X-Force 2022 Insights: An Expanding OT Threat Landscape

X-Force 2022 Insights: An Expanding OT Threat Landscape

This post was written with contributions from Dave McMillen.

So far 2022 has seen international cyber security agencies issuing multiple alerts about malicious Russian cyber operations and potential attacks on critical infrastructure, the discovery of two new OT-specific pieces of malware, Industroyer2 and InController/PipeDream, and the disclosure of many operational technology (OT) vulnerabilities. The OT cyber threat landscape is expanding dramatically and OT asset owners and operators, all of whom understand the need to keep critical infrastructures running safely, need to be aware of the shifting landscape and what they should be doing to secure their operations.


IBM Security X-Force analysts looked at X-Force Incident Response (IR) and Managed Security Services (MSS) data to provide OT defenders with the intelligence necessary to protect their assets.


  • Most Common Attack Attempts:  Widespread and likely indiscriminate internal and external vulnerability scanning, as well as brute force attacks and use of weak and outdated encryption standards, are the most common attack attempts against OT-related industries’ IT and OT environments observed so far in 2022.

  • Most Common Initial Access Vector: Phishing continued to be the most prevalent initial access vector identified across incidents that IBM responded to across OT industries.

  • Top Incidents: The majority of incidents X-Force responded to involved malspam, with clients both receiving emails with the Emotet Trojan and bei ..

    Support the originator by clicking the read the rest link below.