Skip to navigation

Threat reportThreat IntelligenceTL-2026-5154

CISA CI Fortify: Critical Infrastructure OT Isolation and Recovery Planning Guidance (2026)

mediumMONITORING

CISA launched the CI Fortify initiative urging critical infrastructure owners and operators (water, energy, transportation, communications) to plan to disconnect OT from third-party and business networks and to recover compromised systems while isolated, so essential services can continue for weeks or months during a cyber disruption. First disclosed .

Key facts for CI Fortify OT isolation

IdentifiersTL-2026-5154
Also known asCI Fortify
SeverityMEDIUM
First disclosed
Exploitation statusNo known exploitation
Affected productsMultiple Critical infrastructure OT/ICS environments (water, energy, transportation, communications)
MITRE ATT&CK techniquesT1021 Remote Services, T1071 Application Layer Protocol, T1078 Valid Accounts, T1133 External Remote Services, T1199 Trusted Relationship, T1485 Data Destruction, T1489 Service Stop, T1490 Inhibit System Recovery
MotivationUNKNOWN
Target sectorswater, energy, transport, communications, government administration, defense
Target regionsNorth America
Detection rules9 (1 shown free)
Sources8 cited sources

Detection coverage for CI Fortify OT isolation

As of 2026-11-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5154 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CI Fortify OT: System Recovery Inhibition via VSS/Backup/BCD Tampering (T1490/T1485)

TL-2026-5154 (CISA CI Fortify) centres on recovering compromised OT systems while isolated, so tactics that prevent recovery are directly in scope (T1490 Inhibit System Recovery). Detects vssadmin/wmic shadow copy deletion, wbadmin catalog/backup deletion and bcdedit recovery-disabling commands via Sysmon process creation. These destroy the local restore points operators rely on during isolated operation, and wbadmin/vssadmin deletion of backup catalogs and shadow copies is also destruction of recovery data (T1485).

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1490, T1485
  • Data sources: sysmon, microsoft_defender_for_endpoint
  • Severity: high
  • Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h ((Image="*vssadmin.exe" CommandLine="*delete*" CommandLine="*shadows*") OR (Image="*wmic.exe" CommandLine="*shadowcopy*" CommandLine="*delete*") OR (Image="*wbadmin.exe" CommandLine="*delete*" (CommandLine="*catalog*" OR CommandLine="*backup*" OR CommandLine="*systemstatebackup*")) OR (Image="*bcdedit.exe" CommandLine="*recoveryenabled*no*") OR (Image="*bcdedit.exe" CommandLine="*bootstatuspolicy*ignoreallfailures*"))
| table _time host User ParentImage Image CommandLine

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where (FileName =~ "vssadmin.exe" and ProcessCommandLine contains "delete" and ProcessCommandLine contains "shadows")
    or (FileName =~ "wmic.exe" and ProcessCommandLine contains "shadowcopy" and ProcessCommandLine contains "delete")
    or (FileName =~ "wbadmin.exe" and ProcessCommandLine contains "delete" and (ProcessCommandLine contains "catalog" or ProcessCommandLine contains "backup"))
    or (FileName =~ "bcdedit.exe" and (ProcessCommandLine matches regex @"(?i)recoveryenabled.*no" or ProcessCommandLine matches regex @"(?i)bootstatuspolicy.*ignoreallfailures"))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by Timestamp desc

