Energy Disruption in UK Critical Infrastructure and the Growing OT Cyber Threat

MITRE Techniques

• [T1190 ] Exploit Public-Facing Application – The article describes attacks on internet-facing PLCs and remote-access systems, which implies exploitation of exposed services (‘internet-accessible PLC and HMI systems’, ‘internet-connected PLCs’).
• [T1021 ] Remote Services – Attackers may have leveraged remote-management pathways or VPN-style access to reach energy environments (‘remote access’, ‘remote sessions’, ‘remote-management infrastructure’).
• [T1133 ] External Remote Services – The text repeatedly highlights externally reachable OT assets and remote access through gateways and VPN appliances (‘externally reachable OT assets’, ‘VPN appliances’, ‘remote access should be routed through controlled gateways’).
• [T1005 ] Data from Local System – The article mentions attackers changing PLC passwords, IP configurations, and potentially controller project files, indicating interaction with local device settings (‘changing passwords and IP configurations’, ‘monitor changes to PLC configuration, passwords, IP addresses, project files’).
• [T1562 ] Impair Defenses – The incident may have involved containment actions or manipulation of access paths that reduced availability, and the article stresses attacker disruption of monitoring/control (‘loss of monitoring or control’, ‘taken offline as part of containment’).
• [T0881 ] Modify Controller Tasking – The article notes the possibility of direct manipulation of PLC logic or generation equipment, though not confirmed (‘whether attackers directly manipulated generation equipment, PLC logic’).
• [T0842 ] Network Denial of Service – The outage is described as operational unavailability that could have resulted from disruption rather than direct physical control (‘resulted in, or contributed to, several days of operational unavailability’).
• [T1082 ] System Information Discovery – Reported activity included reconnaissance of connected systems and equipment scope expansion (‘targeted reconnaissance’, ‘expanded the observed equipment scope’).
• [T1580 ] Obtain Capabilities – The article describes adversaries developing capability against PLCs and using AI-generated exploitation scripts (‘capability development’, ‘AI-generated exploitation scripts disguised as legitimate monitoring tools’).
• [T1595 ] Active Scanning – The mention of internet-facing and exposed controllers implies scanning and identification of reachable OT assets (‘internet-facing Rockwell Automation MicroLogix PLCs’, ‘externally reachable OT assets’).