Loss of Control (T0827) is the point where operators can no longer command the process, and getting control back needs more than waiting for the attack to stop. ATT&CK for ICS places it in the Impact tactic (TA0105) and describes a sustained loss of control or runaway condition that persists even after the malicious interference has subsided. This guide covers what the technique looks like in practice, what the procedure examples teach, why preparation matters more than detection, and how to plan manual operation, safe states and recovery of controllers and engineering systems. It is written for control engineers, OT security teams and site incident leads.
Key takeaways
- Sustained is the defining word. T0827 is about control that does not come back on its own. The temporary case is T0813 Denial of Control, which has its own ATT&CK page.
- Lockout is as effective as destruction. ATT&CK records actors changing PLC passwords to lock operators out (CISA adds renamed devices in the Unitronics campaign), alongside wipers and damaged field devices.
- Detection of the impact does not exist. ATT&CK v20 states that no standard detection method exists for T0827, so watch for the changes that precede it.
- Recovery depends on things you prepare in quiet times. Offline logic and configuration backups, matching engineering software, spare hardware and staff who can run the process by hand.
- Process safety comes first. Safety instrumented systems and a defined safe state must work whatever happens to the basic control system.
What T0827 covers
ATT&CK for ICS v20 describes Loss of Control as adversaries seeking a sustained loss of control or a runaway condition in which operators cannot issue any commands even after the interference has subsided. The technique text cites the German Federal Office for Information Security (BSI) 2014 IT Security Report, which described a targeted attack on a steel mill that caused breakdowns of control system components and whole installations, with damage and unsafe conditions from the uncontrolled shutdown of a blast furnace.
| Technique | Duration | What operators experience |
|---|---|---|
| T0813 Denial of Control | Temporary | Commands do not reach the device while interference lasts; the process may keep running, not necessarily in the desired state |
| T0827 Loss of Control | Sustained | Commands cannot be issued even after interference stops; recovery needs hands-on work |
| T0831 Manipulation of Control | Any | Commands appear to work but the adversary is steering the process |
| T0829 Loss of View | Sustained | Operators cannot see process state, which often accompanies loss of control |
For the wider Impact tactic see the ATT&CK Impact Tactic Guide, and for the matrix as a whole the MITRE ATT&CK for ICS Guide.
How control is lost: the procedure examples
ATT&CK v20 lists the following examples for T0827. Grouping them by mechanism shows what your recovery plan must cover.
| Mechanism | Example (ATT&CK ID) | What ATT&CK records |
|---|---|---|
| Credential lockout on controllers | 2026 U.S. Water Utilities Attacks (C0066) | Passwords changed on internet-facing MicroLogix controllers, locking out operators; utilities lost control of controllers, water towers and lift stations |
| Logic manipulation and lockout | CyberAv3ngers (G1027), 2026 Iranian Water Campaign | Process logic, HMI and SCADA displays manipulated, and PLC management passwords changed to lock victims out |
| Damage to field devices | 2025 Poland Wiper Attacks (C0063) | RTUs, protection and control relays and HMI workstations damaged, causing loss of communication and control between facilities and the distribution system operator |
| Wiping supervisory hosts | Industroyer (S0604) | Data wiper removed registry image paths and overwrote files, rendering systems unusable |
| Denial of peripherals and equipment | 2015 Ukraine Electric Power Attack (C0028) | Operators shut out of equipment; much of the power was restored manually |
| Ransomware on production systems | LockerGoga (S0372) | Norsk Hydro production systems lost control and the company switched to manual operations |
CISA's advisory AA23-335A on the earlier Unitronics campaign adds detail on how lockout works in practice. CISA reports that the actors renamed devices, which blocked remote operators because the device name is needed to connect, set the logic to an older software version so engineering workstations could not communicate unless the software matched or the PLC was factory reset, disabled upload and download functions, and changed the remote communication port. Every one of those steps attacks the operator's recovery path, not just the process.
CERT Polska's report on the December 2025 attacks shows the limits of the impact: damaged RTUs meant substations lost communication with the distribution system operator and could not be remotely controlled, but ongoing electricity production was not affected. Local control and protection kept the process stable while central control was lost.
