What Real ICS Attacks Teach Us: Lessons from Stuxnet to TRITON

Why Study Past Attacks?

Understanding how real adversaries have targeted industrial control systems is essential for anyone entering OT security. These incidents reveal not just technical vulnerabilities but strategic patterns — how attackers gain access, move through networks, and ultimately impact physical processes.

Here are the incidents I’ve studied most closely and what each one teaches.

Stuxnet (2010) — The Game Changer

Target: Iran’s Natanz uranium enrichment facility (Siemens S7-300 PLCs)

What happened: Stuxnet was a nation-state cyber weapon that manipulated the speed of uranium centrifuges while reporting normal values to operators. It was the first known malware designed to cause physical damage through cyber means.

Key lessons:

• Air gaps are not absolute — Stuxnet spread via USB drives, crossing the air gap
• Attackers can manipulate the “ground truth” — by spoofing HMI displays, operators didn’t know anything was wrong
• Supply chain matters — the attack required deep knowledge of Siemens Step 7 software and specific PLC configurations
• OT attacks require patience — Stuxnet operated for months, slowly degrading centrifuges while avoiding detection

Ukraine Power Grid Attacks (2015 & 2016)

Target: Ukrainian power distribution companies

What happened: In 2015, attackers (attributed to Sandworm/APT28) used spear-phishing to gain IT access, then moved laterally into OT networks and remotely opened circuit breakers, causing power outages for approximately 230,000 customers. In 2016, a more sophisticated follow-up attack used custom malware (Industroyer/CrashOverride) to communicate directly with power grid equipment using industrial protocols.

Key lessons:

• IT/OT convergence is the primary attack vector — initial access came through standard IT methods (phishing emails)
• Industrial protocol knowledge is weaponisable — Industroyer could speak IEC 61850, IEC 104, and OPC DA natively
• Manual overrides save lives — Ukrainian operators were able to restore power relatively quickly because they could switch to manual operations
• The 2016 attack showed evolution — attackers moved from “control the operator’s tools” to “speak directly to the equipment”

TRITON/TRISIS (2017) — Targeting Safety

Target: A petrochemical plant in Saudi Arabia (Schneider Electric Triconex Safety Instrumented System)

What happened: TRITON specifically targeted the Safety Instrumented System (SIS) — the last line of defence that prevents catastrophic physical events like explosions. The malware was designed to disable safety controllers, potentially allowing a dangerous process condition to escalate without automated shutdown.

Key lessons:

• Safety systems are targets — this was the first known attack specifically aimed at a SIS, crossing a threshold from economic damage to potential loss of life
• SIS should be truly independent — if the SIS is reachable from the same network as the DCS, it can be compromised alongside it
• OT security is a safety issue — TRITON made it impossible to separate “cybersecurity” from “process safety”
• Detection came from a bug — the attack was discovered because a programming error caused the SIS to trip, shutting down the plant. Without that error, the malware might have gone undetected

Colonial Pipeline (2021) — IT to OT Impact

Target: Colonial Pipeline (US fuel distribution)

What happened: A ransomware attack on Colonial Pipeline’s IT systems led the company to shut down its OT pipeline operations as a precaution — not because OT was directly compromised, but because they couldn’t monitor billing and operational systems. This caused fuel shortages across the southeastern United States.

Key lessons:

• IT disruption can force OT shutdowns — even without directly attacking OT, compromising IT systems that OT operations depend on can achieve the same effect
• Visibility gaps between IT and OT are dangerous — Colonial shut down OT because they weren’t confident the attack hadn’t spread; better segmentation and monitoring could have avoided this
• Business continuity planning must span IT and OT

Common Patterns Across All Incidents

Studying these attacks together reveals consistent patterns:

1. Initial access almost always comes through IT — phishing, VPN vulnerabilities, stolen credentials
2. Lateral movement from IT to OT is the critical transition that defenders must detect and prevent
3. Attackers invest significant time in reconnaissance — understanding the specific industrial process before acting
4. The most dangerous attacks are the ones operators can’t see — HMI manipulation, false reporting, silent safety system compromise
5. Legacy protocols and systems create structural vulnerabilities that cannot be patched away

Implications for Defenders

Every one of these incidents reinforces the same priorities for OT security professionals: proper network segmentation between IT and OT, continuous monitoring of OT network traffic for anomalies, independent safety systems that operate on separate infrastructure, incident response plans that specifically address OT scenarios, and regular exercises that test the organisation’s ability to operate manually when digital systems are compromised.

Expand this with your own analysis, diagrams mapping the kill chains, and connections to frameworks like MITRE ATT&CK for ICS.