ATT&CK for ICS T0886: Remote Services in OT

Remote Services (T0886) is how intruders who already have a foothold move through an industrial network using the same RDP, SSH, SMB, VNC and vendor protocols that operators and engineers use every day. MITRE ATT&CK for ICS lists it under both Initial Access and Lateral Movement, and its procedure examples run from the 2015 and 2016 attacks on Ukraine's grid and the TRITON safety system intrusion to the destructive 2025 attacks on Polish energy sites. Because the traffic is legitimate in form, the defence rests on knowing which host may talk to which, with which account, and when. This guide is for OT security engineers, network architects and SOC analysts: it covers the services that matter, the communication matrix behind ATT&CK's detection analytics, the controls that make remote services hard to abuse and how to respond safely. For the IT side of the same behaviour see T1021 Remote Services.

Key takeaways

The service is legitimate; the path is not. T0886 uses valid sessions over normal protocols, so detection depends on a documented communication matrix of approved sources, destinations, accounts and jump paths.
Jump hosts and dual-homed hosts are the pivot points. ATT&CK highlights dual-homed devices, and the TRITON actor used RDP into DMZ and control system hosts before reaching the safety engineering workstation.
Controllers have remote services too. ATT&CK records INCONTROLLER using the CODESYS protocol, Telnet and HTTP services on PLCs, and the 2025 Poland attackers using default SSH and FTP accounts on RTUs and protection relays.
Remote sessions must not override the operator. ATT&CK's mitigation M0800 says local operators should have priority over remote sessions and be able to regain control, a direct answer to the 2015 Ukraine cursor takeover.
Default and shared accounts make lateral movement trivial. CERT Polska found default local administrator, root SSH and built-in FTP credentials on the devices the attacker reached.

What T0886 covers and how it differs from nearby techniques

ATT&CK for ICS (v20) describes T0886 as using remote services to move between assets and network segments, naming RDP, SMB and SSH as examples. Remote services support remote access, data transfer, authentication, name resolution and configuration from engineering or management workstations. ATT&CK notes that the technique can reach dual-homed devices, can support Program Download or attacks on control devices through Valid Accounts, and that RDP and VNC may be a precursor to Graphical User Interface execution on HMIs and engineering software. It applies to Embedded, Windows, Linux and Network Devices platforms.

Technique	What is abused	Distinguishing signal
T0886 Remote Services	Normal remote services inside or into the ICS network, with working access	A session on a path, account or time outside the communication matrix
T0866 Exploitation of Remote Services	A vulnerability in a listening service	Crash, unexpected child process or malformed traffic
T0822 External Remote Services	VPN and remote access gateways at the boundary	Boundary authentication from an unusual source
T0859 Valid Accounts	The credentials themselves	An account used by the wrong person, host or time
T0823 Graphical User Interface	The HMI or engineering software once a session exists	Operator actions that nobody at the console performed

See the ATT&CK for ICS Lateral Movement Tactic Guide, the MITRE ATT&CK for ICS T0866 Exploitation of Remote Services page and the T0823 Graphical User Interface page.

The procedure examples and what they teach

Case	What ATT&CK and the cited sources record	Lesson
2015 Ukraine Electric Power Attack (C0028), Sandworm Team (G0034)	IT helpdesk software used to move the mouse on ICS control devices to open breakers	A remote session that can take over an operator console is a control path
2016 Ukraine Electric Power Attack (C0025), Sandworm Team	MS-SQL access to a pivot machine allowed code execution throughout the ICS network	Database services between zones are remote services too
Triton Safety Instrumented System Attack (C0030), TEMP.Veles (G0088)	RDP jump boxes and poorly configured OT firewalls used to move into the ICS environment; Mandiant describes heavy use of RDP, PsExec and WinRM, SSH tunnels and off-hours activity	A jump box that anyone with domain credentials can use is a bridge, not a control
INCONTROLLER (S1045)	CODESYS protocol to Schneider PLCs, Telnet to Omron PLCs, HTTP CGI scripts for administrative access	Controller management services need the same allowlisting as Windows services
Stuxnet (S0603)	SQL commands on the WinCC database server used to propagate to remote systems	SCADA databases run with powerful service accounts
REvil (S0496)	SMB used to encrypt files on remotely connected shares	Mapped shares carry ransomware into OT
2025 Poland Wiper Attacks (C0063)	After entering OT through compromised Fortinet edge devices, adversaries used SSH, RDP and SMB/Windows Admin Shares to connect to remote systems and run commands	Default device accounts and stored RDP credentials shortened the path to destruction
2026 Iranian Water Campaign, CyberAv3ngers (G1027)	One victim reported Dropbear SSH software used to enable remote access over port 22	New SSH listeners on OT devices are a finding

CERT Polska's report on the 29 December 2025 attacks adds detail: at a combined heat and power plant the attacker used SSL-VPN accounts without two-factor authentication, VPN bookmarks that stored RDP credentials so jump hosts could be reached without a further login, and stolen privileged Active Directory accounts; at renewable sites an HMI was reached over RDP with a default local administrator password and a firewall rule was added to open TCP 445. See the Sandworm Threat Actor Profile and the ICS Malware History Guide.

Remote services that matter in OT

Service	Usual port	Legitimate OT use	Control focus
RDP	TCP 3389	Operator and engineer access to HMIs, engineering workstations and servers	Only from the jump host; named accounts; session takeover rules
VNC	TCP 5900 and up	Panel and HMI support	View-only by default; allowlisted viewers
SSH	TCP 22	Linux servers, gateways, RTUs and network devices	Key-based, per-person accounts; restricted commands
SMB and admin shares	TCP 445	File transfer, historian exports, software distribution	Deny between zones except named flows
Database services	Product specific (MS-SQL TCP 1433)	SCADA and historian back ends	Firewall to known clients; least-privilege service accounts
Telnet, FTP and HTTP management	TCP 23, 21, 80, 443	Controller, relay and serial server administration	Disable where unused; restrict to engineering subnet
Vendor engineering protocols	Product specific (for example CODESYS)	Program and configuration transfer	Allowlist engineering workstations; authenticate sessions

Treat the table as a starting point for an inventory, not a complete list: build the real list from passive monitoring. See the OT Asset Visibility Guide.

Building the communication matrix

All four ATT&CK analytics for T0886 compare observed sessions with a documented, approved communication matrix. Without one, the analytics cannot work. Build it in this order.

Capture normal traffic: record east-west sessions on remote service ports for at least a full operating cycle, including a planned maintenance window, using passive OT monitoring.
Write down who may connect to what: for each flow, record the source, destination, service, account or role, and the jump path. Operators confirm what is needed; everything else is a candidate for removal.
Remove dual homing and shortcuts: ATT&CK's M0930 guidance is to move software between business and OT through one-directional DMZs, restrict web access from OT and keep engineering workstations and transient cyber assets minimally connected and not dual-homed. See the OT Network Segmentation, Purdue Model and IEC 62443 Zones and Conduits Guide.
Enforce the matrix: apply it in zone firewalls and host firewalls (M0807 Network Allowlists), and filter application-layer remote service messages where your firewalls can (M0937 Filter Network Traffic).
Keep it current: tie changes to the matrix to change control, so the SOC suppression list and the firewall rules move together.

Detection: ATT&CK's analytics with the OT fidelity gate

ATT&CK v20 attaches the detection strategy Detection of Remote Services to T0886. Each analytic uses the same OT operational fidelity gate: alert only when the account, device or session violates the approved identity, source host, jump path and zone policy and is corroborated by access to a protected OT asset, execution, a configuration change or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning and documented remote-access windows.

Platform	What the analytic identifies	Practical data sources
Windows	A remote service connection between two ICS hosts not in the matrix, followed by process execution or file access unlike normal scheduled communication	Security event 4624 (logon type 10 for RDP, type 3 for network), RDP connection events in the TerminalServices logs, 5140 share access, 7045 service installation
Linux	SSH movement between ICS Linux hosts not in the matrix, followed by ICS tool execution or privilege escalation	sshd authentication logs, auditd execve records
Network devices	New east-west connections between ICS hosts on remote service ports not in the matrix	OT network sensor or flow records
Embedded	ICS protocol traffic from one field device to another, not consistent with the device-to-supervisory topology	OT protocol monitoring

Making the analytics useful

Watch the jump hosts hardest: sessions that reach Level 2 hosts without passing through the approved jump host are high-value alerts. See the If your jump host and bastion is compromised playbook.
Use time as a signal: Mandiant reported that the TRITON actor interacted with controllers during off-hours, when fewer people would notice alarms. Remote sessions to safety and control hosts outside shift patterns deserve review.
Flag new listeners: a new SSH, Telnet or VNC service on an OT device, like the Dropbear case, should alert even before anyone connects to it.
Look for account misuse: Mandiant recommends looking for RDP by default, service or administrator accounts, or any account not expected on sensitive DMZ and control system hosts.

See the OT Network Security Monitoring Guide and the OT Security Operations Centre Guide.

Prevention: making remote services hard to abuse

ATT&CK lists nine mitigations for T0886. The table groups them by what they change.

