Pivoting Between Corporate IT and OT Networks with Network Shell
Summary: Dragos describes a penetration test in which its team, holding domain administrator access, used the built-in Windows Netsh utility to create a port-proxy firewall rule on a host in a "SCADA Security" group, listening on port 49897 and forwarding RDP traffic from the corporate network to an OT/SCADA DMZ asset at 10.10.10.25 on port 3389. The blog cites 2021 Dragos service engagements in which 77% included a finding about improper network segmentation and 44% included a finding about shared credentials between IT and OT systems.
Why it matters: The pivot worked because firewall rules trusted static IP addresses and a single group held RDP rights into the OT DMZ, and the resulting listener on port 49897 sits among the ephemeral ports Windows normally uses, so a quick review of listening ports is unlikely to flag it.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026