilities, specialty chemical manufacturers, discrete-process industrial producers with export exposure
- Where does SLATE FERROUS operate or target?
- United States
- What is the attribution for SLATE FERROUS?
- State-affiliated industrial intelligence collector or strategic disruption pre-positioning; consistent with either or both
- What is the defensive ask for SLATE FERROUS?
- Baseline ICS protocol command distribution, instrument the ICS-to-IT bridge with egress monitoring equivalent to enterprise perimeter, and audit engineering-workstation credentials for rotation against documented policy. The internet-exposed ATG and PLC patterns are documented in FBI/CISA advisory cycles.
- Is SLATE FERROUS an industry-standard name?
- No. SLATE FERROUS is a designator assigned by Cassandra Quill, The Alamo Post's pseudonymous vulnerability research and threat intelligence writer. It is not interchangeable with vendor tracking IDs and is not registered in MITRE ATT&CK or commercial vendor catalogs. Profiles published under this designator describe activity at the sector level and withhold vendor + build information where patches are not yet shipped.
About designators on this site. Actor designators in the SLATE FERROUS family are assigned by Cassandra Quill and are not industry-standard names. Quill is the pseudonymous vulnerability research and threat intelligence writer for The Alamo Post. Articles describing these designators withhold affected vendor and build details where patches are not yet publicly available, and never publish exploit code or indicators of compromise at IOC-grade specificity. Defensive guidance is the focus.