Loading story…
Cybersecurity firm Trellix has highlighted a growing risk in operational technology (OT) environments, particularly within critical infrastructure, due to an increasing number of cataloged vulnerabilities and persistent delays in patching. Programmable logic controllers (PLCs) are being increasingly targeted by attackers, with insecure remote connectivity devices providing new pathways for exploitation. A notable vulnerability, CVE-2025-7353, was identified in Rockwell ControlLogix Ethernet modules, which could allow remote code execution, enabling attackers to tamper with or halt processor communications, inject malicious logic, or disable safety functions without engineering credentials. The average time from vulnerability disclosure to patch deployment in OT environments now exceeds 180 days, significantly increasing exposure.
Legacy equipment prevalent in critical infrastructure further compounds these risks, as such systems are often difficult to update and maintain. The Trellix report underscores that attackers are exploiting these weaknesses for both political and destructive purposes, emphasizing the urgent need for improved patch management and security controls in OT networks. The situation is exacerbated by the complexity of patching OT devices compared to traditional IT systems, leaving critical infrastructure operators vulnerable to potentially severe disruptions and safety risks.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
To mitigate OT threats, Trellix recommended stronger network segmentation, zero-trust security, threat intelligence sharing, and stricter vendor requirements. These measures were presented as responses to the growing intentional targeting of OT environments.
Trellix said attackers are actively exploiting weaknesses in legacy OT protocols including Modbus, DNP3, proprietary SCADA protocols, and programmable logic controllers. The report also warned that some attacks have targeted safety systems in attempts to corrupt or disable them.
The report described threat actors exploiting weak IT/OT connections using tools and techniques such as Cobalt Strike, PowerShell, stolen credentials, and protocol scanning to move laterally. It said attackers increasingly compromise intermediary devices bridging IT and OT rather than directly targeting industrial controllers.
A Trellix report found that manufacturing accounted for 42% of OT-related detections among critical infrastructure clients, indicating it remained the most targeted sector for operational technology attacks. The report said OT incidents have shifted from accidental IT spillover to deliberate campaigns by criminal and state-backed actors.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcescworld.com
Open sourcegovinfosecurity.com
Open sourcebankinfosecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security reporting and expert commentary warn that **operational technology (OT)** environments remain highly exposed due to fragile access controls and that attacker capability is trending toward more dangerous, process-aware operations. Lessons drawn from the 2015 **Ukraine power grid** disruption emphasize that remote connectivity, vendor access, and broad VPN permissions can become the “soft underbelly” of critical infrastructure, with recurring real-world examples of disruption tied to **misused remote access and stolen credentials** (including the **Colonial Pipeline** shutdown following a compromised password). The core takeaway is that OT systems are no longer “too specialized” to be targeted, and that common enterprise intrusion paths—credential compromise and remote access abuse—continue to translate into operational impact when they bridge into industrial environments. Separately, OT-focused threat analysis highlights early signs that attackers are gaining the “process comprehension” historically missing from many intrusions into industrial systems. A forthcoming RSA Conference 2026 presentation is expected to demonstrate **“living-off-the-plant”** techniques—analogous to living-off-the-land in IT—where adversaries leverage native industrial tooling and legitimate functions inside plants to blend in and potentially manipulate physical processes. The reporting argues that “security by obscurity” (attackers’ unfamiliarity with bespoke/legacy OT) has limited the severity of many incidents so far, but that this advantage is eroding as adversaries become more comfortable operating within industrial environments, increasing the risk of more consequential OT attacks.
Jun 29, 2026
CISA published guidance explaining why *secure* variants of common industrial communication protocols remain under-adopted across critical infrastructure OT environments, despite being available for decades. The guidance highlights persistent reliance on legacy protocols designed for uptime rather than security, leaving common gaps—**no authentication, no integrity, and no confidentiality**—that enable attackers with OT network access to impersonate devices, alter messages in transit, or issue unauthorized commands. CISA based its findings on interviews with asset owners/operators across sectors including Water/Wastewater, Transportation, Chemical, Energy, and Food/Agriculture, and pointed to secure alternatives such as **DNP3 Secure Authentication**, **CIP Security**, **Modbus Security**, and **OPC UA**, while noting real-world barriers like cost, complexity, and operational fragility. Separately, reporting described **Operational Relay Box (ORB)** networks—mesh-like relay infrastructure built from compromised IoT devices, SOHO routers, and VPS nodes—used by threat actors to obscure attack origins and blend malicious traffic into residential/business broadband patterns, complicating blocking and attribution. The ORB discussion was tied to a Singapore CSA disclosure that **UNC3886** targeted major telecom operators (M1, SIMBA, Singtel, StarHub), reportedly exploiting **zero-day perimeter firewall vulnerabilities** and deploying rootkits for stealth and persistence. In OT device security, CERT@VDE warned of a cluster of critical vulnerabilities in **WAGO 852 series industrial managed switches** (models `8052-1322` and `0852-1328`, firmware `2.64` and earlier), including **CVE-2026-22906** (hardcoded AES-ECB key enabling credential recovery from configuration files) and additional critical issues (CVSS **9.8**) in the web management stack (modified *lighttpd* and custom CGI) that can be triggered via oversized cookie parsing to crash devices or potentially enable remote code execution—conditions that materially increase the risk of remote takeover within OT networks.
Jun 29, 2026
Honeywell’s 2026 OT Cybersecurity Benchmark Report found that industrial organizations significantly overestimate their operational-technology security maturity: **88%** of 603 critical-infrastructure security, risk and operations leaders rated their programs mature or design-led, but only **21%** maintained a complete OT asset inventory and **33%** had fully integrated OT telemetry and response into a centralized SOC. Legacy controllers without authentication or encryption were identified as the principal readiness obstacle, while connected building-automation and IoT assets often remain outside continuous monitoring. The exposure has operational consequences. Significant OT incidents caused an average **16.2 hours** of downtime, and some respondents estimated losses above **$100,000 per hour**; organizations with more complete inventories reported faster recovery. The findings follow remote compromises of internet-facing PLCs at water systems in at least seven U.S. states, which disrupted monitoring or controls and degraded operations, with the FBI and EPA investigating potential Iran-backed involvement. AI is widely used to support analysts, but autonomous use remains limited: only **23%** reported using agentic AI for threat detection.
Sep 24, 2026