Three security developments from 5–11 October began outside the production process but could still create a path toward operational systems.
An active campaign targeted internet-facing VPN gateways. Critical vulnerabilities were disclosed in energy-monitoring software. A separate espionage campaign used a fake recruitment exercise to target a technical professional connected to critical infrastructure.
Together, they show why OT security must cover the full route to an industrial asset: the identity, workstation, access gateway, supporting software, session and final connection.
TL;DR
- US authorities warned that attackers are compromising internet-facing VPN gateways with leaked credentials and password attacks.
- Attackers have created persistent accounts, locked out administrators and supplied access to ransomware affiliates.
- Critical vulnerabilities in energy-monitoring and historian software could enable remote code execution or administrative access.
- A critical-infrastructure professional was targeted through a weaponized developer project disguised as a recruitment test.
- New NSA guidance recommends continuously verifying users, devices, workflows and communications in OT environments.
What does the VPN gateway campaign mean for OT security?
On 6 October, the FBI and U.S. Secret Service issued an advisory about an active global credential-compromise campaign targeting internet-facing firewalls and SSL VPN gateways.
The attackers are using leaked or reused credentials, password spraying and brute-force techniques. After gaining access, they can create new administrative accounts, change or delete existing accounts and attempt to move further into the victim’s network. U.S. authorities have also linked access obtained through the campaign to ransomware affiliates.
The affected technology provider says the activity is not the result of a newly disclosed product vulnerability. Its assessment points instead to credentials obtained in earlier incidents, weak password practices and absent multifactor authentication.
This distinction matters. Applying the latest software update will not remove an unauthorized account, revoke a stolen API key or identify changes already made to the gateway configuration.
Read more about how VPNs compare with OT-specific remote access.
Why does this matter for industrial organizations?
External access gateways often support maintenance, engineering and vendor service. Losing administrative control can therefore affect both cybersecurity and the organization’s ability to respond to operational problems.
Where suspicious activity is found, the gateway should be treated as potentially compromised. Response should include:
- Terminating active administrative and VPN sessions
- Resetting credentials and reviewing MFA coverage
- Validating every administrative account and API key
- Comparing the configuration with a known-good version
- Reviewing authentication and network logs for lateral movement
- Confirming which OT assets were reachable through the gateway
Sources: FBI and U.S. Secret Service advisory; provider incident-response guidance
Why are energy-monitoring systems privileged OT infrastructure?
On 8 October, CISA published an advisory covering six vulnerabilities in open-source software used to process and archive electrical-grid measurements.
The findings include an unsafe-deserialization flaw that could allow unauthenticated remote code execution and a hard-coded administrative credential in a published container image. Both have CVSS 3.1 scores of 9.8.
Supported installations can be updated. However, CISA warns that older network-interface settings can remain in place when an existing installation is upgraded. Operators must therefore verify the resulting configuration instead of assuming the new default has been applied.
The published container image does not have a complete fix and is not recommended for production use. CISA reported no known public exploitation when it issued the advisory.
Why does this matter?
Monitoring and historian systems often sit between field data, engineering teams and analytical applications. They may not directly control a process, but they can still expose operational topology, provide a route between networks or undermine confidence in the information used for operational decisions.
A remediation plan should confirm:
- The exact software version and deployment model
- Which interfaces and services remain reachable
- Whether old network bindings survived the upgrade
- Whether container images are used in production
- How the system is backed up and recovered
- Whether monitoring can detect unauthorized access or configuration changes
Sources: CISA industrial-control-system advisory; CISA machine-readable advisory
Why are developers and service engineers attractive targets?
Research published during the week described an Iranian-aligned campaign targeting an individual believed to work in Iraq’s critical-infrastructure sector.
The attacker impersonated an airport recruitment team and sent a tailored software-development exercise. Loading the project could trigger malware execution, deploy remote-access tools and establish an encrypted tunnel into the victim’s environment.
The malware used a legitimate cloud-development platform for command-and-control traffic, helping it blend into normal enterprise activity.
The researchers assessed an Iranian nexus with high confidence. However, the public evidence does not confirm that the intended target was successfully compromised, that an industrial organization was penetrated or that OT operations were affected.
Why does this matter?
Developers, automation engineers and service technicians often have access to engineering tools, customer environments and industrial assets. Their workstations can become an indirect route into several operational environments.
Organizations should review how technical personnel:
- Receive and open external projects or engineering files
- Test software, firmware and customer configurations
- Connect from their workstation to industrial assets
- Separate development activity from remote service
- Authenticate to different customer environments
- Report suspicious recruitment or collaboration requests
Source: original technical analysis
What does the latest OT guidance recommend?
NSA published new guidance on 8 October recommending that OT operators continuously verify users, devices, workflows and communications. The aim is to limit unauthorized access, lateral movement and persistence.
The guidance is primarily intended for U.S. defense environments, but NSA says the principles can also support wider critical-infrastructure security.
In Europe, an ENISA-supported energy forum reached a related conclusion: implementing NIS2 and the EU Network Code on Cybersecurity is necessary, but formal compliance must be supported by independent testing, vulnerability management, information sharing and operational exercises.
The forum included a demonstration showing how an attacker who had already compromised a home router or camera could communicate with solar inverters or batteries using unauthenticated protocols. Coordinated manipulation of many distributed devices could potentially affect grid stability.
This was a research demonstration, not a reported active attack, and the forum did not introduce new legal obligations.
Previous guidance on industrial integrators also shows why organizations need to control third-party OT access as an operational dependency.
Sources: NSA OT guidance; European energy forum findings; ENISA event overview
How should OT leaders respond?
- Map external access to individual assets. Identify every firewall, VPN, edge gateway, tunnel proxy and vendor-managed connection that can lead toward production.
- Assess compromise, not only patch status. Review sessions, accounts, API keys, configurations and audit logs when an exposed gateway may have been accessed.
- Treat supporting platforms as privileged infrastructure. Include historians, monitoring tools, engineering workstations and remote-service systems in OT risk and recovery planning.
- Limit standing vendor access. Use asset-level permissions, named ownership, MFA, time-bound approval and prompt revocation.
- Test continuity when access is removed. Confirm that critical operations and approved support can continue when a gateway, identity service or vendor connection must be disabled.
How does governed external access support operational resilience?
External remote access remains essential for maintenance, troubleshooting and fast expert support. The goal is to make every connection controlled, limited and traceable.
A governed approach combines enterprise identity with control at the industrial asset. An OT edge gateway and tunnel proxy can restrict a vendor to the required asset instead of exposing a wider production network. Approval workflows, session recordings and audit logs then provide evidence of who connected, why access was granted and what occurred during the session.
For manufacturers, this supports vendor access governance and business risk reduction. For machine builders, it helps customers approve remote service while supporting faster issue resolution and long-term customer trust.
No single access control can prevent every credential theft or endpoint compromise. Its value lies in limiting reach, improving visibility and making access easier to revoke when risk changes.
Frequently asked questions (FAQ)
Frequently asked questions (FAQ)
Is patching a compromised VPN gateway enough?
No. Organizations should also terminate sessions, reset credentials, remove unauthorized accounts and API keys, validate the configuration and investigate possible lateral movement.
Why are OT historians security-sensitive?
Historians and monitoring systems connect operational data with engineering and business applications. Compromise can expose topology, affect data integrity or provide a route between systems.
Should third-parties receive permanent OT access?
Standing access increases exposure. Access should be limited to the required assets and duration, with clear ownership, approval, authentication and audit logs.
How does Zero Trust apply to OT?
In OT, Zero Trust supports operational resilience by requiring verification of the user, device, workflow and requested asset. It should reinforce asset-level access control rather than remain an identity-only initiative.
