ATT&CK for ICS Lateral Movement Tactic Guide: Detecting and Containing Lateral Movement in OT

Almost every serious industrial intrusion has to cross from where the adversary lands to where the process is controlled, and that crossing is made with accounts, remote services and engineering functions the plant already trusts. MITRE ATT&CK for ICS defines the Lateral Movement tactic (TA0109) as the adversary "trying to move through your ICS environment", and notes that these techniques abuse default credentials, known accounts and vulnerable services, and may use dual-homed devices that sit on both IT and OT networks. This hub covers all 6 techniques and 5 sub-techniques under the tactic in ATT&CK v20, how the Ukrainian grid attacks, the Triton safety system attack, INCONTROLLER and the water sector campaigns moved, and which controls and detections stop the pivot. It is for OT security engineers, identity and remote access owners, and SOC teams covering OT. For the framework itself, see the MITRE ATT&CK for ICS Guide.

Key takeaways

• Lateral movement in OT is mostly an identity problem. Of the 41 procedure examples recorded under the tactic in the v20 dataset, 14 are Valid Accounts (T0859) or Insecure Credentials (T1694) and its default and hardcoded sub-techniques.
• Remote services and jump hosts are the paths. Remote Services (T0886) and Lateral Tool Transfer (T0867) have 8 procedure examples each, as many as Valid Accounts: RDP jump boxes, VPN connections, SMB shares, SSH and vendor protocols.
• Program Download is lateral movement to the controller. ATT&CK treats pushing logic to a PLC or safety controller (T0843) as moving onto that device, and Triton, Stuxnet, INCONTROLLER and CyberAv3ngers all did it.
• Access Management is the anchor mitigation. M0801 is mapped to 9 of the 11 technique entries, followed by Filter Network Traffic (M0937) and Network Segmentation (M0930) at 6 each.
• Default and hardcoded credentials are the cheapest fix. The Unitronics campaign, the 2026 U.S. water utilities attacks and the 2025 Poland wiper attacks all used default credentials on controllers, RTUs or HMIs.

What Lateral Movement means in an ICS environment

ATT&CK for ICS describes lateral movement as entering and controlling remote systems so the adversary can pivot towards their objective, often after Discovery and Collection, and often through several systems and accounts. In OT that journey usually has three hops: from the corporate network or a remote access service into the OT DMZ or a jump host, from there to a SCADA server, HMI or engineering workstation, and finally onto controllers, RTUs, relays or the safety system.

How adversaries chain Lateral Movement

Counts in this section were computed from the official ATT&CK v20 ICS STIX data by counting non-revoked "uses" relationships from groups, software and campaigns to each technique in the tactic: 41 procedure examples from 9 software entries, 3 groups and 6 campaigns.

• Valid accounts through VPN and dual-homed systems: in both the 2015 and 2016 Ukraine Electric Power Attacks, Sandworm Team used valid accounts to move laterally through VPN connections and dual-homed systems. In 2015 the group used IT helpdesk software to move the mouse on ICS control devices; in 2016 it used MS-SQL access to a pivot machine for code execution across the ICS network, and a VBS script to copy ICS payloads. See the Sandworm Threat Actor Profile.
• Jump boxes into the safety system: in the Triton Safety Instrumented System Attack, TEMP.Veles used valid credentials to move through RDP jump boxes into the ICS environment, exploited poorly configured OT firewalls, tried to transfer and run WMImplant on several machines, and downloaded multiple rounds of control logic to the safety controller (T0843.003 Program Append).
• Edge devices to RTUs: in the 2025 Poland Wiper Attacks the adversaries entered OT through compromised Fortinet edge devices, used SSH, RDP and SMB Windows admin shares, and used valid and default credentials to reach Hitachi and Mikronika RTUs, protection relays, HMI computers and Moxa NPort serial device servers.
• Controller credentials and engineering protocols: INCONTROLLER can brute force Schneider PLC passwords over the CODESYS protocol on UDP port 1740, download programs over CODESYS, use Telnet to load an implant on Omron PLCs, and log in to Omron PLCs with hardcoded credentials documented in CVE-2022-34151. The AA22-103A advisory describes the same toolset brute forcing passwords with default or dictionary lists.
• Internet-exposed controllers with default credentials: in the Unitronics Defacement Campaign, CyberAv3ngers used default credentials on Unitronics PLCs; CISA advisory AA23-335A reports that the devices were reached on default TCP port 20256 with default or no passwords, the ladder logic was replaced and at least 75 U.S. devices were compromised between November 2023 and January 2024. ATT&CK also records CyberAv3ngers using manufacturers' PLC programming software to push new configurations, and Dropbear SSH on port 22 for remote access. See the CyberAv3ngers Threat Actor Profile.
• Worms crossing from IT: NotPetya, WannaCry and Bad Rabbit initially infected IT networks and spread to industrial networks through the SMBv1 vulnerability MS17-010 (T0866) and SMB file shares (T0867).

