CISA & FBI Urge Tighter Security for Third-Party ICS Integrators
CISA & FBI Warn of Third-Party Risks to Industrial Control Systems
Related Entities
Organizations
Products & Tech
Other
Full Report
Executive Summary
On September 23, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) released a joint fact sheet to warn critical infrastructure operators about the cybersecurity risks introduced by third-party Industrial Control System (ICS) integrators. The advisory emphasizes that these external partners, while essential for operations, can serve as a vector for malicious actors to access sensitive Operational Technology (OT) networks. The core recommendations focus on implementing the principle of least privilege, embedding robust security clauses into contracts, and diligently monitoring all remote connections to prevent disruptive and destructive attacks.
Threat Overview
Third-party ICS integrators, which provide services ranging from system design and installation to maintenance and support, often require deep access to a client's OT environment. This access, if not properly secured, creates a significant supply chain risk. Malicious actors can compromise a trusted integrator to gain a foothold in the networks of multiple critical infrastructure operators.
The advisory references a 2025 incident where foreign cyber actors compromised a U.S. industrial automation solutions company. The attackers used their access to the integrator's network to search for sensitive client information, using terms like 'SCADA' and 'customers.' They successfully compiled approximately 800 files for exfiltration, containing ICS device details and schematics that could be used to plan future attacks against the integrator's clients. This highlights a direct pathway from a compromised third party to the potential disruption of critical national functions.
Technical Analysis
The attack pattern described involves leveraging a trusted third-party relationship to bypass perimeter defenses. The primary tactic is the abuse of legitimate, pre-existing access granted to the ICS integrator.
MITRE ATT&CK Techniques
- T1199 - Trusted Relationship: The core of this threat involves attackers compromising a third-party integrator to exploit the trusted relationship it has with its clients (the critical infrastructure operators).
- T1078 - Valid Accounts: Once the integrator is compromised, attackers would likely use the integrator's legitimate credentials to access client networks.
- T1021.001 - Remote Services: Remote Desktop Protocol: A common method for integrators to access client systems, which attackers would abuse for lateral movement and persistence.
- T1105 - Ingress Tool Transfer: Attackers may use the integrator's access to transfer malicious tools into the target OT environment.
- T1048 - Exfiltration Over Alternative Protocol: The act of compiling and exfiltrating 800 files suggests a planned data theft operation, likely using covert channels.
Impact Assessment
A successful compromise via a third-party integrator could have severe consequences for critical infrastructure. Potential impacts include:
- Operational Disruption: Attackers could manipulate or shut down industrial processes, leading to service outages in sectors like energy, water, and transportation.
- Physical Damage: In some OT environments, unauthorized control could lead to equipment damage or catastrophic failures, posing a risk to public safety.
- Intellectual Property Theft: The exfiltration of ICS schematics, device configurations, and operational data represents a significant loss of sensitive intellectual property that could be used to engineer further attacks.
- Espionage: Foreign adversaries can use this access to gather intelligence on a nation's critical infrastructure capabilities and vulnerabilities.
IOCs — Directly from Articles
No specific Indicators of Compromise (IOCs) were provided in the source articles.
Cyber Observables — Hunting Hints
Security teams may want to hunt for the following patterns to detect abuse of integrator access:
net user * /domainC:\Windows\Temp\findstr /s /i "SCADA" *.*Detection & Response
Defenders should focus on gaining visibility into all third-party activities within their network.
- Monitor Remote Access: Implement robust logging for all VPN, RDP, and other remote access solutions. Analyze logs for unusual connection times, geographic locations, or multiple failed login attempts from integrator accounts. This aligns with D3FEND techniques like
D3-LAM - Local Account Monitoring. - Network Traffic Analysis: Use network monitoring tools to baseline normal traffic patterns associated with integrator activities. Set up alerts for anomalous data flows, such as large data transfers to unknown external destinations or connections to suspicious domains. This corresponds to
D3-NTA - Network Traffic Analysis. - Endpoint Detection and Response (EDR): Deploy EDR solutions on jump boxes and other systems accessed by third parties. Monitor for suspicious process execution, command-line arguments, and file modifications indicative of reconnaissance or lateral movement.
Mitigation
The CISA/FBI advisory provides several key mitigation strategies:
- Enforce Principle of Least Privilege (PoLP): Grant integrators only the minimum level of access required to perform their duties. This includes restricting access to specific systems, data, and time windows. This is a core part of D3FEND's
D3-UAP - User Account Permissionshardening. - Incorporate Security in Contracts: Legal agreements with integrators should explicitly define cybersecurity requirements, including data protection standards, incident notification timelines, secure remote access procedures, and rights to audit.
- Secure and Monitor Remote Access: All remote connections should be authenticated using MFA. Where possible, use on-demand, session-based access that is terminated immediately after use. All sessions should be logged and reviewed.
