Listen to this Post
Introduction:
Water utility industrial control systems (ICS) and operational technology (OT) have become prime targets for cyber attackers, shifting from theoretical risks to documented, real-world incidents. From remote access abuse at the Oldsmar water treatment facility to insider-driven sewage spills in Maroochy Shire, these attacks expose critical weak points in the cyber-physical perimeter that security teams must map, understand, and mitigate using frameworks like the Cyber Kill Chain.
Learning Objectives:
- Analyze real-world water facility cyberattacks (Oldsmar, Maroochy Shire, Bowman Avenue Dam, Cyber Av3ngers) and extract their attack paths.
- Apply the Cyber Kill Chain framework to OT/ICS environments to identify detection and visibility gaps.
- Implement practical hardening commands, monitoring configurations, and vulnerability mitigation techniques for SCADA, PLCs, and remote access.
You Should Know:
- Remote Access Abuse & The Oldsmar Water Treatment Attack
In the Oldsmar, Florida attack (2021), an adversary gained remote access via a shared TeamViewer connection on a plant computer and attempted to raise sodium hydroxide levels to dangerous concentrations. The attack chain started with reconnaissance of remote desktop protocols (RDP) or remote access tools exposed to the internet.
Step‑by‑step guide to audit remote access in your OT environment:
Windows (target workstation or jump host):
Check for suspicious remote access logs and software installations:
List installed remote access software (TeamViewer, AnyDesk, LogMeIn, etc.)
Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -match "TeamViewer|AnyDesk|LogMeIn" }
Review Terminal Services/RDP logins (Event ID 4624 with Logon Type 10)
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4624} | Where-Object { $_.Properties[bash].Value -eq 10 } | Format-List TimeCreated, Message
Enable PowerShell logging for remote session detection
Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Name "EnableScriptBlockLogging" -Value 1
Linux (jump host or SCADA front-end):
Check for open remote access ports (SSH, VNC, RDP over X11) sudo netstat -tulpn | grep -E ':22|:5900|:3389' Audit recent SSH logins (success and failure) sudo journalctl -u ssh --since "1 hour ago" | grep "Accepted|Failed" Detect TeamViewer processes running on Linux (rare but possible) ps aux | grep -i teamviewer
Hardening measures:
- Deploy an OT‑specific VPN or a jump server with multi‑factor authentication (MFA) – never expose remote access tools directly to the internet.
- Use application whitelisting to block unauthorized remote software.
- Monitor outbound connections from OT workstations to unexpected external IPs (e.g., with Sysmon on Windows or `auditd` on Linux).
- Insider Threat & The Maroochy Shire Sewage Spill
The Maroochy Shire incident (2000) involved a former contractor using stolen radio control equipment to manipulate pumps and valves, releasing 800,000 liters of raw sewage. This was an insider attack leveraging legitimate access and knowledge of proprietary OT protocols.
Step‑by‑step guide to monitor insider actions in OT/ICS:
Linux – using auditd to track SCADA configuration changes:
Install and configure auditd sudo apt install auditd -y Monitor writes to PLC configuration files (example: /opt/scada/config/) sudo auditctl -w /opt/scada/config/ -p wa -k scada_config_change Track execution of engineering tools (e.g., ladder logic editors) sudo auditctl -a always,exit -F path=/usr/bin/iec61131 -F perm=x -k plc_programming Review audit logs for anomalies sudo ausearch -k scada_config_change --format text
Windows – PowerShell logging and SIEM rules:
Enable command line auditing for all processes auditpol /set /subcategory:"Process Creation" /success:enable /failure:enable Log PowerShell script blocks (to detect malicious automation) Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Name "EnableScriptBlockLogging" -Value 1 Forward logs to a centralized SIEM using WinRM or Sysmon Install-PackageProvider -Name NuGet -Force Install-Module -Name Sysmon -Force
Mitigation:
- Implement role‑based access control (RBAC) with strict separation of duties.
- Use digital signing for all PLC firmware and configuration uploads.
- Deploy user behavior analytics (UBA) to detect abnormal access times or unusual command sequences.
3. Internet-Exposed SCADA & Bowman Avenue Dam
In 2013, the Bowman Avenue Dam in New York was accessed via an internet‑exposed SCADA system using default credentials – no complex exploit needed. Attackers simply navigated to the web interface and logged in.
