This study examines the evolution and security implications of IoT as a cyber-physical system integrating operational and IT infrastructures. We focus on how IIoT optimizes production, enables predictive maintenance, and provides real-time data monitoring. We also evaluate the manufacturing industry's vulnerability to cyberthreats amid increasing digitalization and explore the potential consequences of attacks on IIoT systems and devices.
Ekaterina Snegireva
Senior analyst, Research Group of PT Cyber Analytics
How IIoT works and why it's essential
The inner workings of IIoT
IIoT systems vary, but they all share key components: peripheral devices, communication tools, data processing platforms, and user applications. The IIoT framework operates as follows: end devices, which control physical objects or collect environmental data, connect to data storage centers via a network. These centers then link to a unified control system, which serves as an analytical platform accessible to users.
Given the diversity of IIoT architectures, no single model fits all. In 2014, leading industry players—AT&T, Cisco, General Electric, IBM, and Intel—formed the Industrial Internet Consortium (IIC) to bridge the gap between the physical and digital worlds. The IIC created a guide for IIoT architects, enterprise leaders, and developers, outlining common architectural patterns. These include gateway-mediated edge connectivity1, system-of-systems (SoS) orchestration2, and the three-tier architecture. The latest model features three levels: Edge, Platform, and Enterprise, connected by data exchange networks.
1. The gateway-mediated edge connectivity and management architecture pattern comprises a local connectivity solution for the edge of an IIoT system, with a gateway that bridges to a wide area network. The gateway acts as an endpoint for the wide area network while isolating the local network of edge nodes.
2. The system-of-systems (SoS) orchestrator pattern is a collection of systems, each capable of independent operation, coordinated by the orchestrator. The IIoT system may be configured as distributed systems remote from each other (for instance, turbine engines at a wind power plant or oil rigs at an oil field), and powerful computing capabilities may be required on or near the assets for local analytics and management.
Edge level
Edge devices collect data on physical parameters, such as spatial positioning, voltage, pressure, and applied force, enabling interaction with the physical world. Sensors gather data, while actuators enable interaction. Devices can be simple or smart, with smart devices capable of performing computations and processing data locally. At this level, edge computing technology allows data processing and storage close to the device generating the data.
Platform level
At the platform level, data from the edge and enterprise levels is analyzed. Long-term, centralized data storage is maintained, and business analytics are generated based on the collected data. Machine learning and big data technologies are also utilized. Cloud platforms and data centers are commonly used for storage.
Enterprise level
The enterprise level provides an interface for users to interact with the IIoT system. Industry-specific applications and decision support systems are implemented. A system orchestrator—unified management system—is also deployed to integrate distributed IIoT systems.
Data exchange networks
The levels are connected by networks that ensure device operation across these tiers. At the edge level, data is transferred between sensors, actuators, and the local edge computing center, often wirelessly, which expands the attack surface. IoT gateways facilitate data transfer from the physical to the digital environment by supporting essential communication protocols. Corporate networks are typically used for data exchange between different levels.
Why embrace IIoT technology?
According to our data3, IoT adoption spans multiple areas, with companies using it to address various tasks simultaneously. IIoT is primarily adopted to monitor production and technological processes, track IT equipment, and automate decision-making for process adjustments.
3. According to surveys conducted by Positive Technologies in July and August 2024 among professionals working in manufacturing, transportation, healthcare, and telecommunications. Over 60 respondents took part in these surveys.
In power engineering, IIoT upgrades power supply channels and implements smart grids. IoT-powered systems collect energy consumption data, enabling precise resource allocation and efficient use. The power engineering sector leads in IIoT adoption and ranks second in smart manufacturing implementation.
In the petrochemical industry, companies like Sibur use their own IIoT platforms. For example, wireless sensors monitor water temperature at treatment facilities, connected to a unified network. Hundreds of similar sensors across the factory detect overheating sources, enabling timely responses. Video analytics, powered by machine learning, also automatically detects process deviations such as leaks, smoke, or poor-quality raw materials.
In metallurgy, the Magnitogorsk Iron and Steel Works (MMK) has launched a wireless IIoT network to collect data from hard-to-access sensors or those not connected to digital systems.
Mechanical engineering also benefits from IIoT. United Engine Corporation (UEC) was recognized as Russia's leader in digital transformation for its IoT implementation. UEC's IIoT system monitors equipment workload, performance maintenance, downtime, and staff activity, providing real-time machine operation analysis. The operation of machines is monitored and analyzed in real time.
How hackers target the industrial internet of things
Modern technological processes demand seamless interaction between physical objects, production equipment, software components, and IT systems. While digitalization enhances efficiency in both technological and business processes, it also introduces significant cybersecurity risks.
