Listen to this Post
Introduction:
Iranian state-sponsored actors (IRGC Cyber Electronic Command, tracked as CyberAv3ngers/UNC5691) are actively exploiting internet‑exposed Rockwell Automation/Allen‑Bradley PLCs without needing zero‑day vulnerabilities. By abusing legitimate engineering tools such as Studio 5000 and RSLinx, attackers manipulate industrial processes directly—a classic “living‑off‑the‑land” technique adapted for OT environments (OT‑LOLBins). With over 5,200 exposed devices globally, nearly 75% in the U.S., this campaign poses an immediate risk to water, energy, and government facilities.
Learning Objectives:
- Identify and enumerate internet‑exposed OT devices (Rockwell PLCs) using public data sources and network scanning.
- Detect OT‑LOLBin attacks by monitoring for unauthorized use of engineering software and anomalous industrial protocol traffic.
- Implement network segmentation, access controls, and continuous monitoring to mitigate adversary access to cellular‑connected PLCs.
You Should Know:
- Mapping the Attack Surface: Finding Exposed Rockwell PLCs
The initial reconnaissance step for adversaries—and defenders—is locating internet‑facing PLCs. Censys and Shodan index devices that respond on EtherNet/IP (port 44818) or Modbus (502). Below is a Python script using the Censys API to enumerate exposed Rockwell devices.
Step‑by‑step guide:
- Install the Censys Python library:
pip install censys. - Obtain API ID and secret from your Censys account.
- Run the script to query for `services.port = 44818` and
services.service_name = "EtherNet/IP".
from censys.asm import CensysAssets
import csv
api_id = "YOUR_API_ID"
api_secret = "YOUR_API_SECRET"
c = CensysAssets(api_id, api_secret)
Query for Rockwell devices
query = "services.port: 44818 AND services.service_name: 'EtherNet/IP' AND tags: 'rockwell'"
assets = c.search(query)
with open('exposed_plcs.csv', 'w') as f:
writer = csv.writer(f)
writer.writerow(["IP", "Location", "Organization"])
for asset in assets:
writer.writerow([asset.get('ip'), asset.get('location'), asset.get('autonomous_system')])
Linux command alternative using `nmap` (caution: only scan your own assets or with permission):
sudo nmap -p 44818 --script enip-info -Pn --open -iL plc_targets.txt -oA enip_scan
The `enip-info` script extracts vendor, device type, and serial number.
2. Adversary Infrastructure Analysis: Unmasking the Attack Launchpad
The Censys report identified a single multi‑homed Windows host (185.82.73.x, AS214036) with hostname `DESKTOP‑BOE5MUC` running RDP on port 43589. Defenders can hunt for similar artifacts in their own telemetry.
Step‑by‑step guide to detect and analyze such hosts:
- Scan for unusual RDP ports using `nmap` or
masscan:sudo masscan -p43589 185.82.73.0/24 --rate=1000
- Query Shodan for RDP certificates with the hostname pattern:
shodan search 'port:43589 hostname:"DESKTOP-BOE5MUC"' --fields ip_str,hostnames
- Windows defender hunting – Use PowerShell to check for inbound RDP connections on non‑standard ports:
Get-NetTCPConnection -LocalPort 43589 -State Listen | Select-Object LocalAddress,OwningProcess
Then resolve process name: `Get-Process -Id (Get-NetTCPConnection -LocalPort 43589).OwningProcess`
Forensic value: The presence of Rockwell Studio 5000, FactoryTalk, and RSLinx on this host confirms the adversary’s operational capability. Monitoring for installation of these tools on non‑engineering workstations is critical.
3. Detecting OT‑LOLBins: Unauthorized Engineering Software Execution
Since attackers use legitimate Rockwell executables, traditional signature‑based AV fails. Instead, focus on anomalous execution paths and command‑line arguments.
Step‑by‑step guide using Sysmon (Windows) and Event Logs:
- Install Sysmon with a configuration that logs process creation (
Event ID 1) for known Rockwell binaries:<Sysmon> <EventFiltering> <ProcessCreate onmatch="include"> <Image condition="end with">RSLinx.exe</Image> <Image condition="end with">Studio5000.exe</Image> <Image condition="end with">FactoryTalkGateway.exe</Image> </ProcessCreate> </EventFiltering> </Sysmon>
2. Deploy via Group Policy or endpoint management.
- Forward events to a SIEM and alert when these binaries run on:
– Domain controllers
– IT workstations (non‑engineering)
– Servers without Rockwell licensing
4. Linux‑based detection (if monitoring OT network traffic): Use Zeek to flag EtherNet/IP sessions originating from unexpected IP ranges.
zeek -C -r ot_traffic.pcap enip_log
cat enip.log | awk '{print $9}' | sort | uniq -c | sort -nr
Key indicator: Simultaneous login to a PLC via Studio 5000 from an IP address that also shows RDP activity on port 43589.
4. Hardening Rockwell PLCs: Practical Mitigation Steps
Most exposed devices (MicroLogix 1400, CompactLogix, Micro850) run outdated firmware without authentication for reading device information. Immediate actions below.
Step‑by‑step guide for MicroLogix 1400:
- Disable unused protocols via RSLogix 500 – navigate to Channel Configuration > Port 1 (Ethernet) and uncheck HTTP, FTP, and BOOTP.
- Change default passwords for the PLC’s user accounts. Use strong credentials (12+ chars, complex).
- Implement an access control list (ACL) on the upstream router/switch. Example for a Cisco IOS device:
access-list 100 deny tcp any any eq 44818 log access-list 100 deny udp any any eq 44818 log access-list 100 permit ip any any interface GigabitEthernet0/1 ip access-group 100 in
This blocks EtherNet/IP from the internet while allowing internal traffic.
- Firmware update – Check Rockwell’s Knowledgebase for the latest firmware for Micro850 (explicitly targeted). Use ControlFLASH tool.
For cellular‑connected PLCs (Verizon/AT&T/Starlink): Force all traffic through a VPN tunnel before reaching the PLC. Configure the cellular modem to accept only inbound connections from a specific VPN concentrator IP.
5. Network Segmentation for Field‑Deployed PLCs
With 62% of exposed devices on cellular networks, traditional perimeter firewalls are missing. Implement micro‑segmentation using VLANs and egress filtering.
Step‑by‑step guide using Linux `iptables` as a gateway for a pump station:
1. Assume the PLC has IP 192.168.1.10/24. The Linux gateway has two interfaces: `eth0` (cellular modem) and `eth1` (local OT network).
2. Block all inbound EtherNet/IP from the cellular interface except from authorized engineering VPN subnet (10.10.10.0/24):
iptables -A INPUT -i eth0 -p tcp --dport 44818 -j DROP iptables -A INPUT -i eth0 -p udp --dport 44818 -j DROP iptables -A INPUT -i eth0 -s 10.10.10.0/24 -p tcp --dport 44818 -j ACCEPT
3. Log dropped packets for monitoring:
iptables -A INPUT -i eth0 -p tcp --dport 44818 -j LOG --log-prefix "BLOCKED_ENIP: "
4. Windows Firewall alternative (for a Windows‑based ICS gateway):
New-NetFirewallRule -DisplayName "Block_ENIP_Internet" -Direction Inbound -Protocol TCP -LocalPort 44818 -Action Block -RemoteAddress "Any" New-NetFirewallRule -DisplayName "Allow_ENIP_VPN" -Direction Inbound -Protocol TCP -LocalPort 44818 -Action Allow -RemoteAddress "10.10.10.0/24"
- Threat Hunting for EtherNet/IP Anomalies with Wireshark & Zeek
Passive monitoring of port 44818 traffic can reveal adversary reconnaissance and unauthorized commands.
Step‑by‑step guide using Wireshark:
- Capture traffic on the OT network span port:
sudo tcpdump -i eth1 -s 0 -W 100 -C 100 -G 3600 -w enip_capture.pcap
2. Apply display filter for EtherNet/IP commands:
`enip` – shows all CIP messages.
For specific dangerous commands like “Download Program” (Service Code 0x10):
`enip.cip_service == 0x10`
- Export the list of source IPs that send multiple CIP commands within seconds:
tshark -r enip_capture.pcap -Y "enip" -T fields -e ip.src | sort | uniq -c | sort -nr
- Zeek script to detect abnormal upload/download of PLC logic (a sign of attacker retrieving project files). Append to
local.zeek:event enip_forward_open(c: connection, vendor_id: count, device_type: count, product_code: count, revision: count, status: count, serial_number: count, originator_vendor: count, originator_device_type: count, originator_product_code: count, originator_revision: count) { if ( status != 0 ) print fmt("ENIP connection error or command from %s", c$id$orig_h); }
Run Zeek: `zeek -C -r enip_capture.pcap local.zeek`
What Undercode Say:
- Systemic risk, not a niche vulnerability – Over 5,200 exposed PLCs, many in critical infrastructure, show that OT devices are routinely connected to the internet without compensating controls.
- Living‑off‑the‑land in OT is the new normal – Attackers don’t need exploits; they just need network access and legitimate engineering tools. Defenders must shift to behavior‑based detection and strict application whitelisting.
- Cellular and satellite connectivity creates blind spots – Traditional security monitoring misses field‑deployed PLCs. Organizations need VPN‑first architectures and passive network monitoring at the edge.
- Attribution is actionable – The adversary’s single Windows host with Rockwell toolchain is a goldmine for threat hunting. Tracking RDP on unusual ports and hostname patterns can uncover similar infrastructure globally.
Prediction:
Within 12 months, we will see a major incident at a water or energy utility resulting from these exposed cellular‑connected PLCs, leading to emergency regulations mandating disconnection of OT devices from the internet. Simultaneously, threat actors will commoditize OT‑LOLBins frameworks, making it trivial for ransomware groups to target industrial control systems without any specialized ICS knowledge. The only sustainable defense is a zero‑trust model for OT: every engineering tool, every user, and every network flow must be authenticated and authorized—regardless of origin.
▶️ Related Video (86% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Flavioqueiroz Otsecurity – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