- Asset Management: Maintain a comprehensive inventory of all hardware and software provided or managed by the integrator. This is crucial for patch management and vulnerability scanning.
- Network Segmentation: Isolate the OT network from the IT network and the internet. Use demilitarized zones (DMZs) to control access between network segments, limiting an attacker's ability to move laterally from a compromised IT system to the OT environment.
Timeline of Events
MITRE ATT&CK Mitigations
Restrict network access for third-party integrators to only the specific systems and ports required for their function.
Privileged Account Management
Implement just-in-time access and enforce the principle of least privilege for all integrator accounts.
Network Segmentation
Isolate OT networks from IT networks and the internet to contain potential breaches originating from third parties.
Continuously log and audit all activities performed by third-party accounts to detect suspicious behavior.
Multi-factor Authentication
Require MFA for all remote access sessions to prevent unauthorized access via compromised credentials.
D3FEND Defensive Countermeasures
In the context of protecting against ICS integrator compromise, implementing User Account Permissions is paramount. This goes beyond standard account creation and involves a Zero Trust approach to access control. For each integrator, organizations should define granular permissions on a per-system, per-protocol, and per-user basis. Instead of granting broad VPN access, provide application-level access through a secure gateway. For example, if an integrator only needs to manage a specific PLC, their account should only have rights to communicate with that device's IP address on the specific management port (e.g., TCP/502 for Modbus) and nothing else. Access should be time-bound, automatically expiring after a project phase is complete. This D3FEND technique directly mitigates the risk of an attacker leveraging a compromised integrator account for lateral movement or broad network reconnaissance, as their access is confined to a minimal, pre-approved set of resources.
To detect malicious activity stemming from a compromised ICS integrator, Network Traffic Analysis is a critical defensive layer. Organizations should deploy network sensors or leverage existing firewall/switch capabilities (like NetFlow or sFlow) at key ingress/egress points used by third parties, such as VPN concentrators or DMZ jump boxes. The first step is to baseline normal activity: what protocols, systems, and data volumes does the integrator typically use? Once a baseline is established, security teams can create alerts for deviations. For example, an alert could trigger if an integrator's connection, which normally only involves RDP traffic to a specific server, suddenly initiates an SMB connection to a file share or attempts to exfiltrate a large volume of data to an unknown external IP. This directly addresses the threat of data exfiltration and reconnaissance, as seen in the 2025 incident where attackers searched for 'SCADA' files.
Network Isolation, often implemented as network segmentation, is a foundational control for limiting the blast radius of a compromised third-party integrator. The Purdue Model for ICS security provides a strong framework. Integrator access should terminate in a DMZ (Level 3.5), completely separate from the corporate IT network and the core OT process control network (Levels 0-2). From this DMZ, all access into the OT environment must be strictly controlled through an internal firewall, allowing only specific, approved protocols and IP addresses. This prevents a compromised integrator from using their access to pivot to the corporate email server or, conversely, an attacker on the IT network from reaching the OT systems via the integrator's path. This D3FEND technique ensures that even if an integrator's credentials are stolen, the attacker's movement is severely restricted, preventing them from accessing the most sensitive control systems.
Timeline of Events
A U.S. industrial automation solutions company was compromised by foreign cyber actors.
CISA and the FBI release a joint fact sheet on third-party ICS integrator risks.
Sources & References
Article Author
Jason Gomes
• Cybersecurity PractitionerCybersecurity professional with over 10 years of specialized experience in security operations, threat intelligence, incident response, and security automation. Expertise spans SOAR/XSOAR orchestration, threat intelligence platforms, SIEM/UEBA analytics, and building cyber fusion centers. Background includes technical enablement, solution architecture for enterprise and government clients, and implementing security automation workflows across IR, TIP, and SOC use cases.
Editorial Standards & Analyst Review
CyberNetSec.io uses automation to assist source monitoring, deduplication, observable extraction, and structured intelligence generation. Published analysis follows human-defined editorial standards and adds defensive context including MITRE ATT&CK, D3FEND, STIX, and Sigma where applicable. Read our editorial policy.
Tags
📢 Share This Article
Help others stay informed about cybersecurity threats
🎯 MITRE ATT&CK Mapped
Every tactic, technique, and sub-technique used in this threat has been identified and mapped to the MITRE ATT&CK framework for consistent, actionable threat language.
🧠 Enriched & Analyzed
Observables and indicators of compromise (IOCs) have been extracted and cataloged. Risk has been assessed and correlated with known threat actors and historical campaigns.
🛡️ Actionable Guidance
Detection rules, incident response steps, and D3FEND-aligned mitigation strategies are included so your team can act on this intelligence immediately.
🔗 STIX Visualizer
Structured threat data is packaged as a STIX 2.1 bundle and can be visualized as an interactive graph — relationships between actors, malware, techniques, and indicators.
⚡ Sigma Generator
Sigma detection rules are derived from the threat techniques in this article and can be converted for deployment across any major SIEM or EDR platform.