# NSA and CISA release OT/ICS defense guidance against APT threats

Published: 2025-07-22 · Severity: routine · Sectors: energy, infrastructure, government-national, defense, manufacturing, telecommunications, transportation
Canonical: https://vorant.io/reports/e4dab54e-eabd-596f-9ab8-fbe2525b4f82/nsa-and-cisa-release-ot-ics-defense-guidance-against-apt-threats

> NSA and CISA advisory on how nation-state and criminal actors compromise critical infrastructure control systems and recommended mitigations.

This joint NSA and CISA cybersecurity advisory describes the tactics, techniques, and procedures malicious actors use to compromise operational technology and industrial control system (OT/ICS) assets that manage critical infrastructure. The advisory documents a five-stage attack progression: establishing intended effect and selecting targets, collecting intelligence via open-source research and insider threats, developing custom tools and techniques (including custom malware targeting specific PLCs like Triconex and Schneider Electric devices), gaining initial access through poorly secured remote access points, and executing techniques to disrupt, disable, deny, deceive or destroy systems.

Malicious actors ranging from cyber criminals seeking financial gain to nation-state APT groups targeting critical infrastructure for political and military objectives exploit public availability of system designs, vulnerable IT components, and widespread remote access capabilities. The advisory notes that APT actors have developed tools to scan for, compromise, and control certain Schneider Electric PLCs, OMRON Sysmac NEX PLCs, and OPC UA servers. Once inside, attackers manipulate HMI displays, modify control outputs (opening breakers, throttling valves, overriding safety systems), block reporting messages, and prevent operator response.

The advisory provides detailed mitigation recommendations focused on limiting system information exposure, identifying and securing all remote access points through firewalls and DMZs, restricting access to engineering tools and scripts, conducting independent security audits, and implementing dynamic network changes to disrupt persistent attacker access. The guidance emphasizes that OT/ICS owners and operators should assume systems will be targeted and proactively harden against exploitation.

## Mentioned in this report

- Malware: Triton

## Detection guidance (public sample)

### Scripting Interpreter Connecting to Common PLC/ICS Protocol Ports

ATT&CK: T0831

Script hosts or interpreters (PowerShell, Python, WSH) making outbound connections to Modbus, S7comm, Triconex TriStation, OPC UA, OMRON FINS, EtherNet/IP or IEC-104 ports, consistent with custom tooling that scans or manipulates PLCs. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Scripting Interpreter Connecting to Common PLC/ICS Protocol Ports
id: 6922e2e3-89ce-555c-b542-d37a03c12284
status: experimental
description: 'Detects scripting interpreters (PowerShell, Python, WSH) initiating
  outbound connections to well-known OT/ICS protocol ports: Modbus 502, S7comm 102,
  Triconex TriStation 1502, OPC UA 4840, OMRON FINS 9600, EtherNet/IP 44818, IEC-104
  2404. Custom tooling used to scan, control or manipulate PLCs and OPC UA servers
  often takes this form. Most useful on IT hosts, jump hosts and engineering workstations;
  tune by excluding sanctioned engineering scripts.'
tags:
- attack.impact
- attack.t0831
- attack.t0813
- attack.t0832
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    - \python.exe
    - \pythonw.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    DestinationPort:
    - 102
    - 502
    - 1502
    - 2404
    - 4840
    - 9600
    - 44818
  filter_loopback:
    DestinationIp|cidr:
    - 127.0.0.0/8
    - ::1/128
  condition: selection and not filter_loopback
falsepositives:
- Engineers or integrators running sanctioned Python or PowerShell scripts for PLC
  polling, Modbus testing or OPC UA data collection
- Historian or data-collection scripts that read from PLCs on a schedule
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-265a
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-265a

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/e4dab54e-eabd-596f-9ab8-fbe2525b4f82/nsa-and-cisa-release-ot-ics-defense-guidance-against-apt-threats.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup