Industrial Control Systems (ICS) are the backbone of critical infrastructure: power, water, oil & gas, manufacturing, and more. This file covers the full ICS security landscape - basics, threats, exploits, major incidents, key vulnerabilities, standards, and the best resources.
Industrial Control Systems like SCADA, DCS, and PLCs—control everything from electricity generation to water treatment to factory automation. ICS environments:
| **US/UK/Global Water Utility PLC Hacks** | 2023–4 | Iran-affiliated and hacktivist groups target exposed PLCs BLAM, causing real outages | [Aon OT Report](https://www.aon.com/en/insights/cyber-labs/unveiling-the-dark-side-common-attacks-and-vulnerabilities-in-industrial-control-systems) |
- **[Stuxnet](https://en.wikipedia.org/wiki/Stuxnet):** Destroyed centrifuges by reprogramming Siemens PLCs.
- **[Triton/Trisis](https://www.dragos.com/blog/industry-news/trisis-malware/):** Sabotaged safety instrumented systems in petrochemical plants.
- **[Industroyer/CrashOverride](https://www.welivesecurity.com/en/eset-research/crashoverride-malware/):** Ukraine power grid malware (uses ICS protocols directly).
- **[EKANS/Snake Ransomware](https://www.dragos.com/blog/industry-news/ekans-ransomware-and-ics-operations/):** Ransomware with ICS service/process termination.
- **[INCONTROLLER](https://www.mandiant.com/resources/blog/new-state-sponsored-threat-activity-incontroller):** Modular, state-sponsored toolkit for Omron/Schneider PLCs.
- **[Fuxnet & FrostyGoop](https://www.dragos.com/knowledge-center/):** Latest 2024–2025 ICS malware—sensor and process disruption.
---
## Ransomware & Targeted OT Attacks
- **Ransomware up 46% in 2025:** [Honeywell 2025 OT Threat Report](https://industrialcyber.co/reports/new-honeywell-2025-cyber-threat-report-reveals-ransomware-surges-46-percent-with-ot-systems-as-key-targets/)
- **Groups:** Cl0p, Ransomhub, and others are increasingly OT-aware.
- **Attack vectors:**
- USB devices: [Proofpoint 2024 Report](https://www.proofpoint.com/us/blog/threat-insight/usb-borne-attacks-increase)
- **Geopolitics:** Ukraine war and US-China tensions fueling ICS attacks ([JPCERT 2025](https://blogs.jpcert.or.jp/en/2025/04/ics-conference2025.html))
- **Manufacturing:** 2/3 of ICS ransomware victims are manufacturing orgs ([Dragos 2024](https://www.dragos.com/knowledge-center/), [Honeywell 2025](https://industrialcyber.co/reports/new-honeywell-2025-cyber-threat-report-reveals-ransomware-surges-46-percent-with-ot-systems-as-key-targets/))
- **Disclosure:** SEC Form 8-K and new [CISA reporting rule](https://www.cisa.gov/resources-tools/directives/binding-operational-directive-22-01/) improving transparency.
- **Malware:** Repurposed older malware now dominates—little truly “new” malware, but attacks are more creative and critical.
- [Aon: Common Attacks and Vulnerabilities in ICS](https://www.aon.com/en/insights/cyber-labs/unveiling-the-dark-side-common-attacks-and-vulnerabilities-in-industrial-control-systems)
- [Rockwell: What is ICS Security?](https://www.rockwellautomation.com/en-in/company/news/blogs/what-is-ics-security.html)
- [Vumetric: ICS Security Best Practices](https://www.vumetric.com/blog/ics-security-best-practices/)
> _This guide integrates case studies, threat intelligence, high-impact malware, critical vulnerabilities, and best practices, your single reference for research, defense, or investigation in ICS environments._
