Living Off the Land in ICS/OT Cybersecurity
Summary: Dragos describes living off the land as adversary use of pre-existing, legitimate capabilities on a victim host and network, a technique most professionals associate with IT but which also works in OT through abuse of native HMI functionality and OT-specific automation control protocols. The post names activity groups that have used these tactics against OT networks: ELECTRUM pivoted from IT to OT via harvested credentials and exploited Microsoft SQL Server functionality to enable the CRASHOVERRIDE attack on a Ukrainian substation, while DYMALLOY and ALLANITE use captured credentials to pivot inside electric sector OT networks for long-term reconnaissance and XENOTIME used PSexec for remote execution and pivoting with dumped or captured privileged credentials.
What you should know: Attackers reach OT through stolen credentials and improperly configured networks, then operate with tools already present in the environment, which Dragos notes are less likely to be detected by traditional anti-virus. Dragos also states that most traditional security tools do not account for ICS protocols or the lack of patching in operations environments, leaving that ground to defenders who tune monitoring to their own environment.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026