8 minhigh
Disruptive cyber activity highlights risk from internet-exposed systems and edge devices
The NCSC has observed increased targeting of operational technology (OT) systems globally by a range of threat actors, resulting in limited real-world disruption. The advisory highlights that internet-exposed OT systems and edge devices are at risk due to misconfigurations, legacy connections, unmanaged assets, default credentials, and insecure protocols. Organisations are urged to build a definitive view of their OT architecture, remove direct internet exposure of OT devices, harden boundaries, adopt secure protocol versions, segment networks, and maintain tested backups.
Sens:▲ 24h
Detection / Hunteropenrouter
What Happened
The UK's National Cyber Security Centre has seen a rise in attacks against industrial control systems and other internet-connected devices across multiple countries and sectors. Any organisation that uses industrial control systems could be affected, especially if those systems are connected to the internet without the organisation realising it. This matters because attacks on these systems can cause real-world disruption to services and operations. Organisations should check what is exposed to the internet, change default passwords, enable multi-factor authentication, update old equipment, use secure communication protocols, separate their networks, and maintain backups that can survive a ransomware attack.
Key Takeaways
- NCSC reports increased targeting of operational technology (OT) systems across multiple sectors globally, including the UK, by a range of state and non-state threat actors, resulting in limited real-world disruption.
- Organisations should not assume their OT is inaccessible from the internet without verifying it, as unintended exposure can arise through misconfigurations, legacy connections, or unmanaged assets.
- Key mitigations include removing direct internet exposure of PLCs and HMIs, changing default credentials, enabling MFA, hardening OT boundaries, adopting secure protocol versions, and segmenting networks.
- A broader pattern of disruptive cyber activity targeting internet-exposed systems and edge devices affects all sectors, not just OT environments.
- Organisations should register for the NCSC Early Warning service to identify publicly exposed vulnerabilities affecting internet-facing systems.
Affected Systems
- Operational Technology (OT) systems including Programmable Logic Controllers (PLCs) and Human Machine Interfaces (HMIs)
- Industrial gateways, firewalls, routers, and remote access appliances facilitating external connectivity
- Internet-exposed edge devices across all sectors
- Poorly configured routers
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Reconnaissance: Threat actors identify internet-exposed OT systems, PLCs, HMIs, and edge devices through misconfigurations, legacy connections, or unmanaged assets
- Initial Access: Attackers exploit default credentials, shared passwords, or insecure management protocols (telnet, SNMP v1, SNMP v2) to access exposed devices
- Persistence and Discovery: Attackers may modify controller logic or device configurations on compromised OT assets
- Impact: Disruptive cyber activity causes limited real-world operational disruption to affected organisations
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: No
No detection rules or queries are provided in this advisory. The article is a strategic advisory focused on posture improvement and mitigation rather than technical detection content.
Detection Engineering Assessment
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Low | OT systems such as PLCs and HMIs typically lack EDR agents. Visibility into these environments depends on network-based monitoring and specialised OT security tooling rather than endpoint detection. |
| Network Visibility | Medium | The article recommends logging and monitoring all connectivity to and within OT networks, with focus on detecting communication with OT assets from unexpected devices or routes. OT environments are described as static and predictable, making baseline monitoring effective. However, many organisations may lack this visibility today. |
| Detection Difficulty | Hard | Detecting unauthorised access to OT systems requires specialised network monitoring capabilities, a definitive asset inventory, and baseline behavioural understanding of OT communications. Many organisations lack visibility into their OT environments and may not know what is internet-exposed. |
Required Log Sources
- Network flow logs for OT segments
- Firewall logs at OT boundaries
- Industrial protocol traffic logs (DNP3, CIP, Modbus, OPC)
- Device configuration change logs
- Authentication logs for management interfaces
- Asset inventory and exposure scanning results
Hunting Hypotheses
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for OT devices such as PLCs or HMIs that are reachable from the public internet, as unintended exposure can arise through misconfigurations or legacy connections. | External attack surface management data, firewall rule configurations, network flow logs | Reconnaissance | Low — direct internet exposure of OT devices is almost always unintended and should be investigated. |
| Consider hunting for authentication attempts using default or shared credentials against management interfaces and industrial protocols, as threat actors target these weaknesses. | Authentication logs from management interfaces, network authentication traffic | Initial Access | Medium — legitimate maintenance access may use shared accounts; correlate with change management records. |
| Consider hunting for communication with OT assets from unexpected source devices or networks, as OT environments are typically static and deviations from baseline indicate potential compromise. | Network flow logs, industrial protocol traffic analysis, OT network monitoring | Discovery and Lateral Movement | Low to Medium — OT environments are described as predictable, so unexpected communication paths warrant investigation. |
| Consider hunting for use of insecure management protocols such as telnet, SNMP v1, or SNMP v2 in OT and edge device environments, as these are explicitly called out as risk factors. | Network traffic analysis, protocol detection on management network segments | Initial Access | Low — these protocols should not be in use in well-maintained environments. |
| Consider hunting for unauthorised changes to controller logic or PLC operating mode changes (e.g., transitions to PROGRAM mode), as these indicate potential tampering with operational processes. | OT device logs, controller access logs, industrial protocol write commands | Impact | Medium — legitimate maintenance activities involve mode changes and logic updates; correlate with scheduled maintenance windows. |
Control Gaps
- Lack of definitive OT asset inventory may prevent organisations from knowing what is internet-exposed.
