Implications of IT Ransomware for ICS Environments
Summary: Dragos traces how ransomware has reached ICS environments in waves: wormable malware like WannaCry, NotPetya, and BadRabbit spread from IT networks via the MS17-010 SMBv1 exploit or captured credentials, followed by more deliberate attacks such as Ryuk in 2018 and LockerGoga in 2019, which used persistent access and compromised legitimate services. The article notes that the only example of ICS-targeting ransomware is a 2017 proof-of-concept never observed in the wild, and that IT-ICS links such as historian data flows to business intelligence systems and federated Active Directory were the paths that carried infection into control system networks.
What you should know: The article argues that detecting ransomware is nearly worthless as a defense, since victims detect it when files are encrypted anyway, and that EDR or aggressive antivirus in ICS environments can introduce risk by quarantining legitimate files. The real exposure sits in the operational links between IT and ICS that were designed for business convenience, and Norsk Hydro's March 2019 LockerGoga response shows the operational pain required to keep production running once such a link is exploited.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026