Wireless Compromise (T0860) is an adversary gaining a foothold in an industrial network over the air, by compromising a wireless device or by transmitting on the same frequency as the control network, often from outside the fence. Industrial wireless includes Wi-Fi on the plant floor, WirelessHART and ISA100.11a field instruments, licensed and unlicensed radio links to remote sites, and older infrared or proprietary remote controls. MITRE ATT&CK for ICS lists T0860 under Initial Access for Embedded, Windows and Linux platforms. This guide is for OT security engineers, radio and instrument engineers and OT SOC analysts: what ATT&CK's two documented cases teach, how ATT&CK's mitigations apply to industrial radio, what the v20 analytics look for, and how to respond. Interception without access is a separate technique; see MITRE ATT&CK for ICS T0887 Wireless Sniffing. For the wider matrix see the MITRE ATT&CK for ICS Guide.
Key takeaways
- Range is not a boundary. ATT&CK notes wireless compromise can be an initial access vector from a remote distance, so a physical perimeter does not contain the network.
- Do not trust the link layer alone. ATT&CK's Communication Authenticity mitigation says link-layer equipment such as 802.11, LTE or 802.15.4 may have long lifespans and unpatched protocol flaws, so add authenticity at the application layer or through a VPN.
- Replay is the classic risk. ATT&CK's Lodz tram case involved capturing and replaying control signals; its mitigation asks for timestamps or cryptographic nonces.
- Mutual authentication for every device. ATT&CK recommends that wireless networks authenticate every device and that devices authenticate the infrastructure, for example with IEEE 802.1X.
- Detect the unknown device. ATT&CK's v20 analytic alerts on a wireless identity absent from the approved inventory that then reaches a protected OT asset.
What T0860 covers
ATT&CK describes T0860 as adversaries compromising wireless communications to gain unauthorised access to a wireless network, either by compromising a wireless device or by using radios on the same frequency as the network. In OT this spans several kinds of link, each with its own exposure:
| Wireless type | Typical OT use | What to protect |
|---|---|---|
| Wi-Fi (IEEE 802.11) | Handheld HMIs, mobile operator tablets, AGVs, plant-floor laptops | Who can associate, and what the wireless segment can reach |
| Industrial field wireless (WirelessHART, ISA100.11a) | Process instruments and monitoring points | Join keys and gateway configuration; gateway connectivity to the control network |
| Point-to-point and SCADA radio, cellular | Links to remote stations, pump sites and substations | Message authenticity and replay protection end to end |
| Short-range and infrared remote controls | Local control of switches, cranes and similar equipment | Whether a command can be forged or replayed |
The field wireless standards have their own join and key model; see the HART, WirelessHART and ISA100 Security Guide. For enterprise Wi-Fi monitoring, see Wireless intrusion detection.
The procedure examples and what they teach
- Maroochy Water Breach (C0020): ATT&CK describes this 2000 incident, in which an adversary used the local government's wastewater control system and stolen engineering equipment to cause the release of 800,000 litres of raw sewage. For T0860, ATT&CK records that the adversary used a two-way radio to communicate with and set the frequencies of Maroochy Shire's repeater stations. The lesson: a radio network that accepts commands from any transmitter on the right frequency has no access control at all.
- Lodz tram system: ATT&CK's technique description cites a Polish student who used a modified TV remote control to access the tram network and change track settings. Bruce Schneier's January 2008 write-up reports that the points were normally controlled by infrared signals and that in one incident a tram was sent the wrong way, its rear wagon left the rails and hit another tram. ATT&CK states the adversary may have aligned the device to the frequency and amplitude of the infrared signals, enabling capture and replay. The lesson: unauthenticated, replayable commands remain usable for as long as the equipment is in service.
Both cases are old, and that is the point ATT&CK makes in its mitigation text: link-layer equipment lives a long time, so design assuming the radio layer will not be fixed.
Prevention: ATT&CK mitigations in practice
| ATT&CK mitigation | What ATT&CK says for T0860 | How to apply it |
|---|---|---|
| M0813 Software Process and Device Authentication | Authenticate all devices to the network and the network to devices (mutual authentication); use strong protocols such as IEEE 802.1X; MAC filtering only where stronger methods are not available | Certificate-based 802.1X for Wi-Fi clients; unique join keys per field network; record each device identity in the inventory |
| M0802 Communication Authenticity | Do not rely on link-layer authenticity; add it at the application layer or with a network-layer VPN; provide replay protection with timestamps or nonces | Use authenticated variants of SCADA protocols over radio where supported, or a VPN between radio endpoints |
| M0808 Encrypt Network Traffic | Use strong cryptography to prevent eavesdropping | Current Wi-Fi security modes; encrypted radio links; VPNs on cellular backhaul |
| M0806 Minimize Wireless Signal Propagation | Reduce transmit power, adjust antenna gain so signals do not extend beyond the boundary, use RF shielding | Survey coverage from the site boundary and adjust; prefer directional antennas for point-to-point links |
Two design rules sit alongside these. Treat each wireless segment as its own zone, with a conduit to the control network that allows only the protocols and destinations the wireless devices need. And keep wireless out of safety functions unless the safety case explicitly covers it. See the OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide.
Detection: ATT&CK v20 analytics
MITRE's v20 detection strategy for T0860 has three analytics, each with ATT&CK's OT operational fidelity gate: alert only when the device or session breaks the approved identity, source and zone policy and is corroborated by access to a protected OT asset, a configuration change or another follow-on event; suppress approved shift activity, vendor support, commissioning and documented remote-access windows.
| Where | What the analytic looks for | Data needed |
|---|---|---|
| Wireless infrastructure | A device identity (MAC, EUI, certificate or device identifier) not in the approved wireless inventory joining a Wi-Fi/802.1X, WirelessHART, ISA100.11a or vendor mesh segment, then reaching an ICS application server | RADIUS/EAP authentication records; flow records from the wireless segment |
| Linux OT hosts | A wireless interface placed into monitor or promiscuous mode outside configuration management activity | Linux audit (auditd) execve records |
| Windows OT workstations | A capture driver loaded or monitor mode enabled on a workstation that is not a designated wireless management station | Sysmon Event ID 6 (driver loaded) |
For radio links that carry SCADA traffic, add protocol-level checks at the master station: commands from an unexpected outstation address, timing that does not match the polling cycle, or duplicated messages that suggest replay. A wireless intrusion detection system covers Wi-Fi rogue access points and unknown clients; it does not usually cover licensed radio or field wireless, so the gateway's own join logs matter there.
Where identity fits
Every wireless device is a non-human identity: a certificate, a join key or a pre-shared key. Shared keys across a whole plant mean one stolen tablet or instrument exposes the lot, and they rarely get rotated. Issue per-device credentials where the technology allows, record them in the inventory with an owner, and revoke on loss or decommissioning. See NHIs in OT.
How to implement
- Find every wireless link. Include field wireless gateways, radios to remote sites, cellular modems on remote equipment and handheld devices. Unknown cellular modems on vendor equipment are a common surprise. See the OT Asset Visibility Guide.
- Build the approved inventory. Record each device identity, its key or certificate, its owner and what it is allowed to reach.
- Zone the wireless. Put each wireless segment behind a conduit with an allowlist. Run new rules in log-only mode for a full operating cycle before enforcing.
- Strengthen authentication. Move Wi-Fi to certificate-based 802.1X; set unique join keys on field networks; add a VPN or authenticated protocol on radio links. Change one area at a time with a rollback plan, because a failed join can blind operators to field values.
- Shape the coverage. Survey signal strength at the boundary and reduce power or change antennas where it extends beyond the site.
- Turn on the detections. Forward RADIUS and gateway join logs to the OT SOC and alert on unknown identities that reach control assets.
Decision guidance
- Wireless or cable: wire anything that issues control commands where cabling is practical; keep wireless for monitoring and mobile access where the safety and availability case accepts it.
- VPN versus protocol security: a VPN between radio endpoints protects legacy protocols without changing devices; protocol-level authentication protects end to end but needs device support.
- MAC filtering: ATT&CK presents it as a basic protection for when stronger cryptographic methods are not available, not a substitute for them.
- Small sites: a single well-configured Wi-Fi network with certificate authentication, plus a firewall between it and the controllers, covers most of the risk.
- Large or distributed estates: remote-site radio and cellular links are the priority, because they cross public space and are hardest to inspect.
Responding to suspected wireless compromise
- Process safety first. Agree with operations whether affected field values or remote stations can still be trusted, and move to manual or local control if not.
- Isolate the wireless zone. Block the conduit from the wireless segment to the control network where operations accepts the loss of those devices.
- Preserve evidence. Keep RADIUS, gateway and radio logs, flow records and any spectrum observations.
- Rotate keys. Re-key the affected network and revoke any device credential that may be exposed.
- Check what the device reached. Review commands sent to controllers during the window and verify controller logic and set points.
See the OT Incident Response Guide.
Detection and measurement
- Inventory coverage: percentage of wireless devices with a recorded identity, owner and allowed destinations.
- Strong authentication: percentage of wireless segments using per-device credentials or certificates.
- Link protection: percentage of radio and cellular SCADA links with a VPN or authenticated protocol.
- Unknown device alerts: number of unknown identities joining OT wireless per month, and time to resolve each.
- Boundary leakage: number of survey points outside the site boundary where the OT network is receivable.
Framework mapping
| Framework | Reference | Relevance |
|---|---|---|
| MITRE ATT&CK for ICS | T0860; related T0887 | Access over wireless; interception without access |
| NIST SP 800-53 Rev. 5 | AC-18, SC-40, IA-3, SC-8, SC-7 | Wireless access, wireless link protection, device authentication, transmission protection, boundary protection |
| NIST CSF 2.0 | ID.AM-01, PR.IR-01, DE.CM-01 | Hardware inventory, protection from unauthorised logical access, network monitoring |
| NIST SP 800-153 | WLAN security | Configuring and monitoring Wi-Fi |
| NIST SP 800-82 Rev. 3 | OT guidance | Applying the controls above in OT |
Common failure patterns
- One shared key for the whole plant. A lost device exposes every link, and rotation is avoided because it touches everything.
- Wireless bridged flat into the control network. The wireless segment can reach any controller, so one association becomes full access.
- Trusting the radio vendor's link encryption alone. ATT&CK's own mitigation warns against relying on link-layer authenticity.
- Undocumented cellular modems. Vendor-installed modems create wireless paths no one monitors.
- No replay protection. Encrypted but replayable commands still work for an attacker who records them.
Practitioner checklist
- List every OT wireless link, including cellular modems on vendor equipment.
- Keep an approved wireless device inventory with identity, owner and allowed destinations.
- Place each wireless segment in its own zone with an allowlisted conduit.
- Use 802.1X with certificates for Wi-Fi and unique join keys for field wireless.
- Add a VPN or authenticated protocol with replay protection on radio and cellular SCADA links.
- Survey signal reach at the boundary and reduce it where possible.
- Alert on unknown wireless identities that reach control assets.
- Rehearse re-keying a wireless network without losing operator visibility.
Standards and references
- MITRE ATT&CK for ICS: Wireless Compromise (T0860)
- MITRE ATT&CK: Maroochy Water Breach (C0020)
- MITRE ATT&CK for ICS: Wireless Sniffing (T0887)
- NIST: SP 800-153, Guidelines for Securing Wireless Local Area Networks (WLANs)
- NIST: SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security
- Schneier on Security: Lodz tram incident (January 2008)
Related NHI Mgmt Group resources: MITRE ATT&CK for ICS Guide · HART, WirelessHART and ISA100 Security Guide · Wireless intrusion detection · Top 10 Wireless Network Security Risks · OT Network Security Monitoring Guide