Step‑by‑step guide to discover and secure exposed OT devices:
Using Nmap to scan for SCADA/ICS protocols (Modbus TCP port 502):
Discover Modbus devices on a subnet nmap -sS -p 502 --script modbus-discover 192.168.1.0/24 Banner grab for Siemens S7 (port 102) nmap -sV -p 102 --script s7-info 192.168.1.100 Shodan CLI – find your own public IPs exposed with OT services shodan search "port:502,102,20000" --limit 100
Firewall rules to block inbound OT protocols from untrusted networks (Linux iptables):
Block Modbus TCP from external zones sudo iptables -A INPUT -i eth0 -p tcp --dport 502 -j DROP Allow only specific engineering workstation IPs sudo iptables -A INPUT -p tcp --dport 502 -s 192.168.10.50 -j ACCEPT
Windows Defender Firewall with PowerShell:
Block port 502 (Modbus) for public networks New-NetFirewallRule -DisplayName "Block_Modbus_Public" -Direction Inbound -Protocol TCP -LocalPort 502 -Action Block -Profile Public Allow only specific remote IPs for RDP (port 3389) New-NetFirewallRule -DisplayName "RDP_Allow_Only_Admin" -Direction Inbound -Protocol TCP -LocalPort 3389 -RemoteAddress 10.0.0.100,192.168.1.50 -Action Allow
Hardening checklist:
- Remove default credentials and enforce complex passwords.
- Place all SCADA HMIs and PLCs behind a dedicated OT firewall with allow‑list rules.
- Use network segmentation – DMZ for remote access, no direct routing to control network.
4. PLC Vulnerabilities & Cyber Av3ngers Attacks
The Cyber Av3ngers (Iranian threat group) targeted water utilities using known PLC vulnerabilities and manipulated HMIs to display threatening messages. They exploited unprotected programmable logic controllers, often accessible via default Modbus/TCP or proprietary protocols.
Step‑by‑step guide to test and mitigate PLC vulnerabilities (ethical lab only):
Simulating a Modbus command injection using Python (educational):
from pymodbus.client import ModbusTcpClient
Connect to a vulnerable PLC (replace with test IP)
client = ModbusTcpClient('192.168.1.200', port=502)
client.connect()
Write a large value to a holding register (coil) that controls chemical dosing
Address 100 might control pump speed – in real attack this could be 0xFFFF
client.write_register(100, 0xFFFF, unit=1)
Read back to confirm
result = client.read_holding_registers(100, 1, unit=1)
print(f"Register 100 = {result.registers[bash]}")
client.close()
Mitigation with Nmap script to detect insecure Modbus configurations:
Scan for devices allowing unrestricted writes nmap --script modbus-enumerate -p 502 <target> --script-args='modbus-enumerate.function_codes=write'
Hardening PLCs (vendor‑agnostic):
- Disable unused protocols (e.g., turn off Modbus/TCP if not needed, use serial instead).
- Implement deep packet inspection (DPI) firewalls that validate Modbus function codes – allow only read operations from HMIs, restrict writes to specific registers.
- Apply firmware patches for known CVEs (e.g., Rockwell, Siemens, Schneider Electric have regular OT bulletins).
- Use a PLC security gateway (e.g., Moxa, Tofino) that enforces whitelist rules for register addresses.
- Mapping Your OT Kill Chain – A Practical Template
The Cyber Kill Chain (reconnaissance → weaponization → delivery → exploitation → installation → C2 → actions on objectives) applies directly to OT. The post author Zakhar Bernhardt emphasizes mapping each real incident to this chain.
Step‑by‑step guide to build a kill chain matrix for your water plant:
- Reconnaissance: Run Shodan or Censys queries to see if your OT assets appear (use
shodan search net:YOUR_PUBLIC_CIDR). Document any exposed services. -
Weaponization: Assume an adversary crafts a malicious HMI script or Modbus payload. Use YARA rules to scan engineering workstations:
yara -r modbus_malware.yara /opt/engineering_tools/
-
Delivery & Exploitation: Monitor for spear‑phishing targeting OT engineers. On Windows, enable `Event ID 8222` for PowerShell download cradle detection. On Linux, log `execve` syscalls with auditd:
sudo auditctl -a always,exit -F arch=b64 -S execve -k command_execution
-
Installation & C2: Use Zeek (formerly Bro) to detect Modbus/TCP traffic to unexpected external IPs. Example Zeek script snippet for alerting on outbound port 502:
event connection_established(c: connection) { if (c$id$resp_p == 502 && c$id$orig_h !in private_ips) print fmt("Alert: Modbus traffic to external %s", c$id$resp_h); } -
Actions on objectives: Correlate with HMI audit logs. On Windows SCADA servers, enable SACL (System Access Control List) for process creation that triggers on `pump.exe` or
valve_control.exe.
