Report Maps Threat Actors and Exposure Risks for US ICS/OT Systems

Mar 5, 2026 · Original article ↗

Summary

CloudSEK assesses threat actors targeting US and allied industrial systems, outlines their access methods and the scale of exposed ICS/OT devices, and recommends reducing internet exposure, changing default credentials, restricting access, and improving monitoring.

Key points

The assessment profiles nation-state groups and proxies, including APT33, MuddyWater, Handala, Volt Typhoon, and CyberAv3ngers.
Reported access methods include password spraying, phishing, abuse of remote-management tools, exploitation of exposed edge devices, and default credentials on internet-accessible PLCs.
The article describes three routes to disruption: direct access to exposed devices, phishing people in OT-adjacent roles, and lateral movement from IT into OT networks.
It cites more than 40,000 internet-exposed ICS devices in the US and provides protocol-port exposure counts for several countries.
The assessment highlights Volt Typhoon's reported long-term presence in US critical infrastructure and CyberAv3ngers' targeting of exposed Unitronics PLCs.
Recommended actions include removing ICS management interfaces from the public internet, changing default passwords, restricting industrial protocol ports and MSP/RMM access, enabling logs, and hunting for suspicious activity.

Article Details

Attack Vectors: Password spraying against Office 365 and Azure accounts, including distributed attempts with low per-account frequency.
Spearphishing with malicious Office or Excel macros, PDF droppers, malicious archives, LNK files, SMS, and email impersonating vendors, IT support, recruiters, researchers, or conference staff.
Credential harvesting through fake social profiles and phishing sites imitating Google Login and Google Meet.
Abuse of default credentials on internet-exposed Unitronics PLCs, including the default password 1111, followed by changes to ladder logic, HMI displays, device functions, or firmware.
Scanning internet-facing ICS devices and applications for exposed services, misconfigurations, and weak credentials.
Exploitation of internet-facing edge devices, VPNs, firewalls, and Microsoft Exchange servers.
Use of MSP supply-chain compromise and unauthorized remote-management tools to obtain access to OT networks and downstream industrial operators.
Use of compromised end-of-life SOHO routers as relay infrastructure.
Valid-account abuse and lateral movement from IT networks into OT environments.
Living-off-the-land execution with native tools including netsh, wmic, ntdsutil, and PowerShell.
Defensive Notes: Remove ICS management interfaces from the public internet and require VPN access.
Change default credentials on deployed ICS devices.
Block TCP ports 20256, 102, 502, 44818, 1911, 4840, and 20000, and UDP port 47808, at the perimeter.
Audit and restrict MSP and remote-management access to OT environments; investigate unauthorized Syncro, PDQ Connect, or AnyDesk installations.
Establish behavioral baselines and investigate unusual native-tool execution in OT-adjacent environments.
Enable logging on ICS management interfaces.
Monitor for external connections to Unitronics devices on TCP 20256; unexpected MQTT traffic from ICS or IoT devices; HMI changes; disabled remote-access functions; and unexpected firmware downgrades.
Monitor for unusual business-hours account activity, PortProxy registry modifications, IT-to-OT lateral movement, Telegram API traffic, high-entropy DNS queries, and suspicious Exchange webshells.