Loss of View (T0829) leaves operators blind to the state of their process, and ATT&CK notes it can happen while the physical process carries on unaffected, which is exactly what makes it dangerous. The technique sits in the ATT&CK for ICS Impact tactic (TA0105) and covers sustained or permanent visibility loss that needs local, hands-on intervention such as a restart or manual operation. This guide covers how view is lost in the procedure examples, how to tell a display problem from a process problem, how to build independent sources of truth, and how to fall back to manual observation safely. It is written for control room leads, SCADA and HMI engineers, and OT security teams.
Key takeaways
- Sustained loss is the defining feature. T0829 needs hands-on recovery. The temporary case, where the interface recovers when interference stops, is T0815 Denial of View, which has its own ATT&CK page.
- A dark screen hides the attacker. ATT&CK states that a sustained loss of view lets an adversary hide the present state of operations.
- The examples are wipers, lockouts and tampered displays. KillDisk, Industroyer, LockerGoga, the Unitronics HMI defacements and damaged RTUs in Poland all appear in ATT&CK's list.
- Independent sources of truth are the main defence. Local instruments, controller diagnostics, a historian fed by a separate path and out-of-band telemetry let operators confirm what the HMI cannot show.
- There is no analytic for the impact itself. ATT&CK v20 states that no standard detection method exists for T0829, so monitor for the actions that cause it.
What T0829 covers
ATT&CK for ICS v20 describes Loss of View as a sustained or permanent loss of view where ICS equipment requires local, hands-on operator intervention, for instance a restart or manual operation. By causing a sustained reporting or visibility loss, the adversary can hide the present state of operations, and ATT&CK notes that this can occur without affecting the physical processes themselves.
| Technique | What happens to the operator's view | Recovery |
|---|---|---|
| T0815 Denial of View | Temporary communication failure between a device and its control source | The interface recovers once the interference stops |
| T0829 Loss of View | Sustained or permanent loss of reporting or visibility | Hands-on intervention: restart, rebuild or manual operation |
| T0832 Manipulation of View | The display shows false values | Detect the discrepancy, restore trusted displays |
| T0827 Loss of Control | Commands cannot be issued; view loss often comes with it | Restore control path and devices |
For the matrix as a whole see the MITRE ATT&CK for ICS Guide; for alarm-related techniques see the ATT&CK for ICS Inhibit Response Function Tactic Guide.
How view is lost: the procedure examples
| Mechanism | Example (ATT&CK ID) | What ATT&CK records |
|---|---|---|
| Wiping operator hosts | KillDisk (S0607) | Erases the master boot record and system logs, leaving the system unusable |
| Wiping operator hosts | Industroyer (S0604) | Data wiper removes registry image paths and overwrites files, rendering the system unusable |
| Ransomware on production systems | LockerGoga (S0372) | Loss of view at Norsk Hydro forced a switch to manual operations |
| Replacing HMI graphics | Unitronics Defacement Campaign (C0031) | CyberAv3ngers replaced the HMI graphic with their own, so operators could not view PLC information |
| Manipulating displays | CyberAv3ngers (G1027), 2026 Iranian Water Campaign | Process logic, HMI and SCADA displays manipulated, which may disrupt operators' view |
| Controller lockout | 2026 U.S. Water Utilities Attacks (C0066) | Passwords changed on internet-facing MicroLogix controllers; utilities lost monitoring of water towers and lift stations |
| Damaging field and communication devices | 2025 Poland Wiper Attacks (C0063) | RTUs, protection relays and HMI workstations damaged, causing loss of communications and view between facilities and the distribution system operator |
| Disrupting sensor communication | Fuxnet (S1157) | Impaired sensor communication caused loss of view for overall system monitoring |
| Firmware downgrade | FrostyGoop Incident (C0041) | Firmware on victim devices downgraded to a version lacking monitoring |
CISA's advisory AA23-335A adds detail to the Unitronics case: the defacement message displayed on the HMI hid normal readings such as inputs and outputs, and CISA reports at least 75 devices compromised, at least 34 of them in the US water and wastewater sector. CERT Polska's report on the December 2025 Polish energy attacks records that damaged RTUs cut communication with the distribution system operator, while ongoing electricity production was not affected. Both cases show the T0829 pattern: the process kept running, but nobody upstream could see it. For background on the malware families named here see the ICS Malware History Guide.
