Covert networks and hidden C2 channels in OT environments: how APTs operate

Establishing the foothold: how APTs get into OT networks

Advanced Persistent Threats that target industrial environments are not after quick compromise. Their defining trait is patience: they get in, settle quietly, and spend weeks or months mapping the environment before acting (if they ever act: in some cases the presence itself has value as deterrence or intelligence gathering).

Initial access rarely happens through sophisticated zero-day vulnerabilities. The most common vectors are far more mundane: compromised credentials for remote access, phishing against employees with access to OT systems, compromise of a vendor with trusted access, and known unpatched vulnerabilities on exposed systems.

Once first access is obtained, the APT's work becomes building persistence and establishing command and control (C2) channels that survive detection attempts and partial remediation.

C2 channels in industrial networks: DNS, timing, steganography

The challenge for APTs in OT networks is communicating with their external infrastructure without being detected. Industrial networks often have highly predictable traffic, with few services exposed toward the Internet. This makes traditional C2 difficult, but not impossible.

DNS tunneling: DNS is one of the few protocols that is almost universally allowed through firewalls. By encoding data in the DNS records of attacker-controlled domains, it is possible to create a low-bandwidth bidirectional channel that crosses almost every network filter. In an OT environment where few devices make DNS queries, an anomalous volume of requests toward unknown domains is a signal, but it requires specific monitoring to be detected.

Timing channels: some advanced C2 techniques do not encode data in visible payloads, but in the timing of the packets. Modulating the intervals between legitimate communications creates a steganographic channel that is practically invisible to traffic content analysis.

Abuse of industrial protocols: in environments where Modbus, OPC-UA, or other industrial protocols are allowed, an attacker with network access can use these channels for C2 communications. Malicious commands blend into legitimate automation traffic.

Slow exfiltration: in some documented cases, data is exfiltrated in very small volumes over the course of weeks, often during normal maintenance windows or at times of high traffic. The bandwidth is negligible but the coverage is maximal.

Living-off-the-land in OT: using legitimate tools to hide

One of the most effective techniques used by modern APTs in OT is living-off-the-land (LotL): using tools and features already present in the environment instead of installing recognizable malware.

On Windows SCADA workstations, this means using PowerShell, WMI, native networking features, and legitimately installed PLC engineering tools. An attacker who uses ping, netstat, vendor PLC programming tools, and PowerShell scripts does not introduce new binaries that detection systems might identify.

In OT environments, engineering tools are especially useful for LotL: the programming software for a Siemens or Rockwell PLC has read/write functions for the logic that an attacker with access to an engineering workstation can use directly. It is access to control functions without the need for an exploit.

OT-specific indicators of compromise

Detecting APTs in OT environments requires looking for signals different from those typical in IT:

Unusual access to engineering tools: reading or modifying PLC logic outside planned maintenance windows, from unusual accounts, or with anomalous frequency.

Communications toward new IPs or domains: in an OT network with predictable traffic, any new network destination is suspicious. It requires an inventory of baseline communications.

Anomalous DNS queries: an unusual volume of DNS queries, especially toward recently registered domains or domains with an algorithmically generated naming pattern (DGA).

Modification of configuration files: changes in the configuration files of SCADA systems, in PLC logic, or in the startup files of supervisory systems, without a corresponding documented change request.

Accounts with unusual activity: out-of-hours logins, unusually long sessions, and commands unusual relative to the normal use of that account.

Detection and hunting in industrial networks

Detecting APTs in OT networks cannot rely on automated systems alone: it requires active threat hunting, that is, the proactive search for indicators of compromise by analysts with specific knowledge of the environment.

The fundamental principles:

Network traffic baseline: without knowing what is normal, it is impossible to identify what is anomalous. Building a rigorous baseline of OT traffic (who talks to whom, over which protocols, with what frequency) is the prerequisite for any effective detection activity.

Centralized logs and adequate retention: OT system logs must be centralized in a system that cannot be modified by the attacker and kept for a sufficiently long period. APTs can lie dormant for months: logs with 30-day retention do not allow retroactive analysis.

Correlation between OT and IT events: many OT attacks start in IT. Correlating events on the IT network with anomalous behavior on the OT network can reveal patterns that do not emerge when analyzed separately.

OT incident response as an exercise scenario: organizations that regularly drill APT compromise scenarios, even in tabletop form, develop the ability to recognize the signals when they actually appear.

The presence of an APT in an OT network is rarely a high-noise event. It manifests in weak signals, distributed over time, that require continuous attention and specific skills to be recognized.

The MON5 angle

A periodic beacon toward an unknown domain, an anomalous DNS query, a Modbus command that falls outside the operational pattern: the signals of a C2 channel are weak by definition, and they only become visible against a rigorous traffic baseline. This is the territory of the MON5 PROTECT phase: passive out-of-band NDR on native OT protocols (Modbus, Siemens S7, OPC UA, PROFINET, EtherNet/IP) and ML-based anomaly detection that learns the normal behavior of the network to surface deviations.

Before hunting for an APT, however, you need to know what is on the network and who talks to whom: an OT assessment builds this foundation without stopping production.