CISA warns on third-party ICS integrator risks
Free public brief. The indicators, the detections with Splunk and KQL already written, and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CISA and FBI issue guidance after foreign actors breached a U.S. industrial automation integrator and exfiltrated SCADA/customer data in 2025.
CISA and the FBI released a joint fact sheet advising critical infrastructure owners and operators on risks introduced by third-party ICS integrators, who often receive broad access to SCADA systems, PLCs, and OT networks for design, installation, and support services. The agencies cite an FBI-documented incident from March-April 2025 in which unnamed foreign malicious cyber actors compromised the network of a U.S. industrial automation solutions company serving power utilities and transportation customers. The actors searched the compromised network for terms including "customers" and "SCADA," and packaged roughly 800 files into nine zip archives — including customer SCADA information, ICS device details, and schematics — apparently for exfiltration and later use in follow-on disruptive attacks against operational environments.
The fact sheet emphasizes that owners and operators should apply the principle of least privilege to integrator access, assess supply-chain and data-sovereignty risks (particularly with foreign-owned integrators storing data outside the U.S.), and evaluate whether they can operate independently if an integrator is compromised. Specific risk-assessment questions cover what data integrators store/access, where that data resides, whether integrators have remote access to ICS networks, and organizational resilience/backup capability.
Recommended mitigations include contractual cybersecurity and supply-chain requirements (data storage location, remote access terms, patch/change management, default password changes, authorized personnel lists), minimizing internet exposure of ICS devices, monitoring and logging all integrator remote access (preferring on-demand access), maintaining hardware/software inventories from integrators, and practicing manual operations procedures that account for integrator dependencies. This is guidance-oriented content rather than an active, widespread exploitation event, but the cited incident illustrates a real supply-chain access risk to power and transportation ICS environments.
Detection guidance
Suspicious Archive Creation Targeting ICS/SCADA Keywords
Detects creation of archive files (zip, rar, 7z) shortly after filesystem search or enumeration activity targeting ICS-related keywords like 'SCADA', 'PLC', 'device', or 'schematic' — indicative of data staging for exfiltration. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Archive Creation Targeting ICS/SCADA Keywords
description: Detects rapid creation of archive files following searches for ICS-related
terms. Attackers compromising third-party integrators often search for customer
SCADA data and package it into archives for exfiltration. This rule targets the
file creation behaviour without hardcoding specific filenames or archive counts.
tags:
- attack.exfiltration
- attack.t1560
logsource:
category: file_event
product: windows
detection:
selection_archive_creation:
TargetFilename|endswith:
- .zip
- .rar
- .7z
TargetFilename|contains:
- archive
- backup
- export
- data
filter_system_paths:
TargetFilename|startswith:
- C:\\Windows\\
- C:\\Program Files\\
- C:\\Program Files (x86)\\
condition: selection_archive_creation and not filter_system_paths
falsepositives:
- Legitimate backup or software deployment tools creating archives
- Database export utilities creating timestamped backups
level: medium
id: a844e0a4-7942-5b51-9eda-62c9cbf68b72
status: experimental
author: Vorant
Suspicious File Search for SCADA and Device Configuration Terms
Detects command-line search operations (findstr, grep, dir, Get-ChildItem) looking for SCADA, PLC, device, schematic, or configuration-related keywords — consistent with attackers enumerating customer data in a compromised integrator environment. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious File Search for SCADA and Device Configuration Terms
description: Detects filesystem searches targeting ICS/SCADA keywords. Compromised
third-party integrators often search for customer SCADA information and device schematics.
This rule identifies command-line search activity for these terms without matching
specific filepaths or victim identifiers.
tags:
- attack.discovery
- attack.t1213
logsource:
category: process_creation
product: windows
detection:
selection_search_process:
Image|endswith:
- \\findstr.exe
- \\grep.exe
- \\powershell.exe
CommandLine|contains:
- SCADA
- PLC
- schematic
- device config
- customer data
filter_admin_context:
User|contains: SYSTEM
CommandLine|contains: Windows\
condition: selection_search_process and not filter_admin_context
falsepositives:
- Legitimate integrator or IT staff performing inventory or migration work
- System administration tools auditing device configurations
level: medium
id: 218f0872-8840-519a-a49b-be9aa34c19d2
status: experimental
author: Vorant
Suspicious Data Exfiltration Over HTTP/HTTPS from Non-System Account
Detects outbound HTTP(S) POST/PUT requests from non-system processes containing archive file extensions or bulk data patterns, originating from a user context (not SYSTEM/service accounts) — consistent with data exfiltration after staging. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Data Exfiltration Over HTTP/HTTPS from Non-System Account
description: Detects outbound HTTPS connections initiated by non-system processes
to external destinations with patterns consistent with archive or bulk data transfer.
Third-party integrator compromise often results in exfiltration of customer SCADA
data via web services.
tags:
- attack.exfiltration
- attack.t1567
logsource:
category: network_connection
product: windows
detection:
selection_exfil:
Initiated: 'true'
DestinationPort:
- 80
- 443
- 8080
Image|endswith:
- \\explorer.exe
- \\cmd.exe
- \\powershell.exe
- \\winrar.exe
- \\7z.exe
filter_system_account:
User|contains:
- SYSTEM
- LOCAL SERVICE
- NETWORK SERVICE
filter_localhost:
DestinationIp|cidr:
- 127.0.0.0/8
- 192.168.0.0/16
- 10.0.0.0/8
- 172.16.0.0/12
condition: selection_exfil and not filter_system_account and not filter_localhost
falsepositives:
- User browsing the web or downloading files via legitimate applications
- Software deployment or update tools running in user context
level: low
id: 119ab022-6919-56aa-8319-b3695c4a1859
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/resources-tools/resources/considerations-critical-infrastructure-operators-working-third-party-ics-integrators
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections with the Splunk SPL and Microsoft KQL already written, the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 9,539 reports from 155 sources, 1,375 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs