VORANT. Threat Intelligence Research Sign in Create a free account

NSA and CISA release OT/ICS defense guidance against APT threats

routine threat energyinfrastructuregovernment-nationaldefensemanufacturingtelecommunicationstransportation

Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.

NSA and CISA advisory on how nation-state and criminal actors compromise critical infrastructure control systems and recommended mitigations.

This joint NSA and CISA cybersecurity advisory describes the tactics, techniques, and procedures malicious actors use to compromise operational technology and industrial control system (OT/ICS) assets that manage critical infrastructure. The advisory documents a five-stage attack progression: establishing intended effect and selecting targets, collecting intelligence via open-source research and insider threats, developing custom tools and techniques (including custom malware targeting specific PLCs like Triconex and Schneider Electric devices), gaining initial access through poorly secured remote access points, and executing techniques to disrupt, disable, deny, deceive or destroy systems.

Malicious actors ranging from cyber criminals seeking financial gain to nation-state APT groups targeting critical infrastructure for political and military objectives exploit public availability of system designs, vulnerable IT components, and widespread remote access capabilities. The advisory notes that APT actors have developed tools to scan for, compromise, and control certain Schneider Electric PLCs, OMRON Sysmac NEX PLCs, and OPC UA servers. Once inside, attackers manipulate HMI displays, modify control outputs (opening breakers, throttling valves, overriding safety systems), block reporting messages, and prevent operator response.

The advisory provides detailed mitigation recommendations focused on limiting system information exposure, identifying and securing all remote access points through firewalls and DMZs, restricting access to engineering tools and scripts, conducting independent security audits, and implementing dynamic network changes to disrupt persistent attacker access. The guidance emphasizes that OT/ICS owners and operators should assume systems will be targeted and proactively harden against exploitation.

Mentioned in this report

Malware Triton

Related reporting

Detection guidance

Scripting Interpreter Connecting to Common PLC/ICS Protocol Ports

ATT&CK T0831

Script hosts or interpreters (PowerShell, Python, WSH) making outbound connections to Modbus, S7comm, Triconex TriStation, OPC UA, OMRON FINS, EtherNet/IP or IEC-104 ports, consistent with custom tooling that scans or manipulates PLCs. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Scripting Interpreter Connecting to Common PLC/ICS Protocol Ports
id: 6922e2e3-89ce-555c-b542-d37a03c12284
status: experimental
description: 'Detects scripting interpreters (PowerShell, Python, WSH) initiating
  outbound connections to well-known OT/ICS protocol ports: Modbus 502, S7comm 102,
  Triconex TriStation 1502, OPC UA 4840, OMRON FINS 9600, EtherNet/IP 44818, IEC-104
  2404. Custom tooling used to scan, control or manipulate PLCs and OPC UA servers
  often takes this form. Most useful on IT hosts, jump hosts and engineering workstations;
  tune by excluding sanctioned engineering scripts.'
tags:
- attack.impact
- attack.t0831
- attack.t0813
- attack.t0832
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    - \python.exe
    - \pythonw.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    DestinationPort:
    - 102
    - 502
    - 1502
    - 2404
    - 4840
    - 9600
    - 44818
  filter_loopback:
    DestinationIp|cidr:
    - 127.0.0.0/8
    - ::1/128
  condition: selection and not filter_loopback
falsepositives:
- Engineers or integrators running sanctioned Python or PowerShell scripts for PLC
  polling, Modbus testing or OPC UA data collection
- Historian or data-collection scripts that read from PLCs on a schedule
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-265a

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-265a

What this brief leaves out

This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.

It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.

A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.

Create a free account   What it costs