Practical Considerations for Legacy Commodity Malware Cleanup in OT
Summary: Dragos researchers Lesley Carhart and Jan Hoff report a sharp rise in incident response requests for legacy infections including Sality, Gammima, WannaCry, and Conficker in OT networks, with many affected networks carrying 20-70 discrete commodity malware variants across multiple subnets. They attribute the increase to more networking and remote access exposing industrial systems, better network visibility, and regulation requiring critical infrastructure networks stay clean, and note many of these systems predate Windows XP SP2 and cannot support real-time antivirus or agent installations.
Key Takeaway: Cleanup in these environments means network segmentation and slow manual work on operating systems older than many analysts, and leaving the malware in place drains resources on already-failing hosts that must stay stable for safe operations.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026