Iran-Linked Hackers Disabled a UK Power Plant for Four Days — OT/ICS Detection and Hardening Guide for Critical Infrastructure Defenders

Iran-linked threat actors have shut down a British power generation facility for four days in what The Telegraph describes as the most successful cyberattack of its kind against UK energy infrastructure. This is not a data breach, a ransomware detonation on the IT side, or a defaced website. This is a confirmed, multi-day operational outage of critical national infrastructure — the scenario OT security teams have war-gamed for a decade, now executed in the open.

The timing is not coincidental. Concurrent with the UK energy attack, water infrastructure across 12 US states was targeted by the same Iran-linked threat ecosystem. This pattern matches the operational tempo we've tracked from groups like CyberAv3ngers and affiliated IRGC-nexus actors since late 2023: internet-exposed programmable logic controllers (PLCs), HMIs with vendor-default credentials, and opportunistic scanning of OT protocols that should never be reachable from the public internet.

If you operate, defend, or consult for any organization with an OT footprint — energy, water, manufacturing, or building management — treat this as your forcing function. The barrier to entry for these attacks remains shockingly low, and the dwell-time-to-impact ratio favors the attacker unless segmentation and monitoring are already in place.

Technical Analysis: How These Campaigns Actually Work

Affected Systems and Exposure Profile

While attribution-specific details remain limited in public reporting, the consistent tradecraft across Iran-linked ICS campaigns targets:

• Internet-exposed PLCs and HMIs — historically Unitronics Vision/Samba series in water-sector attacks, but Siemens S7, Allen-Bradley, and Schneider Electric Modicon devices are equally in scope for energy-sector targeting
• OT protocols reachable from IT or external networks: Modbus TCP (502), EtherNet/IP (44818), DNP3 (20000), Siemens S7comm (102), BACnet (47808)
• Engineering workstations and HMIs running unpatched Windows, often with vendor-default or weak credentials on remote access services (RDP, VNC, TeamViewer-class tools)
• Flat network architectures where a compromised IT asset can reach the control network without crossing a monitored boundary

Attack Chain (Defender's View)

1. Reconnaissance: Internet-wide scanning (Shodan, Censys, custom scanners) for exposed ICS ports and device banners. Unitronics devices, for example, historically shipped with default port 20256 open and a documented default password.
2. Initial access: Default credentials on the PLC/HMI itself, or compromise of an internet-facing remote access pathway into the OT zone.
3. Control manipulation: Direct write commands over Modbus/function codes, logic modification, or HMI screen manipulation — CyberAv3ngers campaigns famously replaced HMI displays with propaganda while disrupting pump and valve control.
4. Impact: In the UK case, the outcome was a four-day generation outage — meaning the attackers either manipulated control logic, tripped safety interlocks, or forced operators to take the plant offline as a containment measure.

Exploitation Status

This is confirmed active exploitation against production critical infrastructure, not a theoretical risk or a proof-of-concept. No CVE is required for most of this activity — default credentials and exposed OT protocols are configuration failures, not software bugs. That distinction matters for remediation: you cannot patch your way out of this. You must segment, monitor, and harden.

Detection & Response

The detections below target the observable behaviors that show up in every one of these campaigns: non-OT hosts speaking OT protocols, engineering workstations executing anomalous processes, and suspicious write activity toward control devices. Tune the subnet placeholders to your environment — an un-tuned version of any of these will be disabled within a week.

Sigma Rules

---
title: IT Host Initiating Connection to ICS/OT Protocol Ports
id: 8f2a1c47-3b6d-4e59-a1c2-7d4e9f0b3a51
status: experimental
description: Detects Windows hosts outside the OT zone initiating network connections to common ICS protocol ports (Modbus, EtherNet/IP, DNP3, S7comm, BACnet). A hallmark of Iran-linked OT campaigns is lateral movement from IT assets directly to control devices.
references:
  - https://securityaffairs.com/197734/cyber-warfare-2/uk-power-plant-disabled-for-four-days-by-iran-linked-hackers-concurrent-with-us-water-attacks.html
  - https://attack.mitre.org/techniques/T0883/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.ics
  - attack.t0883
  - attack.t0855
logsource:
  category: network_connection
  product: windows
detection:
  selection_ports:
    DestinationPort:
      - 502      # Modbus TCP
      - 44818    # EtherNet/IP
      - 20000    # DNP3
      - 102      # Siemens S7comm
      - 47808    # BACnet
      - 20256    # Unitronics PCOM
  filter_engineering:
    Image|endswith:
      - '\Studio5000.exe'
      - '\RSLogix.exe'
      - '\TIA_Portal.exe'
      - '\UnityPro.exe'
      - '\VisiLogic.exe'
  condition: selection_ports and not filter_engineering
falsepositives:
  - Legitimate engineering software polling PLCs — maintain an allowlist of engineering workstation hostnames and source subnets
level: high
---
title: Suspicious Process Execution on HMI or Engineering Workstation
id: 2c7d9e13-5a48-4f61-b8d3-6e1a0c4f7b29
status: experimental
description: Detects command shells, scripting engines, or remote access tooling spawned by or alongside HMI/SCADA software processes — consistent with post-compromise operator activity on OT Windows hosts in Iran-linked ICS intrusions.
references:
  - https://securityaffairs.com/197734/cyber-warfare-2/uk-power-plant-disabled-for-four-days-by-iran-linked-hackers-concurrent-with-us-water-attacks.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
  - attack.ics
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\ccs.exe'            # common SCADA runtime hosts
      - '\ViewStudio.exe'     # FactoryTalk View
      - '\iFIX.exe'
      - '\Explorer.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\vncserver.exe'
      - '\winvnc.exe'
      - '\TeamViewer.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Vendor maintenance scripts during scheduled outage windows — scope to HMI/engineering subnets via asset tags and alert only outside change windows
level: high

KQL — Microsoft Sentinel / Defender Hunt

This query hunts for any non-OT host speaking an OT protocol, plus inbound external connections to ICS ports — the two highest-fidelity signals for this threat class. Deploy it against Defender for Endpoint data and Sentinel-ingested firewall logs.

let IcsPorts = dynamic([502, 44818, 20000, 102, 47808, 20256]);
let OtSubnets = dynamic(["10.20.0.0/16", "192.168.100.0/24"]); // TODO: replace with your OT VLANs
// Part 1: Endpoint connections to ICS ports from outside OT subnets
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemotePort in (IcsPorts)
| extend SrcIsOt = ipv4_is_in_any_range(LocalIP, OtSubnets)
| where SrcIsOt == false
| summarize Connections = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated),
    Targets = make_set(RemoteIP), Ports = make_set(RemotePort)
    by DeviceName, LocalIP, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Connections desc;
// Part 2: Inbound external connections to ICS ports seen at the firewall
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DestinationPort in (IcsPorts)
| where ipv4_is_private(SourceIP) == false
| summarize Hits = count(), Sources = make_set(SourceIP), Devices = make_set(DeviceName)
    by DestinationIP, DestinationPort
| order by Hits desc

Velociraptor VQL — Endpoint Hunt on HMI/Engineering Hosts

Use this artifact across OT Windows hosts to surface live connections to control devices and unexpected remote access tooling — the persistence and access mechanisms these actors lean on.

-- Hunt: OT host network exposure and remote access tooling
-- Targets HMI / engineering workstations for connections to ICS ports and unapproved remote tools
SELECT Pid, Name AS Process, Path AS ExePath,
       local_ip, local_port, remote_ip, remote_port, status
FROM netstat()
WHERE remote_port in (502, 44818, 20000, 102, 47808, 20256)
   OR remote_port in (3389, 5900, 5938)   -- RDP, VNC, TeamViewer
   OR ExePath =~ '(?i)teamviewer|anydesk|vnc|logmein|ammyy|rustdesk'
ORDER BY remote_port

Remediation & Verification Script

Run this from a management host with network reachability to the OT perimeter to audit for the two failure modes driving these campaigns: internet-routable ICS services and OT protocol exposure across segments. Pair it with credential rotation on every PLC and HMI.

#!/bin/bash
# ot-exposure-audit.sh — audit for internet-exposed and cross-segment ICS services
# Run from an authorized management host only. Adjust CIDR ranges to your environment.