Mitigation	ATT&CK guidance in brief	OT implementation
M0804 Human User Authentication; M0813 Software Process and Device Authentication	All remote services require strong authentication; all sessions are authenticated	MFA at the jump host; disable unauthenticated Telnet and FTP on devices
M0801 Access Management	Enforce authentication on device management, data access servers and HMI sessions	Put device management behind an access broker where devices cannot authenticate strongly
M0800 Authorization Enforcement	Restrict GUI sessions, such as read-only HMI modes; local users take priority and can regain control	Read-only remote HMI by default; prevent remote sessions taking over local consoles
M0918 User Account Management; M0927 Password Policies	Limit accounts that may use remote services; enforce strong passwords	Named accounts only; remove default and shared accounts; restricted SSH commands
M0930 Network Segmentation; M0807 Network Allowlists; M0937 Filter Network Traffic	One-directional DMZs, minimal connectivity, host allowlists, application-layer filtering	Enforce the communication matrix at every conduit

Phased rollout

First 30 days: remove default passwords on devices that offer SSH, Telnet, FTP or web management; disable services nobody uses; block SMB and RDP between zones except named flows.
Next quarter: route all interactive access through a jump host with MFA and session recording; put remote HMI access in read-only mode by default.
Testing: apply new firewall rules in log-only mode where your firewalls support it, review hits with operations for a full cycle, then enforce. Keep the previous rule set ready to restore.
Ongoing: review the matrix and account list after every project, and remove access granted for commissioning when it ends.

Small sites can start with the jump host and default password work; large estates should add the full analytic set and a central remote access platform. See the OT Remote Access Guide and the HMI and SCADA Server Hardening Guide.

Where identity fits

Most T0886 activity rides on accounts that are not tied to a person: shared engineering logins, local administrator accounts on HMIs, built-in device accounts, service accounts behind SCADA databases and credentials stored in VPN bookmarks. Inventory them, give each an owner, rotate them after staff or supplier changes and replace shared logins with named accounts where the product allows. See the OT and ICS Identity and Access Guide and the SSH Key Management Guide.

Safety-aware response

Protect the process: if a remote session may be controlling an HMI, operators take local control and, where needed, move to manual operation before anything is disconnected.
Cut sessions at the conduit: disable the account or block the source at the jump host and zone firewall, rather than shutting down supervisory hosts operators rely on.
Scope the movement: list every host the account or source reached, using the matrix and logon events, and check controllers on that path for program or configuration changes.
Preserve evidence: keep jump host session recordings, Windows and sshd logs, OT sensor captures and firewall logs. CERT Polska noted that destruction limited log recovery, so forward logs off the device.
Reset and recover: rotate every credential used on the path, including device defaults and stored VPN credentials, then restore from known-good images and verify controller logic.

See the OT Incident Response Guide.

Metrics that show it is working

Matrix coverage: share of observed remote service flows that match a documented entry. Target above 95%.
Jump host bypass: interactive sessions to Level 2 hosts that did not originate from the jump host. Target zero.
Default and shared accounts: OT devices and hosts with default or shared remote access accounts, trending down.
Dual-homed hosts: count of OT hosts with interfaces in more than one zone outside approved designs.
Analytic precision: share of T0886 alerts closed as approved activity; a high figure means the matrix or the maintenance calendar is out of date.

Framework mapping

Control area	NIST SP 800-53 Rev 5	NIST CSF 2.0	ATT&CK for ICS mitigation
Remote access paths	AC-17 Remote Access	PR.AA-03	M0801 Access Management
Authentication	IA-2 Identification and Authentication (Organizational Users)	PR.AA-03	M0804, M0813
Session authorisation	AC-3 Access Enforcement; AC-6 Least Privilege	PR.AA-05	M0800, M0918
Zone boundaries	SC-7 Boundary Protection	PR.IR-01	M0930, M0807, M0937
Detection	SI-4 System Monitoring	DE.CM-01	Detection of Remote Services
Containment	IR-4 Incident Handling	RS.MI-01	Not applicable

NIST SP 800-82 Rev. 3 (final, September 2023) is the OT tailoring reference; see the NIST SP 800-82 OT Security Guide and the IEC 62443 Guide for zones and conduits.

Common failure patterns

Jump hosts reachable with any domain account: the host exists, but nothing limits who uses it or where they go next.
Stored credentials on the path: CERT Polska found VPN bookmarks that stored RDP credentials, removing a login step.
Device defaults left in place: default root SSH, built-in FTP and local administrator passwords gave direct access to RTUs, relays and HMIs in Poland.
Remote sessions that override the console: in the 2015 Ukraine attack, helpdesk software moved the mouse on control devices to open breakers.
Mapped shares across zones: SMB shares used for convenience carry ransomware and wipers into OT.
No matrix, so no detection: without a documented baseline every alert looks plausible and analysts stop looking.

Practitioner checklist

Inventory remote services on every OT host and device from passive monitoring.
Write and approve a communication matrix of source, destination, service, account and jump path.
Remove dual homing and route all interactive access through a jump host with MFA and session recording.
Block SMB, RDP and database ports between zones except named flows.
Remove default and shared accounts on devices that offer SSH, Telnet, FTP or web management.
Set remote HMI sessions to read-only by default and give local operators priority.
Deploy the ATT&CK T0886 analytics with the fidelity gate and a shift and maintenance calendar.
Forward jump host, Windows, sshd and firewall logs off the device to the SOC.

MITRE ATT&CK for ICS T0886 Remote Services: Detect and Control Lateral Movement in OT