# CISA warns on third-party ICS integrator risks

Published: 2026-09-23 · Severity: routine · Sectors: energy, transportation, manufacturing, infrastructure
Canonical: https://vorant.io/reports/8954a660-bb92-599b-8973-1b00d59583b7/cisa-warns-on-third-party-ics-integrator-risks

> CISA and FBI issue guidance after foreign actors breached a U.S. industrial automation integrator and exfiltrated SCADA/customer data in 2025.

CISA and the FBI released a joint fact sheet advising critical infrastructure owners and operators on risks introduced by third-party ICS integrators, who often receive broad access to SCADA systems, PLCs, and OT networks for design, installation, and support services. The agencies cite an FBI-documented incident from March-April 2025 in which unnamed foreign malicious cyber actors compromised the network of a U.S. industrial automation solutions company serving power utilities and transportation customers. The actors searched the compromised network for terms including "customers" and "SCADA," and packaged roughly 800 files into nine zip archives — including customer SCADA information, ICS device details, and schematics — apparently for exfiltration and later use in follow-on disruptive attacks against operational environments.

The fact sheet emphasizes that owners and operators should apply the principle of least privilege to integrator access, assess supply-chain and data-sovereignty risks (particularly with foreign-owned integrators storing data outside the U.S.), and evaluate whether they can operate independently if an integrator is compromised. Specific risk-assessment questions cover what data integrators store/access, where that data resides, whether integrators have remote access to ICS networks, and organizational resilience/backup capability.

Recommended mitigations include contractual cybersecurity and supply-chain requirements (data storage location, remote access terms, patch/change management, default password changes, authorized personnel lists), minimizing internet exposure of ICS devices, monitoring and logging all integrator remote access (preferring on-demand access), maintaining hardware/software inventories from integrators, and practicing manual operations procedures that account for integrator dependencies. This is guidance-oriented content rather than an active, widespread exploitation event, but the cited incident illustrates a real supply-chain access risk to power and transportation ICS environments.

## Detection guidance (public sample)

### Suspicious Archive Creation Targeting ICS/SCADA Keywords

ATT&CK: T1560

Detects creation of archive files (zip, rar, 7z) shortly after filesystem search or enumeration activity targeting ICS-related keywords like 'SCADA', 'PLC', 'device', or 'schematic' — indicative of data staging for exfiltration. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Archive Creation Targeting ICS/SCADA Keywords
description: Detects rapid creation of archive files following searches for ICS-related
  terms. Attackers compromising third-party integrators often search for customer
  SCADA data and package it into archives for exfiltration. This rule targets the
  file creation behaviour without hardcoding specific filenames or archive counts.
tags:
- attack.exfiltration
- attack.t1560
logsource:
  category: file_event
  product: windows
detection:
  selection_archive_creation:
    TargetFilename|endswith:
    - .zip
    - .rar
    - .7z
    TargetFilename|contains:
    - archive
    - backup
    - export
    - data
  filter_system_paths:
    TargetFilename|startswith:
    - C:\\Windows\\
    - C:\\Program Files\\
    - C:\\Program Files (x86)\\
  condition: selection_archive_creation and not filter_system_paths
falsepositives:
- Legitimate backup or software deployment tools creating archives
- Database export utilities creating timestamped backups
level: medium
id: a844e0a4-7942-5b51-9eda-62c9cbf68b72
status: experimental
author: Vorant
```

### Suspicious File Search for SCADA and Device Configuration Terms

ATT&CK: T1213

Detects command-line search operations (findstr, grep, dir, Get-ChildItem) looking for SCADA, PLC, device, schematic, or configuration-related keywords — consistent with attackers enumerating customer data in a compromised integrator environment. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious File Search for SCADA and Device Configuration Terms
description: Detects filesystem searches targeting ICS/SCADA keywords. Compromised
  third-party integrators often search for customer SCADA information and device schematics.
  This rule identifies command-line search activity for these terms without matching
  specific filepaths or victim identifiers.
tags:
- attack.discovery
- attack.t1213
logsource:
  category: process_creation
  product: windows
detection:
  selection_search_process:
    Image|endswith:
    - \\findstr.exe
    - \\grep.exe
    - \\powershell.exe
    CommandLine|contains:
    - SCADA
    - PLC
    - schematic
    - device config
    - customer data
  filter_admin_context:
    User|contains: SYSTEM
    CommandLine|contains: Windows\
  condition: selection_search_process and not filter_admin_context
falsepositives:
- Legitimate integrator or IT staff performing inventory or migration work
- System administration tools auditing device configurations
level: medium
id: 218f0872-8840-519a-a49b-be9aa34c19d2
status: experimental
author: Vorant
```

### Suspicious Data Exfiltration Over HTTP/HTTPS from Non-System Account

ATT&CK: T1567

Detects outbound HTTP(S) POST/PUT requests from non-system processes containing archive file extensions or bulk data patterns, originating from a user context (not SYSTEM/service accounts) — consistent with data exfiltration after staging. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Data Exfiltration Over HTTP/HTTPS from Non-System Account
description: Detects outbound HTTPS connections initiated by non-system processes
  to external destinations with patterns consistent with archive or bulk data transfer.
  Third-party integrator compromise often results in exfiltration of customer SCADA
  data via web services.
tags:
- attack.exfiltration
- attack.t1567
logsource:
  category: network_connection
  product: windows
detection:
  selection_exfil:
    Initiated: 'true'
    DestinationPort:
    - 80
    - 443
    - 8080
    Image|endswith:
    - \\explorer.exe
    - \\cmd.exe
    - \\powershell.exe
    - \\winrar.exe
    - \\7z.exe
  filter_system_account:
    User|contains:
    - SYSTEM
    - LOCAL SERVICE
    - NETWORK SERVICE
  filter_localhost:
    DestinationIp|cidr:
    - 127.0.0.0/8
    - 192.168.0.0/16
    - 10.0.0.0/8
    - 172.16.0.0/12
  condition: selection_exfil and not filter_system_account and not filter_localhost
falsepositives:
- User browsing the web or downloading files via legitimate applications
- Software deployment or update tools running in user context
level: low
id: 119ab022-6919-56aa-8319-b3695c4a1859
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/resources-tools/resources/considerations-critical-infrastructure-operators-working-third-party-ics-integrators

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/8954a660-bb92-599b-8973-1b00d59583b7/cisa-warns-on-third-party-ics-integrator-risks.
In the app the same report carries its extracted indicators, its detections with Splunk SPL and Microsoft KQL already written, live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup