Recent attacks against water utilities, refrigeration systems, and energy infrastructure show how adversaries can disrupt physical operations through exposed devices, interconnected networks, and compromised IT systems. Understanding those different paths requires clear visibility into both IT and OT network traffic.

Operational Technology (OT) forms the silent, mission-critical backbone of modern society, managing everything from power grids to global manufacturing and clean water. While enterprise IT data breaches often dominate the news, cyber threats against OT-connected devices continue. In 2026, cyberattacks against the critical infrastructure sector have included water utilities, medical, and retail sectors, causing physical disruption, downtime, and financial loss.

In October 2026, cyberattacks against refrigeration systems affected hundreds of supermarkets, mainly in France. Attackers compromised commercial refrigeration management systems and manipulated defrost settings, causing food and financial loss, and in some cases, started fires.

Most industrial controllers are not directly exposed to the internet. In these architectures, an attacker’s path is via the IT network to reach the operational network. In August 2026, CERT Polska detailed an attack against a Polish combined heat and power (CHP) plant that began with compromised VPN infrastructure at a separate wind farm in December 2025. From the wind farm, the attackers moved through a cellular router and private network to reach the plant's industrial control systems (ICS). The attackers manipulated the industrial controllers, shutting down a steam turbine and process-water treatment system. With low temperatures near or below freezing, the attack risked cutting off heat to roughly 50,000 customers before operators intervened. Plant operators were able to prevent a disruption to customer’s heat supply. This incident demonstrates how compromised IT infrastructure can provide attackers with a path into OT networks, allowing them to manipulate industrial controllers that aren’t directly exposed to the internet.These incidents illustrate why OT security extends beyond monitoring internet-facing controllers. These attacks followed different paths, but both relied on technologies routinely used to manage operational equipment. Remote-access infrastructure, administrative interfaces, and industrial protocols can provide attackers with access to systems responsible for physical processes.

ExtraHop RevealX provides network visibility across monitored IT and OT environments, including new detections for external connections to and from OT devices, first-observed Modbus, DNP3, and BACnet activity. Together with existing detections across the attack-chain, this network evidence can help defenders investigate suspicious activity as it moves between enterprise and operational networks.

Two Route to Operational Disruption

Attackers can reach operational systems through two broad pathways: direct access to exposed devices or indirect access through connected infrastructure.

Neither necessarily requires specialized malware or zero-day vulnerabilities. Existing remote-access services, administrative interfaces, and legitimate control software can provide the functionality needed to interact with operational equipment.

Direct access through operational devices exposed to the internet

Internet-accessible OT devices can give attackers access to the same management interfaces used by engineers and operators. The July 2026 attacks on U.S. water utilities demonstrated the risks of exposed operational infrastructure. Per the FBI's July 30 advisory, attackers remotely accessed internet-facing Rockwell Automation MicroLogix 1100 and 1400 programmable logic controllers (PLCs). The attackers altered IP addresses, passwords, and PLC project files, disrupting communications between the PLCs and supervisory systems and, in some cases, locking operators out of equipment. At least one victim reported unauthorized modifications to PLC project files, including discrepancies in ladder logic. Across affected utilities, the operational consequences included water pressure loss and flooding.

Operational effects depend on what the compromised controller manages. Changing its IP address can interrupt communications with an HMI or SCADA system, leaving operators without current equipment status. While unauthorized programming changes can alter how a controller responds to process conditions. In CISA advisory AA26-097A, Iranian-affiliated actors used legitimate PLC engineering software to retrieve project files and modify control logic, including instructions governing shutdown and alarm functions. Observed malicious connections targeted ports associated with Common Industrial Protocols (TCP/44818 and TCP/2222), Modbus (TCP/502), and Siemens S7 (TCP/102).

Direct access OT attacks also affect commercial sectors. In October 2026, attackers compromised refrigeration management systems at ~700 European supermarkets, primarily in France. By manipulating normal settings to raise defrost temperatures and cycles, they caused food spoilage. France's Cybersecurity Agency (ANSSI) confirmed the compromises involved Danfoss AK-SM and AK-SC controllers, as well as Copeland and Dixell XWEB systems. Several affected products were outdated or no longer supported. These events highlight the continued risks facing accessible internet-facing OT devices.

The implications extend beyond supermarkets. Similar remotely managed technologies support commercial refrigeration, HVAC, pharmaceutical storage, and other temperature-sensitive operations. Compromising these systems can affect physical processes, product integrity, and business continuity, even when the affected equipment is not part of a traditional industrial control environment.

ExtraHop RevealX's New Inbound OT Connection and New Outbound OT Connections detection flags new external connections to or from internal OT assets like PLCs, human-machine interface (HMIs), and engineering workstations. While vendor maintenance and remote monitoring may trigger similar traffic, investigating these events provides critical visibility based on device roles and context.

The indirect path through interconnected devices

Many operational systems aren’t directly accessible from the internet. They operate on segmented networks, communicate through remote gateways, or rely on private cellular infrastructure. Although these systems may not be accessible from the public internet, interconnected infrastructure can still provide attackers with paths into OT environments.

A detailed investigation published by CERT Polska in August 2026 demonstrates how this can happen.

Inside the Polish Energy-Sector Intrusion

According to CERT Polska's August 2026 investigation, the attacker initially gained access to a wind farm through an internet-facing FortiGate VPN concentrator and firewall. The VPN lacked multifactor authentication, although investigators could not establish whether the initial compromise involved exploiting a vulnerability or obtaining credentials.

From the compromised network, the attacker accessed a Teltonika RUTX50 cellular router connected to both the wind farm's Ethernet network and a private cellular Access Point Name (APN) network. The architecture required DNP3 communications between the distribution system operator (DSO) and remote terminal units (RTUs), using an RS-485 serial connection between the router and RTU.

After accessing the router's administration interface and SSH service, the attacker likely established an SSH tunnel into the private APN. There, the attacker discovered a WAGO PFC200 controller using default administrative credentials, likely enabled SSH on its WAN interface, and established another tunnel into the CHP plant's OT network.

Investigators identified unsuccessful administrative login attempts against an internal firewall/VPN gateway, followed by scanning for Siemens S7 (TCP/102), Modbus (TCP/502), and CODESYS (TCP/11740), along with VNC, RDP, and web services. Notably, the internal scanning occurred on Sunday, December 21, eight days before the disruptive attack. On Christmas Day, the attacker successfully established S7 connections to three Siemens PLCs.

Finally, on December 29, the attacker executed their attack, accessed the plant's SCADA interface, and manipulated Siemens PLCs. Plan operators reported that the controllers were switched to STOP mode and password-protected, shutting down a steam turbine and process-water treatment system. Operations were restored before customers lost heat or electricity.

This intrusion demonstrates how an attacker can cross the boundaries of IT and OT devices, even when critical systems are not directly connected to the public internet. In this intrusion, the attacker used remote-access infrastructure, an intermediary industrial network, a cellular service, and an OT device that could reach other plant systems.

ExtraHop RevealX provides network visibility into attacker behavior across IT and OT environments, including networks isolated from the internet. From suspicious remote access at the enterprise perimeter to lateral movement and unexpected communications with industrial controllers, RevealX helps analysts investigate abnormal patterns and communications across monitored network segments.

In HopCloud-connected environments, detections such as VPN Gateway Access from an Unusual Location and Unusual Login Time, identify anomalous access patterns. The new Modbus, DNP3, and BACnet Activity detections (coming soon to airgapped licenses) identify devices beginning to use these protocols for the first time or after a prolonged absence. For air-gapped RevealX deployments, SSH, RDP, and SMB Activity between Internal Devices, providing additional evidence of potential lateral movement without requiring cloud connectivity. These deployment-specific capabilities help security teams investigate suspicious activity across enterprise and operational networks using observed device behavior and communication patterns.

Image 1: Overview of RevealX air-gapped detections

When Familiar Devices Begin Communicating Differently

Honeywell Technologies' 2026 OT Cybersecurity Benchmark Report survey found that only 21% respondents reported having a complete OT asset inventory. Without an accurate inventory, security teams may not know which PLCs, engineering workstations, or building automation controllers are present. Security teams lose visibility on the routine system communications and the ability to define and monitor their OT attack surface. An attacker moving from a compromised IT system toward an undocumented controller may generate observable network traffic, but defenders may lack the context to recognize the destination as a critical operational asset.

ExtraHop RevealX passively discovers communicating devices and provides visibility into their network relationships and protocol activity. The new OT detections identify changes in those communications, such as an external system establishing a new connection to an OT device or an internal system beginning to use Modbus, DNP3, or BACnet protocols unexpectedly.

Direct access: New external connections to operational devices

The 2026 attacks against U.S. water utilities illustrate how attackers can manipulate operational equipment through internet-accessible management interfaces.

Network detection platforms like RevealX flag these blind spots by alerting teams the moment an external IP establishes a session to an internal PLC (New Inbound OT Connection detection). A complementary detection is New Outbound OT Connection, which identifies newly observed connections initiated by internally classified OT devices to external servers.

For example, an engineering workstation or building management system unexpectedly initiating external communications could warrant investigation, particularly if the activity follows suspicious administrative access.

Image 2: RevealX New Outbound OT Connection detection card

Image 3: RevealX New Inbound OT Connection detection card

Indirect access: When an internal device begins using OT protocols

As demonstrated by the Polish energy-sector attack, attackers can traverse remote-access infrastructure, cellular networks, and other interconnected systems before reaching industrial controllers.

Once an attacker compromises a system with access to an operational network, OT devices may begin communicating with equipment it doesn't normally interact with. RevealX's new Modbus, DNP3, and BACnet activity detections identify devices beginning to use these protocols for the first time or after an extended period without observed activity.

Modbus: Communications across industrial environments

Modbus is widely used in manufacturing, energy infrastructure, water and wastewater treatment, and other industrial environments. It commonly supports client-server communications involving PLCs, supervisory systems, engineering workstations, and field equipment.

