The Renaissance Of Cyber Physical Offensive Capabilities

This talk, given by a Mandiant cyber-physical researcher, starts with the recent history of attacks on operational technology. It places the last few years in a period of change, after the 2022 conflict in Ukraine, when attacks on industrial control systems became more frequent and less specialised than the rare, bespoke cases of the past.

The main case study is Cosmic Energy, a piece of malware found through threat hunting in a malware analysis sandbox. It talks to industrial equipment over the IEC 60870-5-104 protocol to send switching commands to remote terminal units, and it is split into two modules. The sample contained a logic error that made it erase itself too early, which the researchers fixed with a small change. Its code shares features with the earlier Industroyer and Industroyer2 tools, and the name "Solar Polygon" pointed to a Russian cyber training range. The speaker presents that attribution as a likely but unconfirmed link. Leaked contractor documents that asked for tooling covering rail and oil and gas were used to discuss how such capabilities are being bought and built.

The talk closes with hunting advice. Insecure-by-design protocols and public libraries make reuse easy, Python is an unusual find in tightly controlled engineering networks, and MS SQL servers that bridge IT and OT are a useful place to look. The speaker's view is that barriers to building OT tooling are falling, mainly for nation states, while activists and ransomware groups are not yet at that level. A closing Q&A touched on how much the baseline of OT environments helps spot anomalies.