SC-014: OT Ransomware Attack — Municipal Water Treatment Plant¶

Threat Actor Profile¶

SYNTHETIC-INDUSTRIAL targets municipal water, wastewater, and small energy utilities. Unlike opportunistic ransomware groups, they conduct OT reconnaissance using public data (state environmental permits, SCADA vendor job postings) to identify targets where ransomware creates maximum public safety pressure. Their playbook: lock out HMI operators, manipulate historian data, and attempt PLC setpoint modification to escalate urgency. Demands: $1.5M–$4M in Monero. Dwell time: 7–12 days. They understand Purdue Model architecture and carry custom Modbus TCP reconnaissance scripts.

Scenario Narrative¶

Phase 1 — Initial Access: Spear Phishing & Credential Harvesting (~30 min)¶

A senior engineer at Municipal Water Treatment — SYNTHETIC-CITY (serving 250,000 residents) receives a phishing email impersonating the VPN vendor, linking to a cloned Fortinet login page at hxxps://vpn-update-syntheticcity[.]com. The engineer enters credentials, which are harvested. The attacker authenticates to the legitimate VPN using a real-time phishing proxy to relay SMS MFA. Entra ID logs show impossible travel: the engineer's plant session (Synthetic City) and the attacker's session (IP 198.51.100.47, Bucharest) within 8 minutes.

Evidence Artifacts:

Phase 2 — IT Network Compromise: Lateral Movement & Staging (~40 min)¶

Via VPN, the attacker runs SharpHound for AD enumeration and Kerberoasts svc_scada_backup (SPN: MSSQLSvc/SCADA-HIST-01.syntheticcity.local:1433). Password WaterPlant2023! cracked in 4 minutes. This service account has local admin on 6 systems including the SCADA historian and IT/OT jump server — a 3-year-old "temporary" configuration. The attacker deploys Cobalt Strike on file server FS-01 (10.20.2.10). Defender AV detects it but the alert is allowed due to a path exclusion on C:\ProgramData\Microsoft\Crypto\.

Evidence Artifacts:

Phase 3 — IT/OT Pivot: Crossing the DMZ (~45 min)¶

The attacker uses svc_scada_backup to RDP through the jump server (JUMP-01, 10.20.3.50) into the OT network. A critical misconfiguration: firewall rule EMERGENCY_MAINT_2024 permits any traffic from JUMP-01 to 172.16.100.0/24 — added 18 months ago during emergency maintenance and never reverted. Claroty detects anomalous RDP from JUMP-01 to SCADA-HIST-01 (172.16.100.10) at 02:47 UTC, outside the maintenance window.

Evidence Artifacts:

Phase 4 — OT Reconnaissance & HMI Ransomware (~45 min)¶

From SCADA-HIST-01, the attacker maps the OT environment: 3 HMI workstations (Wonderware InTouch, 172.16.100.20–22), 2 Allen-Bradley ControlLogix PLCs (172.16.100.30–31) for chemical dosing/filtration, 1 Siemens S7-1200 PLC (172.16.100.32) for pumps, and 1 Triconex SIS (172.16.100.40, accessible via misconfigured VLAN trunk).

On Day 9, ransomware waterlock.exe encrypts all HMIs and the historian simultaneously. Operators lose all visibility — chlorine, turbidity, flow, tank levels. PLCs continue on last setpoints, but operators are flying blind.

Evidence Artifacts:

Phase 5 — Safety System Impact: Chemical Dosing Manipulation (~40 min)¶

A time-delayed script on SCADA-HIST-01 fires 4 hours post-lockout. Modbus TCP writes (FC 6, FC 16) change the chlorine setpoint on PLC-01 from 2.0 mg/L to 8.0 mg/L — four times normal, exceeding EPA limits. The Safety Instrumented System (Triconex), operating on hardwired analog signals independent of the SCADA network, detects the deviation at 4.0 mg/L (high-high alarm) and automatically closes the chlorine injection valve at 07:22 UTC. Chlorine reached 3.8 mg/L before SIS activation — a near-miss.

Evidence Artifacts:

Phase 6 — Recovery & Reporting (~45 min)¶

ICS-CERT Advisory Format¶

CISA Reporting (CIRCIA)¶

Recovery Playbook (OT-Specific)¶

Detection Signatures (Synthetic)¶

alert modbus any any -> $OT_PLC_SUBNET any (
    msg:"Unauthorized Modbus Write to Chemical Dosing Register";
    modbus_func: 6,16; modbus_register: 40001;
    classtype:ics-write-unauthorized; sid:9014001; rev:1;
)

alert modbus any any -> $OT_PLC_SUBNET any (
    msg:"Modbus Device ID Enumeration Scan";
    modbus_func: 43;
    threshold:type both,track by_src,count 3,seconds 30;
    classtype:ics-recon; sid:9014002; rev:1;
)

alert tcp $IT_DMZ_SUBNET any -> $OT_SUBNET 3389 (
    msg:"Off-Hours RDP to OT Network";
    classtype:ics-unauthorized-access; sid:9014003; rev:1;
)

Evidence Artifacts:

ATT&CK for ICS Mapping¶

Detection Opportunities¶

Key Discussion Questions¶

1. SMS MFA was bypassed by a phishing proxy. What is the cost-benefit of FIDO2 hardware keys for a municipal utility with a limited IT budget?
2. Firewall rule EMERGENCY_MAINT_2024 persisted 18 months. What OT change management process — per IEC 62443 — prevents this?
3. The SIS saved the plant. What if it was also compromised (as in the TRITON/TRISIS attack)?
4. Can your operators run the plant manually for 72+ hours? When were manual procedures last tested?
5. At what financial pressure point does ransom payment override FBI guidance, and who decides for a municipal government?

Debrief Guide¶

What Went Well¶

• SIS operated correctly on hardwired analog signals — independent of compromised SCADA
• Claroty/Dragos detected IT/OT pivot and Modbus writes, providing forensic evidence
• Offline PLC backups (paper in fireproof safe) enabled integrity verification
• Operators had training to initiate manual operations

Key Learning Points¶

• Phishing-resistant MFA is non-negotiable — SMS/TOTP bypassed by real-time proxy; FIDO2 is the minimum
• Temporary firewall rules become permanent — implement automatic expiration, not just policy
• Service accounts are Kerberoasting targets — use gMSA with automatic password rotation
• SIS independence is the last line of defense — shared VLAN trunk was near-fatal; physical air-gap required per IEC 61511
• OT backups differ from IT — PLC logic: offline paper/USB; historian: air-gapped; HMI: rebuild from vendor media

Recommended Follow-Up¶

• [ ] Deploy FIDO2 keys for all remote access — eliminate SMS MFA
• [ ] Implement automatic firewall rule expiration for temporary OT access
• [ ] Migrate to gMSA for service accounts — eliminate static passwords
• [ ] Air-gap SIS physically — remove VLAN trunk
• [ ] Deploy EDR on all OT Windows systems
• [ ] 3-2-1-1-0 backup strategy with weekly air-gapped OT backups
• [ ] Quarterly manual operations drills — verify 72h manual capability
• [ ] Join WaterISAC for sector information sharing
• [ ] Annual ICS security assessment per IEC 62443

References¶

• Chapter 21: OT/ICS/SCADA Security
• Chapter 23: Ransomware Deep Dive
• Chapter 9: Incident Response Lifecycle
• Chapter 15: Resilience, Tabletops & Learning
• Chapter 7: Threat Intelligence & Context