An engineering workstation may legitimately issue Modbus requests during maintenance. However, a workstation beginning to use the protocol unexpectedly, particularly after suspicious remote administration or reconnaissance, presents a different investigation question.

Image 4: RevealX New Modbus Activity detection card

DNP3: Monitoring geographically distributed infrastructure

DNP3 is commonly used in geographically distributed operational environments, including electric utilities and water systems. The Polish intrusion provides one example of DNP3's role in distributed energy infrastructure. The distribution system operator required DNP3 for legitimate communications with RTUs.

Although the attacker did not demonstrably exploit DNP3, the incident shows how operational networks depend on interconnected communications infrastructure. In environments where DNP3 runs over observable networks, newly observed requests from an unexpected internal client can provide evidence for investigation.

Image 5: RevealX New DNP3 Device Activity detection card

BACnet: OT beyond the industrial sector

Daily life depends on services that aren’t OT operations, such as hospitals, airports, and retail facilities. As seen in the cyberattack against refrigeration controllers, these services rely on automation to maintain required environmental conditions. BACnet supports communications among building automation and control systems, including HVAC, energy management, lighting and other other systems that support daily business operations.

Honeywell also found that only 16% of respondents continuously monitor more than three-quarters of their building automation systems. For connected IoT devices, including cameras and thermostats, that figure was 20%. These devices often operate alongside enterprise infrastructure but are managed by facilities teams or third-party providers.

Image 6: RevealX New BACnet Activity detection card

Why passive monitoring matters in OT

Monitoring operational networks introduces requirements that differ from those of typical enterprise environments. Many PLCs, RTUs, sensors, and other industrial devices have limited processing resources, run specialized operating systems, or lack support for conventional endpoint security agents. Others operate equipment where timing and availability directly affect production or safety.

Unlike ordinary enterprise applications, a disruption to a controller's communications can affect the physical process it manages. The NIST Guide to OT Security addresses these constraints, including the performance, reliability, and safety considerations that distinguish operational systems from conventional IT environments. These characteristics make passive network monitoring particularly valuable.

ExtraHop RevealX analyzes the network traffic out-of-band, via supported monitoring infrastructure, such as network taps and mirrored switch ports. Because the sensor operates outside the production traffic path, it does not add an additional packet-processing hop between controllers, HMIs, or other operational devices. This avoids adding inline sensor-processing latency to their communications.

Regulatory requirements increasingly recognize OT monitoring

The operational consequences of cyberattacks have prompted governments and regulators to introduce cybersecurity requirements for critical infrastructure. Several frameworks emphasize asset management, network monitoring, and incident reporting, although their scope and applicability differ.

ExtraHop RevealX uses passive network analysis to discover and classify devices communicating across monitored IT and OT networks, helping organizations identify operational assets and understand their communication patterns. The new detections for Modbus Activity, DNP3 Activity, and BACnet Activity identify devices beginning to use these industrial protocols for the first time or after an extended period without observed activity. Complementary New Inbound OT Connection and New Outbound OT Connection detections identify newly observed external TCP connections involving classified OT devices.

Together, these capabilities can help organizations validate asset inventories, investigate unexpected connections, and document changes in operational communications.

Follow the Attack Path, Not the Organizational Boundary

The attacks against U.S. water utilities, French refrigeration systems, and Poland's energy infrastructure demonstrate how adversaries can disrupt physical operations through different access paths. Some directly target operational equipment, while others exploit connections between enterprise networks, remote-access infrastructure, and industrial systems. In Poland, the attacker moved through a VPN gateway, cellular router, private APN, and industrial controller before reaching the CHP plant's operational network.

Much of that activity involved legitimate protocols and administrative capabilities. An SSH connection, network scan, or industrial protocol request isn't inherently suspicious. However, when those activities occur in an unexpected sequence, involve unfamiliar devices, or cross network boundaries, they can provide evidence of abnormal behaviors worth investigating.

With sensors monitoring the relevant traffic, ExtraHop RevealX enables security analysts to effectively investigate these complex interactions. The platform introduces New OT connection detections to flag previously unseen external communications to or from operational devices. Dedicated detections for industrial protocols, such as Modbus, DNP3, and BACnet, surface shifts in protocol usage patterns. Paired with existing capabilities (such as VPN Gateway Access from an Unusual Location and Unusual Login Time detection), that identify remote administration and reconnaissance, this network telemetry provides analysts with the necessary visibility to trace suspicious activity as it traverses IT and OT domains.

Resources

• CERT-FR: Incident de sécurité ciblant les contrôleurs à distance des installations de réfrigération
• CERT.PL: Energy Sector Incident Report – 29 December
• CERT.PL: Follow-Up Analysis of the 29 December 2025 Energy Sector Incident
• FBI: Malicious Cyber Actors Targeting Water and Wastewater Sector Internet- Facing Programmable Logic Controllers, Causing Operational Disruptions
• Honeywell: 2026 OT Cybersecurity benchmark report
• Rewind Weather: Weather forecast history in Poland in December 2025