Responding to the Solar Winds Software Compromise in Industrial Environments
Summary: The SolarWinds supply chain compromise delivered affected software to 18,000 organizations, with follow-on adversary activity publicly supported in the dozens, and in compromised Orion instances the adversary had uncontested access as early as October 2019. Dragos notes that Orion installations in ICS/OT environments may poll SNMP on field equipment or PLCs at Purdue Level 1 or Level 2, and that permissive firewall rules or SNMP traps allowing data value changes could permit direct interaction with or modification of those devices.
What you should know: For OT networks, checking indicators of compromise is insufficient: without monitoring and centralized logging going back 9+ months, Dragos says to assume compromise and hunt, and among nearly 2,000 NERC CIP-regulated power utilities some were likely affected directly or through vendors with access to Bulk Electric System systems.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026