Detection: catch the changes that come first
ATT&CK v20 attaches detection strategy DET0778 to T0827, and its analytic states that no standard detection method currently exists for this technique. The loss of control is obvious once it happens. The value is in seeing the preparatory changes.
| Signal | Source | What it can indicate |
|---|---|---|
| Controller password or security setting change outside a work order | Controller change logs, OT network monitoring of engineering protocol traffic | Preparation for lockout |
| Program download or logic change from an unexpected host | OT network monitoring, asset management change detection | Logic replacement |
| Operating mode change on a controller | Network monitoring of ICS management functions | Preparation for logic or firmware change |
| Device name or port change | Asset inventory comparison | Lockout of remote operators |
| Logins to controllers from the internet | Firewall and gateway logs | The entry point in the Unitronics and 2026 water campaigns |
| Wiper behaviour on HMIs or engineering workstations | EDR and Windows event logs | Loss of the tools needed to recover |
CISA's AA23-335A recommendations include monitoring for ICS management functions that change operating modes or modify programs, monitoring asset management systems for unexpected parameter changes, and using watchdog timers to detect unresponsive systems quickly. See the OT Network Security Monitoring Guide.
Prevention: make lockout hard
- Remove internet exposure: both water campaigns used internet-facing controllers. CISA's primary OT mitigations put removing OT connections to the public internet first. See the PLC Security Guide.
- Replace default passwords and protect project settings: CISA's Unitronics advisory recommends strong passwords on PLCs and HMIs and adding security settings to project files, such as TCP/IP, upload protection and SD card passwords.
- Restrict who can change state: CISA recommends authentication for all access to field controllers before changes to state, logic or programs, role-based control of operating mode changes, and considering physical keys for mode changes.
- Allowlist the engineering hosts: use device control lists or host-based allowlists so controllers accept connections only from known workstations. See the Engineering Workstation Security Guide.
- Diverse paths to the process (M0810, M0811): ATT&CK's mitigations for T0827 are an out-of-band communications channel for monitoring and control, redundancy of service with hot standbys in diverse locations, and data backup.
Planning for manual operation and safe states
The CISA, FBI, EPA and DOE primary mitigations tell operators to practise and maintain the ability to run OT systems manually, and to routinely test fail-safe mechanisms, islanding capabilities, backups and standby systems. Turning that into a plan means answering, for each critical process:
- What is the safe state? Agree with process safety engineers what the process should do if the control system is lost, and confirm that the safety instrumented system achieves it independently. See the Safety Instrumented Systems Security Guide.
- Can it be run locally? Identify local panels, hand-off-auto switches or field operation that bypass the supervisory layer, and the staff needed to use them.
- For how long? Estimate how many hours or days manual operation can be sustained with available staff, and what triggers a controlled stop.
- What is needed to restore control? Offline logic, configuration and firmware copies; engineering software at the right version; licences; spare controllers and modules; and a clean engineering workstation.
- Who decides? Name the role that moves the site to manual operation and the role that approves return to automatic control.
Cyber scenarios belong in the same process hazard analysis as other causes of control failure. See the OT Cyber Physical Risk and Safety Guide.
Choosing recovery options
| Situation | Recovery option | Trade-off |
|---|---|---|
| Controller password changed, hardware intact | Vendor-documented reset and reload from offline backup | Reset may clear logic and configuration; needs a verified backup and site access |
| Logic replaced or version mismatched | Reload known-good logic from an engineering workstation with matching software | Needs software versions recorded and kept available offline |
| Firmware or hardware damaged | Swap with cold-standby hardware, as CISA's advisory recommends | Cost of spares; lead times for older models |
| HMIs and engineering workstations wiped | Rebuild from gold images, operate locally meanwhile | Rebuild time; images must be current and offline |
Small utilities with a handful of PLCs gain most from offline logic backups, a spare controller of each critical model and a laptop with the right engineering software kept off the network. Large operators should add standby control servers in diverse locations and rehearse loss of a whole control centre.
