Adversaries may gain access into industrial environments through systems exposed directly to the internet for remote access rather than through External Remote Services. Internet Accessible Devices are exposed to the internet unintentionally or intentionally without adequate protections. This may allow for adversaries to move directly into the control system network. Access onto these devices is accomplished without the use of exploits, these would be represented within the Exploit Public-Facing Application technique.
Adversaries may leverage built in functions for remote access which may not be protected or utilize minimal legacy protections that may be targeted. [1] These services may be discoverable through the use of online scanning tools.
In the case of the Bowman dam incident, adversaries leveraged access to the dam control network through a cellular modem. Access to the device was protected by password authentication, although the application was vulnerable to brute forcing. [1] [2] [3]
In Trend Micros manufacturing deception operations adversaries were detected leveraging direct internet access to an ICS environment through the exposure of operational protocols such as Siemens S7, Omron FINS, and EtherNet/IP, in addition to misconfigured VNC access. [4]
| ID | Name | Description |
|---|---|---|
| C0066 | 2026 U.S. Water Utilities Attacks |
During the 2026 U.S. Water Utilities Attacks, the adversary located internet-exposed PLCs (e.g., Rockwell Automation/Allen-Bradley MicroLogix 1100 and 1400 PLCs, etc.) at water and wastewater utilities, including cellular-connected water towers and sewer lift stations, and logged in to them directly.[5][6][7] |
| G1027 | CyberAv3ngers |
During the 2026 Iranian Water Campaign, CyberAv3ngers accessed internet accessible PLCs that were exposed through cellular gateways across multiple vendors including Rockwell Automation/Allen-Bradley, Schneider Electric, and Siemens.[8] |
| S1157 | Fuxnet |
Fuxnet execution relied upon accessing Internet-accessible devices for initial access and deployment.[9] |
| C0031 | Unitronics Defacement Campaign |
During the Unitronics Defacement Campaign, the CyberAv3ngers exploited devices connected to the public internet, such as internet connected Unitronics Programmable Logic Controller (PLC) with Human-Machine Interface (HMI) and networking equipment such as cellular modems found in OT environments.[10][11] |
| ID | Asset |
|---|---|
| A0008 | Application Server |
| A0016 | Firewall |
| A0015 | Switch |
| A0011 | Virtual Private Network (VPN) Server |
| A0001 | Workstation |
| ID | Mitigation | Description |
|---|---|---|
| M0930 | Network Segmentation |
Deny direct remote access to internal systems through the use of network proxies, gateways, and firewalls. Steps should be taken to periodically inventory internet accessible devices to determine if it differs from the expected. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0796 | Detection of Internet Accessible Device | AN1928 |
Real-time monitoring identifies inbound connections to Industrial Control System (ICS) Windows application servers from internet-routed Internet Protocol (IP) addresses. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity. |
| AN2222 |
Real-time monitoring identifies Industrial Control System (ICS) field device IPs receiving inbound connections from internet-sourced IP addresses on ICS protocol ports. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity. |
||
| AN2253 |
Real-time monitoring identifies an Industrial Control System (ICS) device or server accepting an inbound connection on its native protocol port from a source Internet Protocol (IP) address outside the organization's address space. Documented in Trend Micro's manufacturing honeypot research, with adversaries exploiting exposed Siemens S7, Omron Factory Interface Network Service (FINS), EtherNet/IP, and misconfigured Virtual Network Computing (VNC). OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity. |
||
| AN2256 |
Real-time monitoring identifies Secure Shell (SSH), web application, or Industrial Control System (ICS) Application Programming Interface (API) authentication attempts on ICS Linux servers from internet-sourced Internet Protocol (IP) addresses. OT operational-fidelity gate: Alert only when the asset's documented role does not permit the connection and the destination/proxy/service is outside the approved communications profile, with process/service identity used as corroboration where available. Suppress approved vendor support, update repositories, remote operations, failover paths, and documented temporary connectivity. |