- Network segmentation between IT and OT environments may be insufficient, allowing lateral movement.
- Default credentials and shared passwords on management interfaces may remain unchanged.
- Insecure protocols (telnet, SNMP v1/v2) may still be in use on OT and edge devices.
- End-of-life edge devices may no longer receive security updates.
- Backup systems may not be designed to resist ransomware.
Key Behavioral Indicators
- Unexpected inbound connections to OT devices from external or untrusted networks
- Authentication events using default credentials on management interfaces
- Communication with PLCs or HMIs from devices outside the expected OT network baseline
- Use of insecure protocols (telnet, SNMP v1, SNMP v2) on management or OT network segments
- PLC mode changes to PROGRAM or maintenance mode outside scheduled maintenance windows
- Unauthorised write operations to controller logic
- Configuration changes on edge devices such as routers, firewalls, or remote access appliances
False Positive Assessment
Low — the advisory describes general targeting patterns rather than specific detection signatures. The recommended monitoring approach (baseline-based detection in static OT environments) is designed to minimise false positives, though legitimate maintenance activities may generate alerts that require correlation with change management records.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organisation's incident response runbook and team escalation paths before acting. Consider conducting an immediate external scan or audit to identify any internet-exposed OT devices, PLCs, or HMIs and remove direct exposure where found.
- Consider reviewing and changing default credentials on all management interfaces, web interfaces, and OT devices, and evaluate whether shared passwords are in use.
- If your EDR or network monitoring supports host isolation, consider isolating any OT devices exhibiting signs of unauthorised access or unexpected configuration changes.
- Consider disabling insecure management protocols (telnet, SNMP v1, SNMP v2) on all edge devices and OT management interfaces where secure alternatives exist.
Infrastructure Hardening
- Consider building a definitive inventory of all OT assets, communication pathways, and external connections to identify unintended internet exposure.
- Evaluate whether network segmentation between IT, management, and OT environments is sufficient, and consider restricting inter-zone communications to only what is operationally required.
- Consider migrating insecure industrial protocols to secure versions (e.g., DNP3 to DNP3-SAv5, Modbus to Modbus Security, OPC DA to OPC UA) where supported.
- Consider replacing end-of-life edge devices (routers, firewalls, gateways, remote access appliances) before they reach end of support.
- Consider implementing a segregated management network for edge device administration that is not connected to the internet.
- Evaluate whether your backup strategy for OT systems, configurations, and controller logic is ransomware-resistant, and consider testing restoration procedures regularly.
User Protection
- Consider enabling multi-factor authentication on all management interfaces and web interfaces where supported.
- Consider using public/private key authentication (e.g., SSH key-based auth) instead of password-based authentication where protocols support it.
- Consider enabling password-based write protection or equivalent mechanisms on controller logic to prevent unauthorised changes.
- Consider registering for the NCSC Early Warning service to receive notifications about publicly exposed vulnerabilities affecting your internet-facing systems.
Security Awareness
- Consider raising awareness among engineering and operations teams about the risk of leaving PLCs in PROGRAM or maintenance modes.
- Consider incorporating OT security awareness into existing training programs, emphasising the importance of not assuming OT systems are inaccessible from the internet.
- Consider exercising incident response and recovery procedures for OT compromise scenarios, in line with NCSC guidance on preparing for severe cyber threats.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping8 techniques
Tactic
Reconnaissance
Tactic
Initial Access
Tactic