# Default ICS Credentials Exploited in Destructive Attack on Polish Energy Facilities

> Default, hardcoded, and well-known credentials in Industrial Control System (ICS) and SCADA components are actively exploited in destructive attacks against Polish energy infrastructure, representing the credential exploitation companion to the Static Tundra campaign (TL-0004/TL-0014/TL-0037). ICS protocols (Modbus TCP, DNP3, OPC-UA, BACnet, EtherNet/IP) were designed for isolated networks without authentication, and legacy devices ship with default credentials documented in publicly available manuals. Attackers leverage default vendor credentials (admin/admin, operator/operator, root/password, factory-set community strings) to gain direct control of PLCs, RTUs, HMIs, and SCADA servers — bypassing IT security controls entirely via the IT-to-OT pivot. CISA, NSA, and NIST SP 800-82r3 have repeatedly warned that default ICS credentials represent the single most exploitable weakness in critical infrastructure, yet surveys consistently find 30-60% of ICS devices running with factory-default credentials in production.

- **Published:** 2026-02-03T11:20:00Z
- **Last reviewed:** 2026-02-03T11:20:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0053
- **ID:** TL-2026-0053
- **Severity:** CRITICAL (CVSS 9.8)
- **Category:** ICS_SCADA
- **Status:** ACTIVE
- **Actor:** Sandworm (Russia)
- **Detections:** 15 · **IOCs:** 42 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Default ICS Credentials: The Persistent Root Cause of Critical Infrastructure Compromise

The Problem — Authentication-Free by Design:

Industrial Control Systems were designed in the 1970s-1990s for isolated, air-gapped networks where physical security was the only access control. Protocols like Modbus (1979), DNP3 (1993), and BACnet (1995) have NO built-in authentication, encryption, or access control. Any device on the network can read/write to any controller. When these systems were connected to IT networks and eventually the internet, the authentication vacuum became the single largest attack surface in critical infrastructure.

Default Credential Categories in ICS:

1. Vendor-Shipped Default Credentials (Most Common):
- PLC/RTU login: admin/admin, admin/password, root/root, operator/operator
- HMI default accounts: factory/factory, engineer/engineer, user/user
- SCADA server: administrator with vendor-specific default password
- SNMP community strings: 'public' (read) and 'private' (read-write) — the most exploited default in ICS
- Web interface: vendor-specific default (often documented in product manual available online)

2. Hardcoded Credentials (Cannot Be Changed):
- Firmware service accounts with compiled-in credentials
- Debug/maintenance backdoor accounts
- OEM access accounts for vendor remote support
- Protocol-level credentials embedded in firmware (Modbus unit IDs, DNP3 addresses)
- These persist even after 'default password change' because they exist at a different level

3. Well-Known Protocol Defaults:
- Modbus TCP: NO authentication at all — any network access = full read/write control
- DNP3: Optional authentication rarely enabled (Secure Authentication v5 exists but adoption <10%)
- OPC-UA: Certificate-based auth available but many deployments use anonymous mode
- BACnet: No authentication — designed for building automation, now in energy management
- EtherNet/IP: No built-in authentication — CIP protocol allows direct PLC programming
- ICCP (IEC 60870-6): Inter-control center communications with minimal authentication

4. Shared/Generic Credentials:
- Single password shared across entire OT environment ('the plant password')
- Generic accounts: 'operator1', 'maintenance', 'engineering' with plant-wide passwords
- VPN credentials for remote access shared among vendors, contractors, and staff
- Engineering workstation local admin passwords identical across all machines

Polish Energy Grid Context:

Poland's energy infrastructure combines legacy Soviet-era ICS equipment with modern EU-standard systems during an ongoing energy transition. The grid includes:
- Polskie Sieci Elektroenergetyczne (PSE) — transmission system operator (400kV/220kV/110kV)
- 5 major distribution system operators (DSOs) covering 16 voivodeships
- 70+ conventional power plants (coal, gas, nuclear planned at Żarnowiec)
- Rapidly growing renewable capacity (18+ GW wind/solar by 2026)
- Cross-border interconnections with Germany, Czech Republic, Slovakia, Lithuania, Sweden

The legacy-to-modern transition creates a mixed environment where modern SCADA systems with authentication capabilities coexist with legacy RTUs and PLCs running Modbus TCP without any authentication. These legacy devices cannot be upgraded — they must be replaced, which requires physical access during scheduled outages.

Attack Progression — IT to OT Pivot:

1. Initial Access to IT Network:
- Spearphishing (APT28 Operation Neusploit — TL-0052)
- VPN credential compromise (default/shared credentials)
- Internet-facing IT systems with known vulnerabilities

2. IT-to-OT Pivot (The Critical Boundary):
- Engineering workstation with both IT and OT network access
- Historians/data servers bridging IT/OT networks
- Improperly segmented SCADA DMZ
- VPN concentrators with OT network access
- USB transfer stations (air-gap bridge)

3. OT Network Reconnaissance:
- Passive network sniffing (Modbus/DNP3 traffic in plaintext)
- Active scanning with ICS-aware tools (Nmap ICS scripts, PLCScan)
- SNMP enumeration with default community strings
- HMI/SCADA web interface discovery