All Lateral Movement techniques in ATT&CK for ICS v20

In v20 the older IDs T0812 Default Credentials and T0891 Hardcoded Credentials were revoked in favour of T1694.001 and T1694.002, so detection tags and coverage maps using the old IDs need updating. Valid Accounts and Insecure Credentials are also listed under Persistence, and Remote Services and Exploitation of Remote Services under Initial Access.

Which techniques matter most for defenders

• Valid Accounts (T0859): the most common route and the hardest to see, because the activity looks like normal administration. ATT&CK maps 10 mitigations to it, tied with Program Download for the most in the tactic, from Access Management and Privileged Account Management to MFA and Active Directory Configuration.
• Remote Services (T0886): RDP, SSH, SMB, VNC, Telnet and vendor maintenance protocols are how operators and integrators do their jobs. The defence is narrowing which sources may use them and on which paths, using allowlists and filtering (M0807, M0937) and segmentation (M0930).
• Program Download (T0843): the final hop onto the controller. Online Edit and Program Append can change logic without stopping the process, so the absence of a stop event does not mean nothing changed.
• Insecure Credentials (T1694): default and hardcoded credentials turn a reachable device into a compromised one. Where a hardcoded credential cannot be changed, the compensating control is to prevent the network path to the service.
• Exploitation of Remote Services (T0866): the worm path. Patching (M0951), disabling SMBv1 (M0942) and segmentation together stop IT outbreaks from becoming OT outages.

Detection priorities

Two telemetry sources do most of the work. Windows and Linux authentication logs from OT hosts (forwarded off the OT network to a collector the adversary cannot easily reach) show account misuse and remote service use. Protocol-aware network monitoring shows program downloads and device logins that never appear in host logs. See the OT Network Security Monitoring Guide.

Mitigation priorities across the tactic

The CISA, FBI, EPA and DOE primary mitigations for OT reinforce this order: remove OT connections to the public internet, change default passwords, secure remote access with a VPN and phishing-resistant MFA, apply least privilege and disable dormant accounts, and segment IT and OT with a DMZ. See the OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide.

Where identity fits

This is the tactic where identity controls decide the outcome. The accounts that move adversaries through OT are rarely ordinary staff logins. They include vendor and integrator remote access accounts, shared engineering accounts, service accounts used by historians, SCADA databases and OPC servers, the default administrator on a PLC or RTU, and credentials hardcoded in vendor software, such as the WinCC database password ATT&CK records Stuxnet using to propagate. Practical steps:

• Inventory non-human and device credentials: record every service account, device account and embedded credential per asset, and who owns it.
• Broker remote access: route vendor and staff sessions through a jump host or access gateway with phishing-resistant MFA, session recording and time-bound approval; disable dormant accounts.
• Separate identity stores: keep OT domain or local accounts separate from corporate Active Directory so a corporate credential compromise does not grant OT logons (M0915 Active Directory Configuration).
• Change and vault defaults: change vendor defaults at commissioning and keep device passwords in a vault with check-out, not in project files or spreadsheets.

See the OT and ICS Identity and Access Guide and the Default Credential Breaches Lessons Guide.

