OT and ICS Under Threat: When Cyberattacks Turn Physical

Operational technology runs physical processes — power, water, heating, manufacturing. Three distinct motives drive attacks: state pre-positioning for future disruptive effect during conflict; wartime sabotage (prominently around the Russia-Ukraine war); and low-sophistication hacktivist or ideological defacement of internet-exposed devices. The impact is physical — loss of heat, water or power. Many devices are “insecure by design” (no authentication, plaintext protocols), internet-exposed and unpatchable, so even unsophisticated actors succeed.

How OT Gets Attacked

Many intrusions start on the IT network and pivot to OT. Volt Typhoon’s living-off-the-land tradecraft (detailed in CISA advisory AA24-038A) uses valid accounts (T1078), compromised edge routers and exploitation of public-facing applications (T1190) to reach operational networks. Against exposed devices, attackers simply log in with default credentials. In the ICS domain, FrostyGoop manipulated devices over Modbus TCP (T0855 Unauthorized Command Message, T0836 Modify Parameter), and wiper-style attacks map to ICS impact techniques (T0809 Data Destruction, T0814 Denial of Service). ICS technique mappings here are analyst-assigned; verify against MITRE ATT&CK for ICS.

Defining Incidents

• CyberAv3ngers / Unitronics (November 2023): IRGC-affiliated actors (per CISA/FBI/NSA/EPA joint advisory AA23-335A) defaced internet-exposed Unitronics PLCs at U.S. water utilities, beginning with Aliquippa, Pennsylvania. The devices used default passwords on an exposed port; operators reverted to manual control with no reported water-quality impact. Agencies assess the “hacktivist” persona is IRGC-run.
• FrostyGoop / BUSTLEBERM (January 2024): ICS malware (named FrostyGoop by Dragos, BUSTLEBERM by Mandiant) used Modbus TCP to disrupt central heating to more than 600 apartment buildings in Lviv, Ukraine, in winter, with initial access via a router flaw. It was not publicly attributed to a named group.
• Fuxnet (April 2024): the Blackjack group (reported as Ukraine-linked) claimed an attack on Moscow’s Moscollector; Claroty Team82 assessed it bricked roughly 1,700 of 2,659 sensor gateways — far fewer than the group’s larger claims, which should be treated with caution.

Actors & Exposure

Volt Typhoon (overlapping Dragos’s VOLTZITE; PRC-linked pre-positioning), CyberAv3ngers (IRGC-affiliated), and Russia-associated OT activity groups feature prominently. The OT:ICEFALL research (Forescout, 2022) catalogued 56 insecure-by-design flaws across 10 vendors — defining the vulnerability class rather than an actor. Dragos’s annual reporting indicates OT-affecting ransomware and the number of OT-active threat groups continue to rise.

Defensive Priorities

• Remove PLCs and OT devices from direct internet exposure and change all default credentials (the Unitronics lesson); put remote access behind VPN and MFA.
• Harden and patch internet-facing edge devices (routers, firewalls) — the FrostyGoop access path — and hunt for living-off-the-land activity on IT networks bordering OT.
• Implement the SANS/Dragos ICS controls: defensible architecture and segmentation, ICS-aware network monitoring (Modbus and anomalous-command visibility), secure remote access, ICS incident response, and risk-based vulnerability management.
• Maintain manual-fallback procedures and known-good firmware/config backups for field devices, and track insecure-by-design exposure through asset inventory.