Display problem or process problem?
When screens go dark or freeze, the first task is to establish whether the process is still in a safe state. A short set of triage questions helps the control room decide quickly:
- Is it one screen, one server or every view? A single HMI failure points to the host; loss across all consoles points to the SCADA server, network or the controllers themselves.
- Does the historian agree? If the historian still receives data through a separate path, it can confirm process values while the HMI is down.
- Do the controllers still report? Controller diagnostics or a local engineering connection can show whether the field layer is healthy.
- What do local instruments show? Field gauges, local panels and site staff are the final source of truth.
- Are alarms still arriving? Loss of alarms with loss of view is a higher-risk state than loss of view alone. See the ATT&CK for ICS Inhibit Response Function Tactic Guide.
Building independent sources of truth
ATT&CK maps three mitigations to T0829, and all of them are about having another way to see the process:
- M0810 Out-of-Band Communications Channel: provide redundant, out-of-band communication to support monitoring and control, especially during recovery from a network outage, using diverse technologies such as cellular networks to avoid common failure modes.
- M0811 Redundancy of Service: hot standbys in diverse locations, and at the network layer redundant protocols such as the Parallel Redundancy Protocol.
- M0953 Data Backup: hardened, separate backups and gold-copy images and configurations for key systems, so HMIs and SCADA servers can be rebuilt quickly.
Historian cross-checks
The historian is useful as a second view only if it does not share the failure. If it is fed by the same SCADA server that has been wiped, it goes dark at the same time. Consider where your historian takes its data from, whether it is on the same domain and credentials as the HMIs, and whether operators can reach a read-only view of it from outside the affected zone. A historian replicated into the DMZ for IT reporting can serve as a read-only fallback, provided the replication path is one way and its credentials are separate.
Choosing a fallback view
| Option | Best for | Trade-off |
|---|---|---|
| Standby HMI or SCADA server in a separate location | Large control centres | Must not share domain, credentials or management path with the primary |
| Read-only historian view outside the affected zone | Confirming trends and values during an outage | Lag and no control; depends on a separate data path |
| Out-of-band telemetry, for example cellular | Remote sites such as water towers and lift stations | New attack surface; secure it like any remote access path |
| Local panels and site staff | Every critical process, as the last resort | Needs staff on site and practised procedures |
Small utilities with remote sites gain most from local indication at each site and the ability to send staff out. Large operators should add a diverse standby control capability and a read-only view that survives the loss of the primary SCADA environment.
Detection: watch what causes the loss
ATT&CK v20 attaches detection strategy DET0763 to T0829, and its analytic states that no standard detection method currently exists for this technique. Monitor for the causes instead.
| Signal | Source | Linked example |
|---|---|---|
| Wiper or ransomware behaviour on HMIs and SCADA servers | EDR, Windows event logs, file integrity monitoring | KillDisk, Industroyer, LockerGoga |
| Logic download, password or graphic change on a controller with integrated HMI | OT network monitoring, controller change logs | Unitronics campaign, 2026 water attacks |
| Firmware change on field devices | Asset inventory comparison, network monitoring for firmware transfer | FrostyGoop |
| Loss of polling from RTUs or sensors | SCADA communication status, historian gaps | Poland 2025, Fuxnet |
| Logins to controllers from the internet | Firewall and gateway logs | Unitronics campaign, 2026 water attacks |
See the OT Network Security Monitoring Guide for sensor placement.
Prevention
- Harden the view layer: HMIs and SCADA servers are Windows or Linux hosts that wipers and ransomware reach first. See the HMI and SCADA Server Hardening Guide.
- Remove internet exposure and default passwords: CISA's first two primary OT mitigations, and the root cause in both water campaigns.
- Protect controller project settings: CISA's Unitronics advisory recommends upload protection and other project file passwords, and disabling or protecting remote programming.
- Segment IT and OT: keep ransomware on the IT side from reaching operator consoles. See the OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide.
- Keep gold images and spares: offline HMI and server images, controller logic backups and cold-standby hardware, as CISA's advisory recommends.