How to implement coverage

1. Map the paths: list every way into OT (VPNs, remote access tools, jump hosts, dual-homed servers, vendor modems, cellular gateways) and every protocol that crosses each zone boundary.
2. Close the free paths first: remove internet exposure of controllers and HMIs, change default credentials, and remove dual-homed connections. Change one site at a time and confirm operators can still reach what they need.
3. Consolidate remote access: put all interactive sessions through one brokered path with MFA, then block direct RDP, VNC and SSH from IT to OT at the firewall. Pilot with one vendor and one site; keep the old path disabled but documented for rollback during the pilot.
4. Restrict engineering services: allow program download, online edit and append only from named engineering workstations, and turn on controller access protection where supported.
5. Patch or contain remote service flaws: disable SMBv1, patch exposed services in maintenance windows, and isolate hosts that cannot be patched.
6. Turn on detections: authentication anomalies, new host-to-host remote sessions, admin share writes and downloads from unapproved sources, in alert mode first, tuned against maintenance work.
7. Exercise: run a tabletop and a technical test where a vendor account is assumed compromised, and confirm the session can be found and cut quickly. See the OT Incident Response Guide.

Small sites versus large estates: a small utility can get most of the value from removing internet exposure, changing defaults and one MFA-protected remote access path. Large estates need central identity governance for OT accounts, consistent jump host design per site and centralised authentication logging.

Detection and measurement

• Default credential exposure: number of OT devices still using vendor default credentials (target: zero, tracked per site).
• Brokered access ratio: percentage of interactive remote sessions into OT that pass through the approved gateway with MFA.
• Dormant accounts: count of OT and remote access accounts unused for 90 days that remain enabled.
• Unapproved engineering transfers: program downloads, edits or appends from sources outside the engineering allowlist, each investigated.
• Dual-homed hosts: number of hosts with interfaces on both IT and OT networks, trending to zero.
• Time to revoke: time from a vendor or account compromise report to session termination and credential reset.

Common failure patterns

• Dormant remote access accounts without MFA: the Colonial Pipeline ransomware attack began with a VPN profile for an account no longer in use and without MFA; the pipeline shutdown that followed was the company's own containment decision. The same kind of account is how adversaries reach OT jump hosts.
• Jump hosts that are only a hop: an RDP jump box without MFA, session recording or strict outbound rules simply relays the attacker, as in the Triton campaign.
• Default passwords left on controllers and RTUs: the Unitronics and 2025 Poland cases show default credentials on field devices being used directly.
• Shared corporate and OT identity: when OT hosts trust the corporate domain, every corporate credential theft becomes an OT access path.
• No control over who can download logic: any host with the vendor software and network reach can push a program to the controller.
• Treating OT as unpatchable without compensating controls: unpatched SMB on HMIs let NotPetya and WannaCry spread from IT into industrial networks.

Framework mapping

NIST SP 800-82 Rev. 3 provides the OT overlay for these controls. For zone and conduit requirements, see the IEC 62443-3-3 and 4-2 Security Levels Guide.

Practitioner checklist

• Remove internet exposure of controllers, HMIs and engineering services.
• Change every vendor default credential and record device credentials in a vault.
• Route all interactive remote access to OT through one brokered path with phishing-resistant MFA and session recording.
• Disable dormant remote access and OT accounts and review them at least quarterly.
• Remove dual-homed hosts and block direct IT to OT remote protocols.
• Allow program download, online edit and append only from named engineering workstations.
• Forward OT authentication logs and alert on new host-to-host remote sessions and admin share writes.
• Disable SMBv1 and patch or isolate exposed remote services.
• Update detection content from revoked T0812 and T0891 to T1694.001 and T1694.002.

Standards and references

• MITRE ATT&CK: Lateral Movement, Tactic TA0109 (ICS)
• MITRE ATT&CK: Valid Accounts (T0859)
• MITRE ATT&CK: Program Download (T0843)
• CISA and partners: IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors (AA23-335A)
• CISA, DOE, NSA and FBI: APT Cyber Tools Targeting ICS/SCADA Devices (AA22-103A)
• CISA, FBI, EPA and DOE: Primary Mitigations to Reduce Cyber Threats to Operational Technology
• NIST: SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
• NIST: SP 800-53 Rev. 5, Security and Privacy Controls

Related NHI Mgmt Group resources: MITRE ATT&CK for ICS Guide · OT and ICS Identity and Access Guide · OT Third-Party and Integrator Access Guide · Engineering Workstation Security Guide · OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide