Critical Infrastructure Network Attacks: Code Red, Alert Network Operators
summary
A deployed electric transmission substation honeypot is internet-facing for two days before initial compromise via brute-forced RDP on a remote technician interface; attacker stages a multi-stage ransomware campaign using Mimikatz and PSExec (SMB and later pass-the-ticket in OT), steals credentials and exfiltrates data, drops but delays ransomware across hosts, pivots IT→OT via an HMI web vuln, then detonates across IT and OT on day 24 — operation shows cybercrime playbook that reliably reaches OT.
AI-written summary · about
chapters (9)
- 0:00Intro
- 0:23The Honeypot Research Goals
- 3:24Single Stage Ransomware
- 5:05Multi-Stage Ransomware
- 8:02An Electric Transmission Substation Honeypot
- 10:37Incident Timeline at a Glance
- 19:33Persistence
- 20:42Network Discovery
- 21:48Credential Theft
related talks
52mRansomware; The Real Pandemic
51mPreparing for and Defending OT Systems from Ransomware
52mRansomware 101: Get Smart Understanding Real Attacks
21mRansomware Attack: Lessons Learned
32mSurviving a Ransomware Attack - Lessons from the Field
41mRansomware Incident Response - The Real-World Story of a Ransomware Attack
20mConnecting the Dots in a Cyber Pandemic Era
42mStart Covering Your Bases And Stop Chasing APT Headlines