Legacy OT malware cleanup: when does removal create more risk?

TL;DR: Legacy malware such as Conficker, Sality and WannaCry is still spreading through OT networks, and Dragos argues that cleaning it like enterprise IT can be more disruptive than the infection itself because legacy systems, vendor restrictions and safety constraints change the risk calculus. In OT, scoping, segmentation and maintenance-window planning matter more than quick reimaging.

Editorial analysis by NHI Mgmt Group, based on content published by Dragos: “Practical Considerations for Legacy Commodity Malware Cleanup in OT”.

Key questions

Q: What breaks when legacy malware cleanup is treated like enterprise IT remediation in OT?

A: The assumption that infected systems can be reimaged, instrumented and restored quickly often fails in OT.

Q: Why can immediate malware removal increase risk in industrial environments?

A: Immediate removal can increase risk when the infection is deeply embedded, the scope is uncertain or the cleanup requires shutdowns that affect safety and availability.

Q: What signs tell OT teams that legacy malware needs a planned maintenance-window cleanup?

A: Look for infections that are contained but persistent, systems that still support operations, and environments where segmentation or host changes are possible only through controlled maintenance.

Practitioner guidance

• Define a risk threshold for immediate OT malware cleanup Classify infections by operational, safety and compliance impact before choosing immediate shutdown and removal.
• Scope legacy infections before any remediation step Map affected hosts, shares and subnets first, because incomplete scoping can leave a reinfection path in place and force repeated cleanup cycles.
• Reduce lateral movement paths in legacy OT segments Tighten segmentation, restrict common lateral movement ports and protocols, and remove unnecessary Windows features where change control allows it.

Bottom line: Legacy OT malware persists because industrial systems often cannot be cleaned with standard enterprise endpoint methods.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →