Legacy OT malware cleanup needs risk-based decisions, not IT playbooks

At a glance

What this is: This is Dragos’ analysis of why legacy commodity malware persists in OT environments and why removal decisions must be risk-based rather than copied from enterprise IT playbooks.

Why it matters: It matters because OT teams have to balance containment, safety, uptime and regulatory obligations when legacy malware is embedded in long-lived infrastructure.

Context

Legacy malware in OT is a governance problem as much as a technical one. Older industrial systems often cannot support modern endpoint agents, cannot be modified freely, and may sit inside networks where even a well-intentioned cleanup can destabilise operations.

The core issue is not whether the malware is old, but whether the environment can absorb the disruption of removing it. For identity and access practitioners, the intersection shows up in remote access exposure, network segmentation and the controls that limit lateral movement across legacy estates.

Key questions

Q: What breaks when legacy malware cleanup is treated like enterprise IT remediation in OT?

A: The assumption that infected systems can be reimaged, instrumented and restored quickly often fails in OT. Many industrial assets cannot support modern agents, cannot be modified outside safe parameters and may be too tightly coupled to operations for disruptive cleanup. That means the remediation model itself can become a source of instability if it ignores plant constraints.

Q: Why can immediate malware removal increase risk in industrial environments?

A: Immediate removal can increase risk when the infection is deeply embedded, the scope is uncertain or the cleanup requires shutdowns that affect safety and availability. If any infected host, share or subnet is missed, the malware can return quickly. In OT, the wrong cleanup can create more operational harm than the infection did.

Q: What signs tell OT teams that legacy malware needs a planned maintenance-window cleanup?

A: Look for infections that are contained but persistent, systems that still support operations, and environments where segmentation or host changes are possible only through controlled maintenance. That pattern suggests the right answer is not panic remediation, but a scoped project plan that removes spread paths without forcing an unsafe outage.

Q: When should organisations choose to leave legacy malware in place temporarily?

A: That choice is reasonable when removal would endanger safety, availability or critical processes more than the infection itself, and when the malware’s behaviour is understood well enough to monitor it safely. The decision should be time-bound, documented and tied to replacement or future remediation, not treated as permanent acceptance.

Technical breakdown

Why legacy malware persists in OT networks

Commodity malware remains viable in OT because many industrial environments combine long-lived systems, remote access exposure and limited host-side remediation options. Unlike enterprise endpoints, these assets may predate modern antivirus, cannot easily be reimaged, and must be changed only within certified-safe parameters. That creates an environment where detection may improve faster than eradication. The result is a persistent infection surface made up of aging systems, flat subnets and operational constraints rather than attacker sophistication.

Practical implication: Treat legacy infection persistence as a systems constraint problem and scope it before deciding on removal.

Why enterprise cleanup models fail in industrial environments

Enterprise cleanup assumes agent deployment, rapid isolation and straightforward restoration from backups. OT often lacks those assumptions. Shutdowns can affect safety, availability and vendor support, while unsupported operating systems and embedded devices may not tolerate standard remediation tools. In practice, cleanup becomes a combination of segmentation, manual verification and coordinated work with engineering stakeholders. That makes the control problem one of operational compatibility, not just malware detection.

Practical implication: Build cleanup plans around plant constraints, not enterprise endpoint workflows.

How risk-based malware removal works in OT

The article’s Now, Next, Never framing is really a decision model for operational risk. Immediate cleanup is justified only when the infection threatens safety, compliance or process continuity enough to outweigh outage risk. Delayed cleanup uses maintenance windows, scoping, policy changes and host or network controls to reduce future spread. In some cases, leaving malware in place temporarily is the least risky option if removal could destabilise the process and replacement is pending.

Practical implication: Use a scoped risk assessment to choose between immediate removal, deferred cleanup or monitored containment.

Threat narrative

Attacker objective: The objective is broad persistence and propagation across vulnerable industrial systems rather than a single high-value exploit.

1. Entry occurs through long-lived legacy OT exposure, including remote access and older systems that are easier for commodity malware to reach and persist on.
2. Privilege is not the main story here, but spread is enabled by flat legacy subnets, weak segmentation and systems that cannot easily be modified or reimaged.
3. Impact comes from repeated infections, wasted recovery effort and the possibility that cleanup itself destabilises operations or creates a second propagation cycle.