Where identity fits
Controller passwords, shared engineering accounts and vendor remote access credentials are the levers in the lockout examples. Record which accounts can change controller state, who holds them, and how they are recovered if the actor changes them. Store recovery credentials offline. See the OT and ICS Identity and Access Guide and the OT Third-Party and Integrator Access Guide.
Safe response
- Stabilise the process: move to local or manual control, or a controlled stop, under the pre-agreed decision rules. Do not fight the attacker through the compromised path while the process is unstable.
- Cut the attacker's access: block internet and remote access paths to controllers and engineering hosts at the conduit.
- Preserve evidence: keep network captures, controller logs and images of HMIs and engineering workstations before rebuilding. See the OT Incident Response Guide.
- Restore control device by device: reset or replace, reload verified logic, check configuration against backups, and test with operations before returning to automatic control.
- Close the entry point: change every credential the actor could have seen, remove exposure, and review why the change went unnoticed.
Metrics that show it is working
- Controller backup coverage: share of critical controllers with a current, verified offline logic and configuration backup.
- Spares coverage: share of critical controller models with a cold-standby unit on hand.
- Manual operation readiness: critical processes with a manual operation drill in the last 12 months, and time to stable manual control.
- Unapproved change rate: controller logic, mode or password changes without a matching work order, per month.
- Restore time: measured time to reset and reload a representative controller from backup.
Framework mapping
| Control area | NIST SP 800-53 Rev 5 | NIST CSF 2.0 | ATT&CK for ICS mitigation |
|---|---|---|---|
| Manual operation and contingency plans | CP-2 Contingency Plan; CP-4 Contingency Plan Testing | ID.IM-04 | M0953 Data Backup |
| Logic, configuration and image backups | CP-9 System Backup; CP-10 System Recovery and Reconstitution | PR.DS-11; RC.RP-01 | M0953 Data Backup |
| Safe state on failure | SC-24 Fail in Known State | PR.IR-03 | Not mapped by ATT&CK |
| Standby control systems | CP-7 Alternate Processing Site | PR.IR-03 | M0811 Redundancy of Service |
| Diverse control paths | CP-11 Alternate Communications Protocols | PR.IR-03 | M0810 Out-of-Band Communications Channel |
| Change monitoring | SI-4 System Monitoring | DE.CM-01 | Not mapped by ATT&CK |
NIST SP 800-82 Rev. 3 (final, 28 September 2023) is the OT tailoring reference; NIST's page notes a Revision 4 initial public draft with comments due by 30 November 2026. See the NIST SP 800-82 OT Security Guide.
Common failure patterns
- Backups on the network that was attacked: logic backups on a domain file server or the engineering workstation itself are lost with it.
- No record of engineering software versions: the Unitronics lockout relied on a version mismatch; without the right version kept offline, recovery waits for the vendor.
- Controllers reachable from the internet with default or shared passwords: the entry point in both water campaigns.
- Assuming manual operation is possible: local panels removed in upgrades, or no staff left who know how to run the process by hand.
- Fighting for control while the process is unstable: response that ignores process safety can cause more harm than the attack.
Practitioner checklist
- Define the safe state for each critical process and confirm the safety system reaches it independently of the control system.
- Keep offline, verified backups of controller logic, configuration and firmware, with the matching engineering software version.
- Hold cold-standby hardware for critical controller models.
- Remove controllers from internet exposure, replace default passwords and set project security settings.
- Restrict operating mode and program changes to authorised roles and known engineering hosts.
- Monitor for controller password, mode, name and logic changes outside work orders.
- Store controller recovery credentials offline with a named owner.
- Rehearse manual operation and the restore of a controller at least yearly.
Standards and references
- MITRE ATT&CK for ICS: Loss of Control (T0827)
- MITRE ATT&CK for ICS: Denial of Control (T0813)
- NIST: SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
- CISA: AA23-335A IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors
- CISA, FBI, EPA and DOE: Primary Mitigations to Reduce Cyber Threats to Operational Technology
- CERT Polska: Energy sector incident report, December 2025
Related NHI Mgmt Group resources: MITRE ATT&CK for ICS Guide · Safety Instrumented Systems Security Guide · PLC Security Guide · OT Backup, Recovery and Golden Image Guide