OT_RANGES="10.20.0.0/16 192.168.100.0/24"
ICS_PORTS="502,102,44818,20000,47808,20256"
REPORT="ot-exposure-$(date +%F).txt"

echo "=== OT Exposure Audit — $(date) ===" | tee "$REPORT"

# 1. Scan OT ranges for listening ICS protocol ports
echo -e "\n[+] Scanning OT ranges for ICS protocol listeners..." | tee -a "$REPORT"
nmap -Pn -sT -p "$ICS_PORTS" --open $OT_RANGES -oG - | \
  awk '/Ports:/{print $2, $4}' | tee -a "$REPORT"

# 2. Identify hosts answering on Modbus (502) — these must NEVER be internet-reachable
echo -e "\n[+] Modbus (502) responders — verify each is segmented and credentialed:" | tee -a "$REPORT"
nmap -Pn -p 502 --open $OT_RANGES | grep 'Nmap scan report' | awk '{print $NF}' | tee -a "$REPORT"

# 3. Check the perimeter firewall for inbound rules permitting ICS ports
echo -e "\n[+] Checking local firewall for ICS-port permit rules (should return NONE):" | tee -a "$REPORT"
if command -v nft >/dev/null 2>&1; then
  nft list ruleset 2>/dev/null | grep -Ei 'dport.*(502|44818|20000|47808|20256).*accept' | tee -a "$REPORT"
else
  iptables -L -n 2>/dev/null | grep -Ei 'dpt:(502|44818|20000|47808|20256)' | tee -a "$REPORT"
fi

# 4. Verify no ICS service is bound to 0.0.0.0 on this host
echo -e "\n[+] Local listeners on ICS ports bound to all interfaces (should be empty or justified):" | tee -a "$REPORT"
ss -tlnp 2>/dev/null | grep -E ':(502|102|44818|20000|47808|20256)\s' | tee -a "$REPORT"

echo -e "\n=== Manual follow-ups (do not skip) ===" | tee -a "$REPORT"
cat <<'EOF' | tee -a "$REPORT"
1. Rotate EVERY PLC/HMI credential — vendor defaults are the #1 entry vector in Iran-linked OT campaigns.
2. Confirm no OT device appears in Shodan/Censys (search: your ASN + port:502,102,44818,47808,20256).
3. Enforce deny-by-default between IT and OT VLANs; permit only engineering workstations via jump host.
4. Disable remote access tooling (VNC/TeamViewer/AnyDesk) on OT hosts unless brokered through a monitored gateway.
5. Snapshot and offline-backup PLC logic and HMI configurations; verify restoration on a test rig.
EOF

echo "Report written to $REPORT"

Remediation Priorities

This campaign class exploits architecture failures, not patchable bugs. Prioritize in this order:

1. Eliminate internet exposure of OT assets — this week. Audit your external attack surface (Shodan/Censys against your ASNs and IP ranges) for ports 502, 102, 44818, 20000, 47808, 20256, and any HMI web interfaces. Anything found gets pulled behind a firewall or VPN immediately. This is the single action that would have prevented the majority of water-sector intrusions in this campaign wave.
2. Rotate all PLC, HMI, and SCADA credentials. Assume any device that ever had a default password is compromised. Document every device where the vendor prevents credential change — that list is your compensating-controls backlog.
3. Enforce IT/OT segmentation with monitoring at the boundary. Deny-by-default firewall policy between zones; all cross-zone traffic brokered through a jump host with session recording. The KQL query above becomes your standing control to verify the segmentation actually works.
4. Offline backups of PLC logic and HMI configurations. A four-day outage is survivable when you can re-flash controllers from known-good logic. It becomes an existential event when the only copy of the ladder logic was on the compromised device.
5. Establish an OT-aware incident response retainer before you need it. IR in a generation facility is not IT IR — safety systems, regulatory notification obligations (NCSC in the UK, CISA in the US), and plant restart sequencing all require rehearsed playbooks. If your current IR plan doesn't name your OT assets, it isn't an IR plan.
6. Report and coordinate. UK operators: notify the NCSC. US water/energy operators: report to CISA (report@cisa.gov, 888-282-0870) and your sector ISAC (WaterISAC, E-ISAC). Cross-sector visibility is how the 12-state water campaign was correlated in the first place.

The Bottom Line

Four days of lost generation at a UK power plant and concurrent water-sector intrusions across a dozen US states is not two incidents — it's one adversary demonstrating repeatable, scalable capability against under-defended OT. The tradecraft is not sophisticated; the defense, historically, has been absent. Close the exposure, rotate the credentials, verify the segmentation with telemetry, and have an OT-capable IR plan on the shelf. The next plant is already being scanned.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub