Internet-facing software may be user applications, underlying networking implementations, an assets operating system, weak defenses, etc. Targets of this technique may be intentionally exposed for the purpose of remote management and visibility. An adversary may seek to target public-facing applications as they may provide direct access into an ICS environment or the ability to move into the ICS network. Application isolation and Sandboxing will limit the other processes and system features an exploited target can access. Sandworm Team actors exploited vulnerabilities in GE’s Cimplicity HMI and Advantech/Broadwin WebAccess HMI software.”]
Source: https://collaborate.mitre.org/attackics/index.php/Technique/T0819