4. ICS Device Access via Default Credentials:
- PLC programming access with default engineering passwords
- RTU configuration modification with vendor defaults
- HMI login with factory credentials
- SCADA server admin access with default accounts

5. Destructive Payload Execution:
- PLC logic manipulation (false readings, protective relay disabling)
- RTU configuration overwrite (incorrect setpoints, tripped breakers)
- HMI display manipulation (operators see normal readings while physical process diverges)
- Safety instrumented system (SIS) bypass (disabling automatic safety shutdowns)
- Firmware overwrite (brick PLCs requiring physical replacement)

Historical Precedent — ICS Default Credential Attacks:

- Ukraine 2015 (BlackEnergy/Sandworm): Default VPN and HMI credentials enabled SCADA access → 230K customers lost power for 6 hours
- Ukraine 2016 (Industroyer/CrashOverride): Direct ICS protocol manipulation (IEC 104, IEC 61850) — no authentication needed
- Saudi Arabia 2017 (TRITON/TRISIS): Schneider Electric Triconex SIS — hardcoded firmware credentials enabled safety system manipulation
- Oldsmar Florida 2021: TeamViewer remote access with shared password → sodium hydroxide levels manipulated
- Colonial Pipeline 2021: Compromised VPN credentials (legacy account, no MFA) → $4.4M ransom, 6-day pipeline shutdown
- Denmark Wind Turbines 2023: Default credentials on Enercon/Vestas turbine SCADA → 11 GW disconnected
- Multiple US water utilities 2023-2024: Default Unitronics PLC passwords → Iranian CyberAv3ngers campaign, CISA advisory

Scale of the Problem:

- CISA ICS-CERT: Default credentials cited in >40% of ICS advisories (2019-2025)
- Claroty Team82: 30% of ICS devices in production run default credentials (2024 survey)
- Dragos: 60% of ICS environments have at least one device with default credentials
- NIST SP 800-82r3: Lists default credential elimination as top priority recommendation
- ICS-CERT scans: Average energy utility has 20-50 devices with default/hardcoded credentials
- Shodan: 100K+ ICS devices internet-accessible, majority with default configurations

## MITRE ATT&CK

- T1078.001 Default Accounts
- T0800 Activate Firmware Update Mode
- T0831 Manipulation of Control
- T1694.001 Default Credentials
- T0886 Remote Services
- T0883 Internet Accessible Device
- T1078 Valid Accounts
- T1566 Phishing
- T1133 External Remote Services
- T0858 Change Operating Mode
- T0821 Modify Controller Tasking
- T1059 Command and Scripting Interpreter
- T0889 Modify Program
- T1693.002 Module Firmware
- T1692.002 Reporting Message
- T0851 Rootkit
- T0842 Network Sniffing
- T0846 Remote System Discovery
- T1046 Network Service Discovery
- T0843 Program Download
- T1021 Remote Services
- T1570 Lateral Tool Transfer
- T0861 Point & Tag Identification
- T0802 Automated Collection
- T0885 Commonly Used Port
- T1071 Application Layer Protocol
- T1691.002 Reporting Message
- T0838 Modify Alarm Settings
- T0814 Denial of Service
- T0836 Modify Parameter
- T1692.001 Command Message
- T0806 Brute Force I/O
- T0879 Damage to Property
- T0826 Loss of Availability
- T0880 Loss of Safety
- T0827 Loss of Control
- T1485 Data Destruction
- T1110 Brute Force
- T0860 Wireless Compromise
- T0847 Replication Through Removable Media

## Sources

- [NIST SP 800-82r3 — Guide to Operational Technology (OT) Security](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-82r3.pdf)
- [MITRE ATT&CK for ICS — T0812: Default Credentials](https://attack.mitre.org/techniques/T0812/)
- [CISA — ICS Advisory: Default Credentials in Critical Infrastructure](https://www.cisa.gov/topics/industrial-control-systems)
- [Dragos — ICS/OT Cybersecurity Year in Review 2024](https://www.dragos.com/year-in-review/)
- [Claroty Team82 — State of XIoT Security Report: ICS Vulnerability Landscape](https://claroty.com/team82/research)
- [CISA/FBI — Iranian CyberAv3ngers Targeting US Water Utilities via Unitronics PLCs](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-335a)
- [SANS ICS — Analysis of the Ukraine Power Grid Attacks (2015-2016)](https://www.sans.org/blog/analysis-of-the-cyber-attack-on-the-ukrainian-power-grid/)
- [FireEye/Mandiant — TRITON: Attacking Safety Instrumented Systems](https://www.mandiant.com/resources/blog/attackers-deploy-new-ics-attack-framework-triton)
- [CISA — Colonial Pipeline Ransomware Attack Response](https://www.cisa.gov/colonial-pipeline-cyber-incident)
- [IEC 62443 — Industrial Automation and Control Systems Security Standards](https://www.isa.org/standards-and-publications/isa-standards/isa-iec-62443-series-of-standards)
- [Shodan — Internet-Facing ICS Device Exposure Statistics](https://www.shodan.io/explore/category/industrial-control-systems)
- [NSA/CISA — Stop Malicious Cyber Activity Against Connected OT](https://media.defense.gov/2021/Apr/29/2002630479/-1/-1/0/CSA_STOP-MCA-AGAINST-OT_UOO13672321.PDF)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0053