Sigma

title: System Recovery Inhibition Via Shadow Copy Backup Or BCD Tampering (CI Fortify TL-2026-5154)
id: 7b2d94e0-1c6f-4a38-b5d7-92e4c8a0f102
status: experimental
description: Detects commands that delete volume shadow copies, delete Windows backup catalogs or disable boot recovery. CI Fortify (TL-2026-5154) relies on the ability to restore compromised OT systems while isolated; these actions inhibit system recovery (T1490).
references:
    - https://www.cisa.gov/fortify
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-03
tags:
    - attack.impact
    - attack.t1490
    - attack.t1485
logsource:
    category: process_creation
    product: windows
detection:
    selection_vssadmin:
        Image|endswith: '\vssadmin.exe'
        CommandLine|contains|all:
            - 'delete'
            - 'shadows'
    selection_wmic:
        Image|endswith: '\wmic.exe'
        CommandLine|contains|all:
            - 'shadowcopy'
            - 'delete'
    selection_wbadmin:
        Image|endswith: '\wbadmin.exe'
        CommandLine|contains: 'delete'
    selection_wbadmin_target:
        CommandLine|contains:
            - 'catalog'
            - 'backup'
    selection_bcdedit:
        Image|endswith: '\bcdedit.exe'
        CommandLine|contains:
            - 'recoveryenabled no'
            - 'ignoreallfailures'
    condition: selection_vssadmin or selection_wmic or (selection_wbadmin and selection_wbadmin_target) or selection_bcdedit
falsepositives:
    - Backup or storage administrators pruning shadow copies during approved maintenance
    - Imaging or provisioning scripts that reset boot configuration
level: high

Known false positives:

  • Backup administrators deleting old shadow copies or catalogs during approved maintenance
  • Provisioning or imaging scripts that modify bcdedit recovery settings

Tuning notes: Exclude known backup-server hosts and service accounts. Treat hits on OT/engineering workstations and historians as high priority. Requires Sysmon EventCode 1 with command-line capture (or Windows 4688 with command-line auditing).

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • CI Fortify OT: Third-Party Remote Support Tool Executed On Host (T1133/T1199) · unlock with TL Creds
  • CI Fortify OT: Backup, Database, Historian or SCADA Service Stop (T1489/T1490) · unlock with TL Creds
  • CI Fortify OT: One Account Network/RDP Logons Across Many Hosts (T1021/T1078) · unlock with TL Creds
  • CI Fortify OT: Remote Desktop Access Path Re-Enabled On Host (T1133/T1021) · unlock with TL Creds
  • CI Fortify OT: Secure Deletion / Disk Wipe Utilities And Backup File Deletion (T1485/T1490) · unlock with TL Creds
  • CI Fortify OT: Remote Execution Tooling For Lateral Movement (T1021/T1078) · unlock with TL Creds
  • CI Fortify OT: Remote Desktop Logon From Public IP (T1133/T1078/T1199) · unlock with TL Creds
  • CI Fortify OT: Periodic Script/LOLBin Beaconing To External Hosts (T1071/T1133) · unlock with TL Creds

Indicators of compromise for CI Fortify OT isolation

As of 2026-11-03, Threadlinqs Intelligence tracks 12 indicators of compromise for TL-2026-5154.

Sample indicators (1 of 12)

  • URL: hxxps://www[.]cisa[.]gov/fortify

Defanged, TLP:CLEAR. Full set of 12 indicators: unlock with TL Creds.

12 indicators of compromise · unlock with TL Creds. Compare plans

How CI Fortify OT isolation works

This is defensive guidance; it contains no CVEs and no IOCs.

CI Fortify is a CISA initiative, announced in early May 2026 by Acting Director Nick Andersen, that pairs published guidance with operational support (pilot assessments) to help critical infrastructure operators keep delivering essential services during periods of cyber duress, including a geopolitical crisis or wider conflict. It is built on two capabilities: isolation and recovery.

Isolation means proactively disconnecting operational technology (OT) from third-party and business networks, including cloud providers, vendors, and telecommunications services, so that OT cyber impacts do not spread and essential services continue during degraded communications. Per Andersen, isolation also severs adversary command-and-control pathways. Operators are asked to plan for sustained isolated operation of weeks to months. Recovery means restoring compromised systems while isolated: documenting systems, backing up critical files, and rehearsing component replacement or transition to manual operation in case isolation fails and components become inoperable.

