INDIA & SAARC MANUFACTURING SECTOR

MITRE Techniques

• [T1566 ] Phishing – Used as a leading initial-access vector and for spear-phishing campaigns against manufacturing targets. [‘Phishing remains a leading initial-access vector’ and ‘Spear-phishing’]
• [T1078 ] Valid Accounts – Used for persistence, privilege, and lateral movement after access is gained. [‘identity compromise and valid-account abuse are becoming increasingly important for persistence, privilege, and lateral movement’]
• [T1199 ] Trusted Relationship – Used through vendor and OEM compromise to obtain trusted access into plant networks. [‘Vendor and OEM compromise enables trusted access into plant networks’]
• [T1021 ] Remote Services – Used via exposed remote-access services and vendor/OEM pathways to reach manufacturing networks. [‘exposed remote-access services’ and ‘Exposed OT remote-access gateways remain a persistent weakness’]
• [T1210 ] Exploitation of Remote Services – Used to abuse exposed OT remote-access gateways and other externally reachable services. [‘Exposed OT remote-access gateways remain a persistent weakness’]
• [T1068 ] Exploitation for Privilege Escalation – Used where compromised credentials or misconfigured services help attackers expand access in converged IT/OT environments. [‘a compromised credential or misconfigured service can create a potential pathway toward plant-floor environments’]
• [T1090 ] Proxy – Used indirectly through vendor-connected access paths and intermediary footholds that broker access into target environments. [‘access is increasingly brokered rather than developed in-house’]
• [T1027 ] Obfuscated Files or Information – Referenced through living-off-the-land and stealth-oriented intrusion tradecraft that reduces obvious malware dependence. [‘Living-off-the-land & automation’]
• [T1105 ] Ingress Tool Transfer – Implied in supply-chain compromise and brokered access operations that enable delivery of attacker tooling into target environments. [‘supply chain compromise’ and ‘access is increasingly brokered’]
• [T1486 ] Data Encrypted for Impact – Used in double-extortion ransomware operations against manufacturers. [‘encryption combined with data theft and leak-site pressure’]
• [T1567 ] Exfiltration to Cloud Storage – Used conceptually in double-extortion operations involving theft and leak-site pressure. [‘data theft and leak-site pressure’]
• [T1047 ] Windows Management Instrumentation – Referenced under living-off-the-land execution across converged IT/OT networks. [‘living-off-the-land (LotL) execution’]
• [T1133 ] External Remote Services – Used by threat actors leveraging vendor VPNs and remote monitoring tools. [‘Abuse of vendor VPNs & remote monitoring tools’]
• [T1018 ] Remote System Discovery – Supported by AI-assisted reconnaissance and broader target mapping of manufacturing networks. [‘AI-assisted reconnaissance’]