Where identity fits
HMIs and SCADA servers often run with shared operator logons and service accounts that also reach historians and jump hosts. If those accounts are in the corporate domain, a domain compromise can take every console at once. Keep OT accounts separate, give service accounts owners and minimal rights, and protect controller passwords from being changed by anyone outside approved engineering roles. See the OT and ICS Identity and Access Guide.
Safe response
- Confirm process state from an independent source: historian, controller diagnostics or local instruments, before anything else.
- Decide manual, local or stop: operations choose based on pre-agreed criteria and the staff available at site. The CISA, FBI, EPA and DOE guidance tells operators to practise and maintain the ability to run OT manually.
- Contain without blinding further: block attacker paths at the conduit rather than pulling remaining working consoles off the network.
- Preserve evidence: image affected HMIs and servers and keep network captures before rebuilding. See the OT Incident Response Guide.
- Restore view, then verify it: rebuild from gold images, reload controller logic and HMI projects from offline backups, and compare displayed values with local instruments before relying on them again.
Metrics that show it is working
- Independent view coverage: share of critical processes with at least one source of process state that does not depend on the primary SCADA servers.
- HMI rebuild time: measured time to rebuild an HMI or SCADA server from a gold image.
- Image currency: share of HMIs and servers with a gold image less than one change cycle old.
- Loss of view drills: control room exercises run in the last 12 months that simulate total loss of displays.
- Exposed controllers: OT devices reachable from the internet, with a target of zero.
Framework mapping
| Control area | NIST SP 800-53 Rev 5 | NIST CSF 2.0 | ATT&CK for ICS mitigation |
|---|---|---|---|
| Diverse monitoring paths | CP-11 Alternate Communications Protocols | PR.IR-03 | M0810 Out-of-Band Communications Channel |
| Standby view systems | CP-7 Alternate Processing Site | PR.IR-03 | M0811 Redundancy of Service |
| Gold images and backups | CP-9 System Backup; CP-10 System Recovery and Reconstitution | PR.DS-11; RC.RP-01 | M0953 Data Backup |
| Manual operation plans and drills | CP-2 Contingency Plan; CP-4 Contingency Plan Testing | ID.IM-04 | Not mapped by ATT&CK |
| Monitoring for causes | SI-4 System Monitoring | DE.CM-01 | Not mapped by ATT&CK |
NIST SP 800-82 Rev. 3 (final, 28 September 2023) is the OT tailoring reference; NIST's page notes a Revision 4 initial public draft with comments due by 30 November 2026. See the NIST SP 800-82 OT Security Guide.
Common failure patterns
- A historian that shares the failure: fed by the same server or on the same domain, it goes dark with the HMIs.
- Trusting the restored screen too soon: after a rebuild, displays are not compared with local instruments, so a manipulated value goes unnoticed.
- Integrated HMI controllers exposed to the internet: the Unitronics defacements removed the view and the logic in one step.
- No practice running blind: operators have never had to run on local indication, so the first time is during an incident.
- Pulling working consoles during containment: isolation decisions taken without operations can turn partial loss of view into total loss.
Practitioner checklist
- Identify an independent source of process state for every critical process and test it.
- Check that the historian has a separate data path and credentials from the HMIs it backs up.
- Keep offline gold images of HMIs and SCADA servers and offline HMI project files.
- Remove controllers and HMIs from internet exposure and replace default passwords.
- Monitor for wiper behaviour on operator hosts and for controller logic, graphic, password and firmware changes.
- Write triage questions for loss of view into control room procedures.
- Run a total loss of displays drill at least yearly and record time to confirmed process state.
Standards and references
- MITRE ATT&CK for ICS: Loss of View (T0829)
- MITRE ATT&CK for ICS: Denial of View (T0815)
- NIST: SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
- CISA: AA23-335A IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors
- CISA, FBI, EPA and DOE: Primary Mitigations to Reduce Cyber Threats to Operational Technology
- CERT Polska: Energy sector incident report, December 2025
Related NHI Mgmt Group resources: MITRE ATT&CK for ICS Guide · HMI and SCADA Server Hardening Guide · ICS Malware History Guide · OT Incident Response Guide · MITRE ATT&CK for ICS T0815 Denial of View · MITRE ATT&CK for ICS T0827 Loss of Control