Download the MITRE ATT&CK for ICS matrix (https://attack.mitre.org/matrices/ics/) and map your current detection coverage. Use the open‑source tool `ICS‑ATTACK‑Mapper` to generate a heatmap of missing controls.
- Defensive Hardening & Continuous Monitoring with Labshock Methodology
The post refers to “Labshock” as a full guide repository (join link: https://lnkd.in/e3Y2m-HF). You can implement similar continuous visibility using free tools.
Step‑by‑step OT monitoring stack (Linux + open source):
Install Wazuh (SIEM + XDR) with OT decoders:
Add Wazuh repo and install manager + agent curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | sudo apt-key add - echo "deb https://packages.wazuh.com/4.x/apt/ stable main" | sudo tee /etc/apt/sources.list.d/wazuh.list sudo apt update && sudo apt install wazuh-manager wazuh-agent
Configure custom Modbus rule (in `/var/ossec/ruleset/rules/`):
<group name="ot,modbus,"> <rule id="100100" level="12"> <if_sid>31103</if_sid> <field name="modbus.function_code">6|16</field> <description>Modbus write function (preset single register) detected</description> </rule> </group>
Windows agent to collect PowerShell logs and Sysmon events:
Deploy Sysmon via Wazuh agent & "C:\Program Files\Ossec-agent\agent_manager.exe" -c "sysmon -accepteula -i"
Cloud hardening for hybrid water SCADA (e.g., Azure IoT Edge):
– Use Azure Policy to enforce `Deny` for public network access on IoT hubs.
– Enable Defender for IoT (formerly CyberX) for asset discovery.
– Rotate SAS tokens every 24 hours and use certificate‑based authentication for field devices.
What Undercode Say:
- Key Takeaway 1: The same kill chain patterns repeat across water sector incidents – remote access abuse, exposed SCADA, insider misuse, and unpatched PLCs. Defenders must shift from reactive patching to proactive kill chain mapping and continuous monitoring of OT network behavior.
- Key Takeaway 2: Free and open‑source tools (Nmap, Zeek, Wazuh, auditd, PowerShell logging) provide enterprise‑grade visibility when properly configured. No need for expensive commercial OT security platforms to start closing detection gaps.
Analysis (10 lines):
The post by Zakhar Bernhardt underscores a critical reality: water utility cyberattacks are no longer hypothetical. The Oldsmar, Maroochy, Bowman Dam, and Cyber Av3ngers incidents each exploited a different phase of the Cyber Kill Chain – yet most plant operators still lack basic visibility into remote access logs, exposed Modbus ports, or insider behavior. By mapping each incident step‑by‑step, security teams can re‑examine their own environment: Is my SCADA interface on the internet? Can a former contractor still authenticate? Are write commands to PLCs logged? The provided commands and configurations offer a practical starting point for both Linux and Windows OT assets. Furthermore, the Labshock repository (linked) appears to be a valuable training resource, though users should verify its contents before deploying in production. Ultimately, the water industry needs mandatory incident reporting and routine kill chain drills – not just compliance checklists.
Prediction:
Within 24 months, AI‑driven OT malware capable of autonomous reconnaissance and multi‑stage impact (e.g., manipulating chemical dosages while hiding telemetry) will target water utilities. Regulatory bodies such as EPA and CISA will mandate real‑time OT monitoring and kill chain mapping for all critical water facilities, with non‑compliance penalties mirroring those in the energy sector. Cloud‑connected SCADA will become the new attack surface, pushing defenders to adopt zero‑trust for OT and routine adversary emulation exercises based on the real incidents documented above.
▶️ Related Video (62% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: Zakharb Water – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