Breaches seen in the wild

• CircleCI breach 2023: Malware stole a CircleCI engineer's SSO session; attackers exfiltrated customers' CI/CD secrets and keys, forcing a platform-wide rotation.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Legacy OT malware is primarily a governance and operational compatibility problem. The wrong remediation model fails because industrial assets do not behave like managed enterprise endpoints. In these environments, the critical question is not whether malware exists, but whether the environment can support safe removal without breaking production. Practitioners should treat remediation feasibility as part of security governance, not as an afterthought.

The real control gap is assuming cleanup is always lower risk than containment. In OT, that assumption can be wrong. If infection scoping is incomplete, or if removal requires unsupported host changes, remediation can trigger a fresh propagation cycle or operational instability. Security and engineering leaders need shared decision criteria that weigh safety, uptime and compliance together.

Legacy malware makes network segmentation and remote access discipline more important than host tooling. When endpoint agents cannot be deployed, the compensating controls shift to reducing lateral movement paths, constraining removable media and limiting cross-subnet spread. That is a familiar control pattern in industrial environments, and it aligns with the broader principle that access pathways matter more than retrospective cleanup when systems are old. The practitioner conclusion is to govern exposure first, then decide on removal.

Now, Next, Never is a practical concept for OT remediation strategy. The article sharpens a useful notion: cleanup timing is itself a control decision. Not every infection should be removed immediately, and not every infection should be left alone. Teams need a formal risk threshold for when disruption is acceptable, when maintenance-window remediation is safer, and when monitored coexistence is the least harmful option. The practitioner takeaway is to make remediation timing explicit, documented and cross-functional.

What this signals

Legacy OT remediation is really a control-design problem. When endpoint agents and standard reimaging are unavailable, the most effective controls shift upstream to segmentation, exposure reduction and careful scoping. Teams that still measure success only by eradication speed will miss the more important question of whether the environment can tolerate the cleanup at all.

Risk acceptance needs a documented end state. Leaving malware in place can be defensible, but only when the decision is bounded by monitoring, maintenance planning and replacement milestones. Without that structure, temporary coexistence becomes permanent technical debt and the infection remains part of the operational risk profile.

For practitioners

• Define a risk threshold for immediate OT malware cleanup Classify infections by operational, safety and compliance impact before choosing immediate shutdown and removal. Make the threshold explicit so teams do not default to IT-style reimaging when process stability is at stake.
• Scope legacy infections before any remediation step Map affected hosts, shares and subnets first, because incomplete scoping can leave a reinfection path in place and force repeated cleanup cycles.
• Reduce lateral movement paths in legacy OT segments Tighten segmentation, restrict common lateral movement ports and protocols, and remove unnecessary Windows features where change control allows it.
• Plan cleanup around maintenance windows and vendor constraints Coordinate with engineering and equipment vendors so remediation steps fit certified-safe parameters and do not depend on unsupported endpoint tooling.
• Decide when monitored containment is safer than removal If malware removal creates greater process risk than coexistence, document the decision, monitor the infection and tie it to the system replacement plan.

Key takeaways

• Legacy OT malware persists because industrial systems often cannot be cleaned with standard enterprise endpoint methods.
• The key decision is not whether malware is old, but whether removal would create more operational risk than containment.
• Practitioners should use scoping, segmentation and maintenance-window planning to decide between immediate removal, deferred cleanup or monitored coexistence.

Key terms

• Operational Technology Malware: Malware that targets industrial and process-control environments rather than standard office IT. In OT, the defining issue is often persistence and operational disruption, because the infected asset may be old, hard to patch and tightly coupled to safety or production processes.
• Maintenance-Window Remediation: A planned cleanup approach that waits for an approved outage or service window before removing malware and tightening exposure. It is used when immediate eradication would create more operational risk than temporary containment, especially in legacy environments with limited host tooling.
• Network Segmentation: Network segmentation divides traffic and resources into controlled zones so access can be restricted between groups, systems, or applications. In remote access design, segmentation limits what a connected user or workload can reach after authentication, which reduces lateral movement and shrinks blast radius.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is suitable for security and identity practitioners who need a structured way to understand how access, credentials and lifecycle controls intersect with broader security programmes.