The Hunt: Decoding Human Behavior in OT Threat Hunting
Summary: A Dragos OT Watch threat hunter describes hunting for human-driven behaviors in OT networks, including a case where a single host showed a 90-day anomalous spike in traffic to ad hoc file-sharing sites such as Pastebin, JustPasteIt, MediaFire and ZippyShare. The team also reports frequently finding "rogue" remote access tools left in OT networks by vendors or employees, or built into systems without the asset owner's knowledge.
Why it matters: Adversaries hide inside normal network noise and reuse tools already present, so the unknown answer to "why is this here?" is the exposure - and gaps in logging and network artifacts can leave an asset owner unable to prove or disprove the hypothesis either way.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026