Hacker or Engineer? Reconstructing Attack Chains in Industrial OT Networks

Positive Technologies expert Anton Kutepov, head of the company’s Industrial Expertise Center, explains how to reconstruct an attack chain in technological networks using a realistic educational scenario reproduced on the Standoff online polygon.

The scenario starts at 14:23 when a SCADA server of a hydrocracking unit writes a new value to a PLC. The command occurs outside any scheduled technological window, immediately raising questions for the security team. Although the connection uses a standard industrial protocol and the write operation itself is permitted by system logic, the timing and lack of prior similar activity make the event suspicious.

Reversing the timeline reveals the full attack path. Shortly before the PLC write, Windows Defender was disabled on the SCADA server to extract credentials from memory. The attacker reached the SCADA server via RDP after first compromising an engineering workstation, performing local reconnaissance, and harvesting credentials. That workstation had been accessed from an administrative host in the corporate network, where the attacker had already established domain persistence, escalated privileges, and abused Active Directory certificate services.

The chain began with the exploitation of a vulnerable system in the DMZ. After gaining initial access, the attacker established a reverse SSH tunnel, performed reconnaissance, attempted mass SMB connections, and moved laterally into the corporate domain. From there the attacker used legitimate administrative channels to cross into the OT segment, eventually reaching the SCADA server and issuing the control command.

The case illustrates that a permitted operation on an industrial protocol can still represent an attack when the preceding context—defensive control changes, unusual access routes, and credential abuse—is taken into account. Effective detection therefore requires correlation of network traffic, endpoint telemetry, authentication logs, and a continuously updated asset model rather than reliance on any single data source.