Claroty recently published their State of CPS Security 2025: OT Exposures report. The report analyzes nearly one million OT devices, most of which are found in the manufacturing, logistics and transportation, and natural resources sectors. The data shows that many organizations face the challenge of prioritizing which vulnerabilities to remediate first due to the sheer number of KEVs (known exploited vulnerabilities) present across OT devices.
Key findings include:
- 12 percent of OT devices analyzed contain KEVs and 40 percent of organizations have a subset of these devices insecurely connected to the internet.
- Seven percent of OT devices are exposed with KEVs linked to known ransomware samples, with 31 percent of organizations having these assets insecurely connected to the internet.
- 12 percent of industrial organizations had OT assets communicating with malicious domains, underscoring active threats.
- The manufacturing industry was found to have the highest number of devices with confirmed KEVs, devices with confirmed KEVs linked to ransomware, and devices with confirmed KEVs linked to ransomware and insecurely connected to the internet.
The report also offered perspective on some active threat actors:
- China-based Volt Typhoon and Salt Typhoon: Volt Typhoon uses native legitimate tools to exploit weak or default passwords for access. Salt Typhoon has been linked to breaches against U.S. internet service providers and ISP wiretap systems, allegedly exfiltrating data useful for intelligence operations.
- Russia-based Sandworm: The group is allegedly responsible for several attacks against Ukraine’s power grid, as well as the NotPetya malware. It is also responsible for the deployment of Industroyer and Industroyer 2, which was purpose-built malware targeting industrial equipment communicating over the IEC-104 (IEC 60870-5-104) protocol. In Ukraine, the targets were power system automation applications used in high voltage electrical substations.
- CyberAv3ngers: Under the watch of the Islamic Revolutionary Guard Corps Cyber Electronic Command (IRGC-CEC), this group has vowed to target any OT and enterprise technology developed in Israel. In late 2023, they targeted Unitronics’ integrated HMI/PLC devices inside U.S. water facilities, and in December 2024, attacks against civilian infrastructure were disclosed using a Linux-based backdoor called IOCONTROL that has a modular configuration that allows it to be used against OT assets, including PLCs and HMIs.
