Microsoft alerts of increasing Cyberattacks Against Internet-Exposed OT Devices

After a wave of cyberattacks that have been attacking operational technology (OT) environments since late 2023, Microsoft has underlined the importance of safeguarding these devices while they are connected to the internet.

Microsoft has alerted of increasing cyberattacks targeting internet-exposed Operational Technology (OT) devices. These devices, often used in critical infrastructure and industrial environments, are becoming prime targets for cybercriminals.

The Microsoft Threat Intelligence team stated that these persistent attacks against OT devices highlight the critical need to strengthen the security posture of OT devices and prevent critical systems from becoming easy targets.

The alert emphasizes the need for enhanced security measures to protect OT devices from potential breaches, which could have significant implications for safety and operations.

A cyberattack on an OT system could transfer control over these critical parameters to attackers and enable malicious alteration that could result in malfunctions or even complete system outages, either programmatically via the programmable logic controller (PLC) or using the graphical controls of the human machine interface (HMI).

Adding to the potential damage of attacks on OT systems are their often-lacking security measures, which make OT attacks not only attractive for attackers but also relatively easy to execute. Many OT devices, notwithstanding common security guidelines, are directly connected to the internet, making them discoverable by attackers through internet scanning tools.

Once discovered by attackers, poor security configurations, such as weak sign-in passwords or outdated software with known vulnerabilities, could be further exploited to obtain access to the devices.