If you’re only hunting for malware in OT, you’re late.

Assume the move is quiet access.

Nation-state pre-positioning rarely looks like a dramatic intrusion. It often blends into normal admin work: a new remote account, a service tool update, an engineer “helping” with a config change, a vendor connection that never fully goes away.

Then it sits dormant for months.

That dormancy is the point. It gives adversaries optionality when geopolitics shifts: the ability to disrupt, degrade, or coerce on demand, without having to break in under pressure.

Treat this as an access-governance and detection design problem, not a compliance checklist.

Practical tripwires to make stealthy persistence noisy:
– Engineering workstation use: baseline who uses them, when, and for what; alert on rare tools, rare hours, and rare targets
– Remote maintenance: enforce identity, strong session controls, and record/review remote sessions; alert on “always-on” connectivity patterns
– Privilege changes: monitor group membership, new local admins, new service accounts, and credential use across zones
– Identity-to-asset mapping: know which identities can reach which PLCs/HMIs/historians, and make exceptions visible

If an attacker’s best strategy is to remain invisible, your best defense is to make access changes observable.

#OT #ICS #CriticalInfrastructure #CyberSecurity #ThreatHunting #ZeroTrust #IdentitySecurity #IndustrialSecurity