What is OT malware?

What is OT malware?

Summary

OT malware is malicious software designed to target Operational Technology (OT) and Industrial Control Systems (ICS). Its goals range from changing how an industrial process runs to causing disruptive or destructive cyber-physical effects.

The article explains how OT malware differs from typical IT malware in impact and intent. Attackers may compromise management workstations or IT systems that bridge to OT, or they may target OT devices directly (for example, PLCs, HMIs and safety controllers). The post uses well-known incidents — Stuxnet, Havex, BlackEnergy, CrashOverride (Industroyer) and TRITON — to illustrate the threat and shows how IT-focused malware (EKANS, LockerGoga, BlackEnergy3) can still seriously affect OT by hitting workstations, stealing credentials or impeding recovery.

Key Points

• OT malware specifically targets control systems to alter processes or cause disruptive/destructive outcomes.
• Attack vectors include compromised management workstations, supply-chain compromises, malicious removable media and direct targeting of PLCs, HMIs or safety controllers.
• Notable examples: Stuxnet (PLC manipulation and stealth), Havex and BlackEnergy2 (reconnaissance and remote exploitation), CrashOverride/Industroyer (power grid attacks), TRITON (targeting safety controllers).
• IT malware can indirectly cripple OT: EKANS and LockerGoga affected operator/engineering workstations and production, while BlackEnergy3 enabled reconnaissance and follow-on OT attacks.
• NCSC guidance — the 10 Steps to Cyber Security and the Cyber Assessment Framework — provides a strong baseline to mitigate many OT malware threats.
• Practical mitigations include removable media controls, supply-chain security, network segmentation, host and network monitoring, privileged access management and timely patching where possible.
• Complete prevention of a determined adversary is unlikely; resilience matters: keep secure offline backups, test recovery plans and practise incident response.

Author

Ben H — ICS Technical Lead. Style: Punchy. The write-up is direct and focused on practical steps you can take.

Why should I read this?

Short and blunt — if you look after OT, ICS or critical infrastructure, read this. It pulls the essentials together: how attacks work, real-world examples and concrete mitigations (NCSC-backed) so you know where to focus efforts. We’ve saved you time by summarising the practical bits.

Source

Source: https://www.ncsc.gov.uk/blog-post/what-is-ot-malware