Why Adversaries Target VPN Appliances: The Pathway from IT to OT Cyber Attack
Summary: Dragos identified malicious activity targeting multiple critical North American infrastructure networks, mainly in electric, oil and gas, water and wastewater, and manufacturing, focused on initial access to Cisco SSL VPN, Fortinet VPN, and Palo Alto Global Protect VPN appliances. The adversary used a mix of random and genuine employee information, including former employee credentials, in the login attempts, and Dragos cites its 2023 OT Cybersecurity Year in Review finding that 70 percent of OT attacks started in IT systems.
Key Takeaway: The login attempts are early-stage reconnaissance, but the same credentials that open a VPN can carry an adversary from IT into OT systems that run physical processes in energy and water.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026