Sandworm and Manufacturing: State APTs Do Not Target Only Large Infrastructure

Sandworm is not just a Ukrainian problem

Sandworm is the name the threat intelligence community uses for an APT group attributed to Unit 74455 of the GRU, the Russian military intelligence service. Its notoriety is tied to some of the most disruptive cyberattacks in recent history: the Ukrainian power blackouts of 2015 and 2016, the attack using the Industroyer malware, and above all the launch of NotPetya in 2017.

NotPetya is often remembered as an attack against Ukraine. But the greatest damage, in absolute economic terms, was suffered by multinational companies that also operated in Ukraine and had interconnected networks. Maersk lost control of tens of thousands of computers within hours. Merck saw its pharmaceutical plants compromised. Saint-Gobain suffered damage estimated at hundreds of millions of euros. These organizations were not the target: they were collateral damage from a wiper designed to spread as fast as possible by exploiting EternalBlue.

This is the point that many Italian manufacturing SMEs have still not internalized: in large-scale APT attacks, collateral damage is not a negligible side effect. It is often the norm.

How Sandworm's TTPs apply to manufacturing OT

The tactics, techniques and procedures (TTPs) documented for Sandworm follow a recognizable pattern that applies directly to manufacturing environments.

Initial access via IT: Sandworm does not enter OT networks directly. The initial access point is almost always the IT infrastructure: spear phishing aimed at employees with access to corporate systems, VPN compromise, exploitation of vulnerabilities in internet-facing applications. This means that the initial attack surface is corporate IT, not the PLCs or SCADA systems.

Persistence and reconnaissance: once a foothold is gained in IT, the operators conduct internal reconnaissance for weeks or months. The goal is to map the network, identify credentials with elevated privileges, understand where the industrial control systems are located and how to reach the OT networks. This stage is often carried out with legitimate network administration tools (living off the land), making signature-based detection difficult.

Lateral movement toward OT: the transition from the IT network to the OT network happens through existing interconnection points. Engineering workstations that have access to both IT and OT networks are a classic vector. Jump servers, vendor remote-access connections, historian systems that aggregate OT data and make it available to IT: all of these are potential bridges.

Destructive or disruptive payload: in OT, the ultimate goal of a Sandworm attack is not necessarily data exfiltration. Industroyer and Industroyer2 were designed to modify the configuration of protection relays and cause blackouts. CrashOverride targeted electrical breaker control systems. In manufacturing, similar payloads can aim to alter process parameters, change PLC logic, or simply destroy configuration data, forcing a rebuild from scratch.

Why European manufacturing SMEs are on the radar

Italian manufacturing SMEs might think they are too small to be a target for an APT group linked to a military intelligence service. This risk assessment is wrong for at least three reasons.

European manufacturing as a supply chain to strategic targets: many manufacturing SMEs produce components or supplies for strategic sectors: defense, aerospace, energy, infrastructure. Compromising a tier-two or tier-three supplier can be the vector to reach a tier-one target. Supply chain attack campaigns documented in recent years show that sophisticated attackers are willing to invest heavily to enter the supply chain of a strategic target.

Collateral damage as a tool: NotPetya was not aimed at European manufacturing, but it devastated it. A future campaign with similar objectives would have the same effect. SMEs with interconnected IT-OT networks and poor visibility are particularly vulnerable to this kind of collateral damage.

The replication of TTPs by less sophisticated actors: the techniques developed and made public by APT groups like Sandworm are systematically replicated by actors with smaller capabilities. Industrial ransomware in recent years often uses lateral movement and OT access techniques that derive directly from documented APT playbooks. You do not need to be in the GRU's sights to suffer an attack that uses the same TTPs.

The blind spots that turn a company into a collateral victim

Analyzing industrial incidents from recent years, recurring patterns emerge in the organizations that suffered serious damage from attacks that did not have them as a primary target.

OT networks reachable from IT without visibility: the lack of segmentation is not the only problem. The real problem is not knowing that segmentation is absent or that undocumented paths exist between IT and OT. An organization that does not have an inventory of its OT assets and of the connections between networks does not know what it is protecting and cannot detect lateral movement.

Shared credentials and unmanaged accounts: Sandworm and similar groups systematically exploit default credentials, weak passwords, and service accounts with excessive privileges. In manufacturing, it is still common to find PLCs and HMIs with unchanged default credentials, or VPN accounts shared between internal technicians and external vendors.

Software updates missing for years: EternalBlue, the vulnerability NotPetya used to spread, had been patched by Microsoft months before the attack was launched. Organizations that had applied the patches were protected. Those that had not suffered the collapse of their networks. In OT environments, where patching cycles are longer, this exposure window can last years.

Absence of OT monitoring: without OT network telemetry, there is no way to detect the reconnaissance phase or lateral movement toward the control systems. The only moment when the attack becomes visible is when it manifests as operational damage, which is when it is already too late.

What to watch for to detect Sandworm-like TTPs in OT

The good news is that many of the TTPs documented for Sandworm leave identifiable traces if you have the right visibility.

Anomalous SMB traffic in the OT network: EternalBlue propagates through SMB. SMB traffic to or from OT devices that should not generate it (PLCs, HMIs, field devices) is a relevant indicator of compromise.

New connections to the internet from OT systems: Industroyer and related malware establish connections to external command-and-control infrastructure. A SCADA workstation generating traffic toward undocumented external IPs is a signal worth investigating.

PLC configuration changes outside maintenance windows: changes to PLC logic or to configuration parameters that occur outside planned maintenance windows are a critical indicator. In systems with a historian or with OT network monitoring, these events are detectable.

Anomalous lateral communications between OT systems: malware that propagates laterally generates traffic patterns that do not match normal operational behavior. A PLC that starts attempting connections to other PLCs unrelated to its process is a signal worth examining.

Detecting these patterns does not necessarily require sophisticated technologies: it requires visibility. The first priority is to know what is on the OT network and to understand what normal traffic looks like, so that deviations are recognizable.

---

State APTs like Sandworm have redefined what we mean by "cyber warfare". But the real damage of recent years shows that the line between targeted attacks and collateral damage is thin. For an Italian manufacturing SME, the question is not whether it is important enough to be a direct target: it is whether it is resilient enough to survive as a collateral victim.

The MON5 angle

SMB traffic toward PLCs, new external connections from a SCADA workstation, logic changes outside maintenance windows: the Sandworm-like indicators listed above are detectable only if someone observes the OT network continuously. MON5 does this with passive, out-of-band NDR on native industrial protocols (Modbus, Siemens S7, OPC UA, PROFINET, EtherNet/IP) and with ML anomaly detection that flags deviations from the operational baseline.

For an SME that fears collateral damage more than the targeted attack, the priority is visibility into assets and lateral movement between IT and OT. A good starting point is an OT assessment conducted without interrupting production.