CISA & FBI Urge Tighter Security for Third-Party ICS Integrators

Executive Summary

On September 23, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) released a joint fact sheet to warn critical infrastructure operators about the cybersecurity risks introduced by third-party Industrial Control System (ICS) integrators. The advisory emphasizes that these external partners, while essential for operations, can serve as a vector for malicious actors to access sensitive Operational Technology (OT) networks. The core recommendations focus on implementing the principle of least privilege, embedding robust security clauses into contracts, and diligently monitoring all remote connections to prevent disruptive and destructive attacks.

Threat Overview

Third-party ICS integrators, which provide services ranging from system design and installation to maintenance and support, often require deep access to a client's OT environment. This access, if not properly secured, creates a significant supply chain risk. Malicious actors can compromise a trusted integrator to gain a foothold in the networks of multiple critical infrastructure operators.

The advisory references a 2025 incident where foreign cyber actors compromised a U.S. industrial automation solutions company. The attackers used their access to the integrator's network to search for sensitive client information, using terms like 'SCADA' and 'customers.' They successfully compiled approximately 800 files for exfiltration, containing ICS device details and schematics that could be used to plan future attacks against the integrator's clients. This highlights a direct pathway from a compromised third party to the potential disruption of critical national functions.

Technical Analysis

The attack pattern described involves leveraging a trusted third-party relationship to bypass perimeter defenses. The primary tactic is the abuse of legitimate, pre-existing access granted to the ICS integrator.

MITRE ATT&CK Techniques

• T1199 - Trusted Relationship: The core of this threat involves attackers compromising a third-party integrator to exploit the trusted relationship it has with its clients (the critical infrastructure operators).
• T1078 - Valid Accounts: Once the integrator is compromised, attackers would likely use the integrator's legitimate credentials to access client networks.
• T1021.001 - Remote Services: Remote Desktop Protocol: A common method for integrators to access client systems, which attackers would abuse for lateral movement and persistence.
• T1105 - Ingress Tool Transfer: Attackers may use the integrator's access to transfer malicious tools into the target OT environment.
• T1048 - Exfiltration Over Alternative Protocol: The act of compiling and exfiltrating 800 files suggests a planned data theft operation, likely using covert channels.

Impact Assessment

A successful compromise via a third-party integrator could have severe consequences for critical infrastructure. Potential impacts include:

• Operational Disruption: Attackers could manipulate or shut down industrial processes, leading to service outages in sectors like energy, water, and transportation.
• Physical Damage: In some OT environments, unauthorized control could lead to equipment damage or catastrophic failures, posing a risk to public safety.
• Intellectual Property Theft: The exfiltration of ICS schematics, device configurations, and operational data represents a significant loss of sensitive intellectual property that could be used to engineer further attacks.
• Espionage: Foreign adversaries can use this access to gather intelligence on a nation's critical infrastructure capabilities and vulnerabilities.

IOCs — Directly from Articles

No specific Indicators of Compromise (IOCs) were provided in the source articles.

Cyber Observables — Hunting Hints

Security teams may want to hunt for the following patterns to detect abuse of integrator access:

Detection & Response

Defenders should focus on gaining visibility into all third-party activities within their network.

1. Monitor Remote Access: Implement robust logging for all VPN, RDP, and other remote access solutions. Analyze logs for unusual connection times, geographic locations, or multiple failed login attempts from integrator accounts. This aligns with D3FEND techniques like D3-LAM - Local Account Monitoring.
2. Network Traffic Analysis: Use network monitoring tools to baseline normal traffic patterns associated with integrator activities. Set up alerts for anomalous data flows, such as large data transfers to unknown external destinations or connections to suspicious domains. This corresponds to D3-NTA - Network Traffic Analysis.
3. Endpoint Detection and Response (EDR): Deploy EDR solutions on jump boxes and other systems accessed by third parties. Monitor for suspicious process execution, command-line arguments, and file modifications indicative of reconnaissance or lateral movement.

Mitigation

The CISA/FBI advisory provides several key mitigation strategies:

1. Enforce Principle of Least Privilege (PoLP): Grant integrators only the minimum level of access required to perform their duties. This includes restricting access to specific systems, data, and time windows. This is a core part of D3FEND's D3-UAP - User Account Permissions hardening.
2. Incorporate Security in Contracts: Legal agreements with integrators should explicitly define cybersecurity requirements, including data protection standards, incident notification timelines, secure remote access procedures, and rights to audit.
3. Secure and Monitor Remote Access: All remote connections should be authenticated using MFA. Where possible, use on-demand, session-based access that is terminated immediately after use. All sessions should be logged and reviewed.
4. Asset Management: Maintain a comprehensive inventory of all hardware and software provided or managed by the integrator. This is crucial for patch management and vulnerability scanning.
5. Network Segmentation: Isolate the OT network from the IT network and the internet. Use demilitarized zones (DMZs) to control access between network segments, limiting an attacker's ability to move laterally from a compromised IT system to the OT environment.