Mandiant’s research shows a rise in attackers this past year attempting to monetize their access to an exposed ICS system. Researchers identified a noticeable uptick in OT-related incidents since 2020, with most of the actors not looking to turn off the lights, poison the water, or perform any physical outcome. The attacks are mainly rudimentary attacks that exploit industrial control systems inadvertently exposed to the open Internet or that abuse chronically weak or shared credentials. In all of the incident-response cases it worked on, the attackers gained access to the victim’s ICS via the Internet.”]