VORANT. Threat Intelligence Sign in Get the full feed

NCSC warns of OT and edge device targeting

routine vulnerability energymanufacturinginfrastructuretransportationgovernment-nationaltelecommunications

NCSC reports increased global targeting of internet-exposed operational technology causing limited real-world disruption, urging hardening of OT and edge devices.

The UK NCSC has issued an advisory highlighting a rise in threat activity targeting operational technology (OT) systems across multiple sectors globally, including the UK, carried out by a range of both state and non-state actors. This activity has resulted in some limited real-world disruption and follows a broader pattern of disruptive cyber activity against internet-exposed systems and edge devices affecting both critical national infrastructure (CNI) and non-CNI organisations. The NCSC assesses that the threat from state use of offensive cyber, including outside declared conflicts, has almost certainly increased amid rising geopolitical instability and improving adversary capability.

The advisory does not name specific threat actors, malware, or CVEs, but stresses that any organisation with internet-exposed OT—PLCs, HMIs, industrial gateways, routers, and remote access appliances—could be affected, particularly where exposure arises from misconfiguration, legacy connections, or unmanaged assets rather than deliberate design. The NCSC references prior joint advisories (e.g., July 2026 reporting on poorly configured routers) as part of the same broader trend affecting edge network devices across all sectors.

Defenders are urged to build a definitive inventory of OT assets and external connections, remove direct internet exposure of OT devices, eliminate default/shared credentials in favour of MFA and key-based authentication, harden OT boundaries with segregated, non-internet-connected management networks, adopt secure protocol variants (e.g., DNP3-SAv5, CIP Security, Modbus Security, OPC UA) and retire insecure ones (Telnet, SNMPv1/v2), implement baseline monitoring for anomalous OT communications, segment IT/OT networks, and maintain tested, ransomware-resistant backups. Non-OT organisations are advised to maintain visibility of internet-facing assets, patch edge devices promptly, retire EOL equipment, and monitor for unexpected configuration changes. The NCSC recommends its Early Warning service, Cyber Assessment Framework, and Cyber Essentials as resilience-building resources.

Detection guidance

OT Device Authentication Using Hardcoded or Default Credentials

ATT&CK T0891

Detects authentication attempts to OT devices (PLCs, HMIs, industrial gateways) using common default or hardcoded credential patterns in network traffic. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: OT Device Authentication Using Hardcoded or Default Credentials
description: Detects network authentication attempts to OT devices using default or
  hardcoded credentials. Targets industrial protocols and common OT management interfaces
  where default credentials remain unchanged.
tags:
- attack.credential-access
- attack.t0891
logsource:
  category: network_connection
  product: windows
detection:
  selection_ot_ports:
    DestinationPort:
    - 21
    - 23
    - 80
    - 161
    - 502
    - 1026
    - 2222
    - 5900
    - 8080
  selection_ot_protocols:
    Protocol:
    - tcp
    - udp
  selection_auth_patterns:
    CommandLine|contains:
    - admin:admin
    - root:root
    - administrator:administrator
    - default
    - password123
  filter_internal:
    SourceIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
  condition: selection_ot_ports and selection_ot_protocols and selection_auth_patterns
    and not filter_internal
falsepositives:
- Legitimate OT vendor support or commissioning using documented default credentials
  on isolated test networks
- Authorized industrial network scanning or vulnerability assessment tools
level: high
id: e8f5844c-160f-59bb-be3d-2e2c234533e5
status: experimental
author: Vorant

Anomalous OT Protocol Communication on Non-Standard Ports

ATT&CK T0842

Detects suspicious network sniffing or unauthorized command messages on OT protocols (Modbus, DNP3, Profibus, OPC) over unexpected ports or tunneled connections. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Anomalous OT Protocol Communication on Non-Standard Ports
description: Detects anomalous network traffic patterns consistent with OT protocol
  sniffing or unauthorized command injection. Targets insecure OT protocol variants
  (unencrypted Modbus, DNP3, SNMPv1/v2) on non-standard or tunneled ports.
tags:
- attack.discovery
- attack.t0842
logsource:
  category: network_connection
  product: windows
detection:
  selection_ot_payload:
    Payload|contains:
    - \x03\x00\x00
    - modbus
    - DNP3
    - profibus
    - OPC
  selection_nonstandard_port:
    DestinationPort:
    - 8080
    - 8443
    - 9000
    - 9999
    - 12345
  selection_direction:
    Direction: outbound
  filter_vpn:
    CommandLine|contains:
    - openvpn
    - wireguard
    - ssh
  condition: selection_ot_payload and selection_nonstandard_port and selection_direction
    and not filter_vpn
falsepositives:
- Authorized OT remote access appliances using tunneled connections for legitimate
  industrial engineering
- Vendor-specific OT device communication over custom ports
level: medium
id: 97c3545e-dee7-556a-9e75-0a68739342a9
status: experimental
author: Vorant

Unauthorized Remote Access to OT Management Interface

ATT&CK T0886

Detects direct network connections to internet-exposed OT management interfaces (HMI, PLC, industrial gateway) from external sources using telnet or unencrypted HTTP. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Unauthorized Remote Access to OT Management Interface
description: Detects inbound network connections to OT management interfaces (HMI,
  PLC, industrial gateway, router admin panel) from external IP space using insecure
  protocols. Identifies exploitation of misconfigured internet exposure.
tags:
- attack.initial-access
- attack.t0886
logsource:
  category: network_connection
  product: windows
detection:
  selection_ot_mgmt_port:
    DestinationPort:
    - 23
    - 80
    - 161
    - 502
    - 1026
    - 5900
    - 8080
  selection_insecure_protocol:
    Protocol:
    - tcp
  selection_external_source:
    SourceIp|cidr: 0.0.0.0/0
  filter_internal_source:
    SourceIp|cidr:
    - 10.0.0.0/8
    - 172.16.0.0/12
    - 192.168.0.0/16
    - 127.0.0.1/32
  filter_authorized_mgmt:
    DestinationPort: 443
  condition: selection_ot_mgmt_port and selection_insecure_protocol and selection_external_source
    and not filter_internal_source and not filter_authorized_mgmt
falsepositives:
- Authorized remote industrial engineering support accessing OT devices via VPN or
  reverse proxy
- Cloud-based OT monitoring services intentionally exposed behind API gateways
level: high
id: f5843967-3fe9-5e7f-bf79-38e0169da5ba
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ncsc.gov.uk/news/disruptive-cyber-activity-highlights-risk-from-internet-exposed-systems-and-edge-devices

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free