CISA's recommended actions for operators: identify critical customers (e.g., military installations and lifeline services) and set service delivery targets; determine the vital OT needed to meet those targets while isolated; update business continuity plans for prolonged isolation; monitor CISA and Sector Risk Management Agency communications for isolation triggers; and share the guidance with managed service providers, integrators, and vendors. Industrial vendors are asked to identify blockers to isolation and recovery (licensing, contractual issues), communicate failure states during telecommunications outages, and update contact details with CISA. MSPs should support engineering updates, local backups, documentation, and dependency mapping. Security vendors should provide watch-and-warning and communicate tactics that prevent recovery or break isolation. Linked CISA resources include 'CI Fortify - Advice for Isolating Vital Systems', 'Communicating Under Pressure: Best Practices for Service Providers', 'Secure Connectivity Principles for OT', and a tabletop exercise package for isolation and recovery. Coverage also notes CISA's zero-trust guidance for OT (April 30, 2026) and an Australian CI Fortify framework from 2025 as a model.

Threat context from press coverage: the scenario assumes nation-state actors are already positioned inside OT, telecommunications, and critical infrastructure networks, and that third-party connections, internet access, and upstream providers become unreliable. CyberScoop and Cybersecurity Dive reference Chinese state-sponsored campaigns Volt Typhoon and Salt Typhoon as context; the guidance itself does not attribute a specific campaign. Xage Security CEO Duncan Greatwood cautioned that isolation alone is insufficient without control and segmentation inside the environment, because threats exploit trusted connections and compromised credentials. CISA reported pilot assessments already underway and a hiring push of 300+ positions for regional field operations and industrial control systems expertise.

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021 Remote Services

Command and Control

T1071 Application Layer Protocol

Defense Evasion

T1078 Valid Accounts

Initial Access

T1133 External Remote Services; T1199 Trusted Relationship

Impact

T1485 Data Destruction; T1489 Service Stop; T1490 Inhibit System Recovery

Remediation for CI Fortify OT isolation

Immediate actions

  • Identify critical customers and set service delivery targets
  • Determine the vital OT assets needed to meet those targets while isolated
  • Monitor CISA and Sector Risk Management Agency communications for isolation triggers
  • Share CI Fortify guidance with MSPs, system integrators, and vendors

Workarounds

  • Manual operation procedures for critical processes if automation or components are inoperable

Longer-term hardening

  • Update business continuity plans for weeks-to-months of isolated operation
  • Engineer the ability to sever OT from IT/business and third-party networks on demand
  • Document systems, maintain current offline backups of critical files, and map dependencies and workarounds
  • Run tabletop and live exercises for isolation, component replacement, and manual operation
  • Apply segmentation and credential controls inside the OT environment so isolation is effective

Affected and fixed versions

  • Multiple — Critical infrastructure OT/ICS environments (water, energy, transportation, communications)

Timeline of CI Fortify OT isolation

  • CISA publishes zero-trust guidance for OT, referenced in coverage as related guidance to CI Fortify.
  • CyberScoop coverage frames CI Fortify against locked-ioc-11 and locked-ioc-12 and recent conflicts (Ukraine, Gaza, Iran) in which cyberattacks and kinetic strikes hit water plants, power substations and data centers; the guidance itself attributes no specific campaign.
  • CISA publishes role-specific asks: operators set service delivery targets; industrial vendors identify isolation/recovery blockers; MSPs support local backups and documentation; security vendors provide watch-and-warning and report tactics that prevent recovery, via cisa.jcdc@cisa.dhs.gov.
  • CISA's CI Fortify page lists four resources: 'locked-ioc-6', 'Communicating Under Pressure: Best Practices for Service Providers', 'Secure Connectivity Principles for OT', and the 'locked-ioc-2'.
  • CISA reported hiring 300+ positions focused on regional field operations and industrial control systems expertise to support the initiative.
  • CISA states pilot assessments with critical infrastructure operators are already underway, with scope varying by sector risk; specific partners were not disclosed.
  • CISA, through Acting Director locked-ioc-9, launches the CI Fortify initiative asking critical infrastructure operators to plan for isolation and recovery.
  • Infosecurity Magazine and SecurityWeek publish coverage; locked-ioc-10 CEO locked-ioc-8 cautions isolation alone is insufficient without internal control and segmentation.

Sources cited for CI Fortify OT isolation

Further reading

Drafted by the Threadlinqs research pipeline from 8 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats