World War OT: How the Next War is Already Being Fought

Executive Summary

The standard breach discovery timeline: adversary dwell time averages 200+ days (Mandiant M-Trends 2026). By the time defenders find them, attackers have mapped the network, established persistence, and pre-positioned payloads.

Recent grid incidents prove that critical infrastructure control systems are viable kinetic targets. Coordinated substation trips. PLC logic corruption. Cascading failures.

The Dwell Time Problem

Mainstream threat reports focus on attribution and initial access. What they miss: the months-long persistence phase where attackers quietly map your environment, establish backdoors, and pre-position payloads.

Pattern from recent incidents:

• Initial compromise: watering hole or vendor network access
• Dwell time: 4-8 months average before discovery (industry incident analysis)
• Legitimate tool abuse: engineering workstation software, vendor remote access
• Pre-positioned payload: PLC logic modifications, ready to deploy
• Trigger: External geopolitical event, not technical timeline

Why this matters: Your OT network might already be compromised. The attacker isn't exfiltrating data or demanding ransom. They're waiting for a phone call.

Technical Deep Dive: Living Off the Land in OT

Phase 1: Quiet Entry (Months Before Conflict)

// Initial access patterns (sanitized)
Vector: Engineering workstation compromise
   - Watering hole (vendor forums, technical communities)
   - Spear phishing (maintenance notifications, firmware updates)
   - Supply chain (compromised vendor tools/updates)

Stealth: Use legitimate credentials
   - Default passwords still common (admin/admin, vendor defaults)
   - Stolen vendor remote access credentials
   - Legitimate maintenance windows for cover
        

Phase 2: Map and Pre-Position (Dwell Time: 4-8 months)

// Reconnaissance (looks like normal ops)
- Protocol traffic sniffing (DNP3, Modbus, S7COMM)
- PLC register mapping (control points, setpoints)
- Engineering workstation software enumeration
- Vendor maintenance schedule observation
- Network topology mapping (air gaps, segmentation)

// Payload staging
- Modified PLC logic prepared (not yet deployed)
- Backdoor accounts created (dormant)
- Persistence mechanisms (legitimate-looking scheduled tasks)
        

Phase 3: Activation (When Shooting Starts)

// Grid collapse sequence
Trigger: External command (geopolitical event)
Action: Deploy pre-staged PLC logic modifications
Target: Coordinated substation trips
Effect: Cascading grid failure
Timeline: Minutes from trigger to lights out
        

Real-World Implications

They're Already Inside

The uncomfortable truth: if you haven't found them yet, they're probably already there. Nation-state actors pre-position in critical infrastructure the same way military forces pre-position ammunition and equipment.

What Equipment Is At Risk?

Same vendors, same protocols, same vulnerabilities:

• Siemens S7-1500/S7-1200: Widely deployed in US critical infrastructure
• Rockwell PLCs: Allen-Bradley ControlLogix, CompactLogix
• Schneider Electric: Modicon, EcoStruxure systems
• Protocols: DNP3, Modbus TCP, IEC 60870-5-104, EtherNet/IP
• Engineering software: TIA Portal, RSLogix, Unity Pro

Detection & Defense: The Monday-Morning Checklist

1. Audit Engineering Workstation Activity

# Look for unusual PLC programming activity
# Check scheduled tasks, service accounts
# Review vendor remote access logs (past 12 months)
grep "PLC\|engineering\|vendor" /var/log/auth.log | awk '{print $1, $3, $11}' | sort | uniq -c

2. Baseline Normal Protocol Traffic

# Capture 30 days of normal ops
# Flag deviations (unusual register reads, write attempts outside maintenance windows)
tcpdump -i eth0 port 502 or port 102 or port 20000 -w baseline.pcap

3. Hunt for Dormant Backdoor Accounts

• Service accounts created during "maintenance" that never get used
• Vendor accounts with passwords that don't match current vendor standard
• Engineering software licenses activated but rarely touched

4. Review PLC Logic Integrity

# Hash all PLC logic blocks monthly
# Alert on any changes outside documented change windows
# Compare against known-good baseline from commissioning

1. Change ALL Default Credentials

• Engineering workstation local admin accounts
• SCADA HMI login credentials
• Vendor portal/remote access accounts
• PLC programming software passwords

2. Segment Engineering Networks

# Engineering workstations on isolated VLAN
# No internet access from engineering subnet
# Protocol-aware firewall between IT and OT
# Monitor all traffic from engineering VLAN

3. Enable Write Operation Logging

# Log every PLC write command
# Modbus FC 5/6/15/16
# S7COMM write requests  
# DNP3 control operations
# Alert on writes outside maintenance windows

1. Implement Two-Person Rule

• Critical PLC logic changes require two authorized engineers
• Dual authentication for logic uploads
• Separation of duties in change management

2. Deploy Protocol-Aware Monitoring

• IDS rules for DNP3/Modbus/S7COMM anomalies
• Baseline normal traffic, alert on deviations
• Focus on write operations and extensive register reads

3. Vendor Access Audit

• Review all active vendor remote access accounts
• Disable dormant accounts (>90 days unused)
• Require MFA for all vendor access

1. Air-Gapped PLC Logic Backups

• Weekly hash verification of all PLC logic
• Offline backup to removable media
• Test restoration procedures quarterly

2. Hunt Team Exercises

• Assume breach, hunt for pre-positioned threats
• Focus on long-dwell, living-off-the-land techniques
• Review 12 months of engineering workstation logs

3. Incident Response Plan: Lights-Out Scenario

• Manual procedures for grid restoration
• Out-of-band communications (not dependent on network)
• PLC logic recovery from known-good offline backups
• Physical access procedures when remote tools compromised

Monitoring Points & Detection Signatures

Hunt for Long-Dwell Indicators

Service Account Anomalies:

# Accounts created during "vendor maintenance" that are never used again
# Scheduled tasks that run during odd hours
# Engineering software licenses activated but showing minimal use

Protocol Traffic Deviations:

# Extensive register reads (reconnaissance)
# Write operations outside documented maintenance windows
# Protocol traffic from unexpected source IPs

Engineering Workstation Red Flags:

# PLC programming tools launched outside work hours
# Unusual network connections from engineering machines
# File transfers to/from engineering workstations during off-hours

Tool Suggestions

The Uncomfortable Truth

The lights didn't go out because of a zero-day exploit or sophisticated new malware. They went out because an adversary had been inside the network for months, living off the land with legitimate tools and credentials, waiting for the order to flip the switch.

That same pre-positioning is happening right now in US critical infrastructure.

The attack isn't coming. It's already there, dormant, waiting for a geopolitical trigger.

Recommendations

For OT Defenders:

• Assume breach: Hunt for pre-positioned threats in your environment today
• Change all defaults: Every credential, every password, every vendor account
• Baseline and monitor: Know what normal looks like, alert on deviations
• Segment aggressively: Engineering networks isolated, protocol-aware firewalls
• Prepare for lights-out: Manual restoration procedures when networks are compromised

For Security Vendors:

• Focus detection on long-dwell, living-off-the-land techniques
• Build tools that find dormant persistence, not just active exploitation
• Protocol-aware anomaly detection for OT environments
• Assume legitimate credentials, focus on behavior

For Policy Makers:

• Fund threat hunting in critical infrastructure (not just perimeter defense)
• Incident response planning for kinetic+cyber coordinated attacks
• Anonymous threat intelligence sharing (dwell time indicators, TTPs)
• Manual backup procedures for when automation is compromised

Disclaimer: All analysis defensive. No attribution. No specific targets or incidents identified. Pattern analysis based on publicly available incident forensics and threat research. For defensive use by OT security professionals.

← Back to Control Systems Security · Previous Dispatch: OT Watering Hole Attacks