Most attacks on cyber-physical systems (CPS) follow a familiar pattern: phishing or a compromised supply chain provides initial access, attackers move laterally through the IT network, cross the IT-OT boundary, and then operate inside the OT environment. Stuxnet, Industroyer, and Triton are the most prominent examples. Alongside these multi-stage campaigns, a second and more direct attack form is growing: targeting CPS devices that are directly reachable from the internet, bypassing the IT network entirely.
The Five-Step Kill Chain of Direct CPS Attacks
1. Target selection: Attackers choose a specific device type, such as a PLC, HMI, or SCADA system. More often, they look for device classes that expose insecure services like VNC or Modbus.
2. Victim selection: Using scanning services like Shodan and Censys, which continuously monitor the IPv4 address space, attackers identify exposed devices. These are legitimate research tools that can be abused for malicious searches.
3. Enumeration: Attackers gather information depending on the planned attack vector. For Modbus-exposed devices, they use open-source clients to read registers and coils. For VNC, they try default credentials or run brute-force attacks.
4. Destruction: Parameters, values, or configurations are altered to take the device offline or cause physical effects on the system it controls.
5. Recognition: Attackers take screenshots of their actions and post them on social media or in closed channels to build credibility in hacker circles.
Drive-by Attacks as a Growing Threat
Traditional CPS attacks target specific facilities and try to stay undetected as long as possible. Recent research shows a trend toward opportunistic drive-by attacks, where targets are selected more randomly in regions that match the attacker's political motivation. Simple techniques often suffice instead of sophisticated exploits: default configurations, weak credentials, and insecure protocols provide enough of an opening.
What Security Teams Should Do
Every internet-connected OT device, smart device, and networked medical device needs a configuration review. Default credentials must be identified and changed. Fundamentally insecure protocols like VNC and Modbus should be replaced with secure alternatives wherever possible. The stakes with CPS are higher than with conventional IT: attacks can cause environmental damage and endanger human lives.