Adversaries may use information from Remote System Information Discovery to aid in targeting and shaping follow-on behaviors. This information may be used to tailor management actions, such as program download and system or module firmware. Backdoor.Oldrea payload gathers server information that includes server name, server name and OPC version, vendor information, running state, group count, and server bandwidth. The Industroyer IEC 61850 component sends the domain-specific MMSrequest to determine what logical nodes the device supports. It then searches the logical nodes for the CSW value, which indicates the device performs a circuit breaker.”]
Source: https://collaborate.mitre.org/attackics/index.php/Technique/T0888