Cyberthreats to edge devices, sensors, and industrial controllers
Exploiting hardware vulnerabilities and firmware flaws
When connected, even simple actuators and sensors become targets for cyberattacks, as they are integral parts of the IIoT system. But cybercriminals don't stop there—they often focus on industrial controllers. Hardware and firmware vulnerabilities in these devices can lead to hijacking, service denial, and major disruptions, including production halts at critical industrial sites.
In 2024, Positive Technologies identified five vulnerabilities in Mitsubishi Electric's MELSEC System Q and MELSEC System L PLC processor modules. These modules, used in sectors such as chemicals, semiconductor production, and building automation, were vulnerable to exploitation. In 2022, two vulnerabilities were discovered and fixed in Mitsubishi's MELSEC iQ-F controllers. The controllers are used in food production, manufacturing, building automation, shipping, water management, and many other sectors.
In 2023, Positive Technologies helped eliminate vulnerabilities in OMRON controllers (CVE-2023-22357). This flaw allowed attackers to access and modify any memory area of the controller without authentication, enabling firmware overwrite, denial of service, or arbitrary code execution. OMRON PLCs control systems such as conveyors, machine tools, power plant pipelines, farm microclimates, product quality control, and automated packaging—critical functions that could be severely disrupted if compromised.
Exploiting vulnerabilities in IoT devices does more than disrupt operations. It undermines the quality of the data these systems collect. Organizations are increasingly integrating video analytics and CCTV systems into their workflows, which raises the stakes. Cybersecurity researchers recently uncovered a vulnerability in Dahua CCTV cameras that allows hackers to manipulate timestamps on recorded footage. This manipulation compromises the reliability of video analytics systems by altering critical date and time data.
Legacy vulnerabilities continue to be a major entry point for cybercriminals. A 2023 ThreatLabz report revealed that 34 of the 39 most exploited IoT vulnerabilities were over three years old. These flaws remain unpatched in many systems, making them easy targets for attackers who rely on outdated weaknesses.
IoT devices often share similar hardware and software, which magnifies the risks of a single vulnerability, meaning a single vulnerability could expose multiple vendors to the same hacking risk. In October 2024, Germany's CERT@VDE reported vulnerabilities in mbNET.mini industrial routers by MB connect line. These routers are widely used as VPN gateways for remote industrial maintenance. The vulnerabilities also affected Helmholz's REX100 industrial routers.
The dark web adds fuel to this fire. Hackers use it to share exploit information, making it easier and faster to launch attacks. Addressing vulnerabilities quickly is not just a best practice; it is essential for protecting critical systems from exploitation.
Botnets
The ThreatLabz report revealed a 400% increase in cyberattacks using malware targeting IoT devices in 2022. Analysts attributed most of this surge to botnet activity, including the spread of the Sality botnet, which was analyzed by Dragos experts.
Our surveys indicate that organizations rank the use of IIoT devices in large-scale DDoS attacks among the most dangerous cyberattack scenarios.
Weak passwords and unsecured internet access
IoT devices often come with default passwords that are difficult or impossible to change. For example, NETGEAR XR1000 router software versions prior to 1.0.0.58 had a vulnerability that prevented users from changing these passwords. Another critical issue is that many IoT devices automatically connect to available networks as soon as they are powered on. This behavior, combined with unchangeable default passwords, creates a significant security risk for certain models. Using specialized search engines designed to detect internet-connected devices, cybercriminals can locate IoT devices and exploit default passwords published online. Templates for these search requests, including those tailored for the Shodan browser, are widely distributed on dark web forums, often for free or at minimal cost.
Some tools enable cybercriminals to connect to device control panels by scanning for weak passwords and basic vulnerabilities. Although these tools are often created for legitimate use, they are frequently misused by malicious actors to carry out attacks. Their accessibility on dark web forums lowers the barrier for entry, allowing even low-skilled hackers to exploit industrial systems.
Security challenges at the end device level
Key security issues at the end device level include:
- Insufficient standardization. Many IoT device components function as "black boxes," offering little transparency into their internal workings These devices may contain hidden features that pose significant security risks.
- Insufficient security update support. Many manufacturing companies rely on outdated devices that do not support critical security updates. Even when vulnerabilities are identified, organizations are often reluctant to update firmware due to the potential for supply chain disruptions or operational downtime. However, ignoring updates can lead to far more serious risks. For example, in 2023, Forescout researchers identified 21 vulnerabilities in Sierra Wireless routers, which are widely used in healthcare and energy. Over 86,000 vulnerable devices were found to be accessible from the internet, some beyond their lifecycle and unable to receive updates. A particularly concerning case arose in October 2024, when vulnerabilities were reported in tens of thousands of traffic lights in the Netherlands. Attackers could exploit emergency radio signals to manipulate traffic lights, such as triggering a green light. Fixing this issue requires physically replacing the traffic lights, a process expected to take until 2030.
- Difficulty detecting external attacks. IoT devices often lack the ability to identify malicious files or commands. Although newer models include some protective features, vulnerabilities still exist and remain exploitable by attackers.
Vulnerabilities in data transfer protocols and IoT gateways
IIoT networks enable data exchange between central systems and devices, but cybercriminals often exploit weaknesses in the underlying protocols. In 2022, Rockwell Automation reported an increase in attacks targeting port 502 Modbus TCP, a widely used industrial protocol. Control over this port allows attackers to manipulate end devices and disrupt operations. In April 2024, Dragos identified FrostyGoop malware, written in Go, which directly interacts with industrial control systems via Modbus TCP.
Although new sensors, drives, and automation systems use modern internet protocols, many industrial controllers still depend on outdated protocols. IoT gateways are often deployed to bridge communication between legacy and modern infrastructure. However, these gateways are not immune to vulnerabilities. In December 2023, researchers revealed that Digital Communications Technologies had failed to fix a bug in the Syrus4 IoT gateway, which had been discovered months earlier. This flaw allowed unauthenticated attackers to execute arbitrary code on Syrus4 devices connected to the cloud service, potentially disrupting entire fleets of vehicles. Cybercriminals continue to exploit gateway vulnerabilities, developing malware specifically designed to target industrial communications. In April 2024, Fuxnet malware was used to attack TMSB and MPSB gateways, demonstrating how these tools remain a focus for attackers.
Exploits and hacking tools are commonly traded on dark web forums. For example, a zero-day vulnerability in an IoT gateway using protocols such as IEC-104, Modbus, or MQTT can sell for as little as $1,000. These exploits allow attackers to hijack gateways and deliver malicious commands to all connected devices, amplifying the scope of potential damage.
Hackers also distribute universal tools that exploit vulnerabilities in widely used protocols and end devices.
Vulnerabilities extend beyond communication protocols to include converters that link industrial controllers, meters, and sensors to local networks. In 2024, Positive Technologies identified and eliminated a critical vulnerability in Moxa's NPort W2150a and W2250a wireless industrial converters. If left unaddressed, this flaw could have given attackers full access to connected equipment, enabling them to disrupt technological processes.
Threats to analytical systems and end-user software
Attacks on specialized industrial software
Data shows that 37% of successful cyberattacks on manufacturing companies in Q1–Q3 2024 involved exploiting vulnerabilities. In most cases (71%), attackers focused on software vulnerabilities, including flaws within the code of industrial control systems.
Rockwell Automation identified SCADA systems as the most common targets in the industrial sector. Like many other types of software, SCADA systems often contain exploitable vulnerabilities. In 2024, Positive Technologies discovered and patched flaws in the MasterSCADA 4D platform, which is widely used to develop automation and dispatching systems for technological processes. MasterSCADA (versions 3 and 4D) is implemented in tens of thousands of projects across more than 40 industries. Exploiting this vulnerability could have allowed attackers to access the system and potentially disrupt operations.
Hackers often lack a deep understanding of industrial systems. To compensate, dark web forums provide not only attack tools but also detailed guides explaining how these systems operate and how their vulnerabilities can be exploited.
In addition to guides, the dark web hosts posts offering to develop custom exploits tailored to specific industrial systems.
Modern IIoT platform solutions include advanced analytics and process control systems. These solutions are expected to become key targets for malicious actors in the near future.
Attacks on cloud resources and data centers
The storage and analysis of large data sets almost always depend on cloud infrastructure. In attacks targeting manufacturing companies, cybercriminals are increasingly expected to focus on cloud solutions to steal sensitive data, often as part of ransom demands. In September, Microsoft researchers reported an attack by the Storm-0501 group that compromised hybrid cloud environments. This campaign resulted in data exfiltration, persistent access to the affected infrastructure, and ransomware deployment. It targeted multiple U.S. sectors, including government, manufacturing, and transportation.
Key players targeting the industrial sector and their impact
The industrial sector has been one of the top five most targeted industries for the past five years, with no indication of this trend slowing. In the first three quarters of 2024, manufacturing companies were the focus of 9% of all successful cyberattacks on organizations globally.
Figure 12. Percentage of successful attacks on manufacturing companies (of the total number of attacks on organizations)
According to Rockwell Automation, the energy sector faced the highest number of attacks in 2024. Ransomware operators and hacktivists often succeed in this sector due to the destructive nature of their attacks. Cybercriminals are also increasingly targeting organizations that provide water supply and wastewater services.
In the first three quarters of 2024, most attacks on the industrial sector involved malware (79%), social engineering (58%), and vulnerability exploitation (37%). The use of legitimate software by attackers is also on the rise. By the end of 2023, this tactic accounted for just 1% of incidents, but by the end of Q3 2024, it had surged to 8%. Legitimate tools make attacks harder to detect and are easily accessible, making them popular among hacktivists, APT groups, and ransomware operators.
Figure 13. Attack methods (Q1–Q3 2024)
Attacks by APT groups
Attacks on the industrial sector by advanced persistent threat (APT) groups are on the rise. In the first three quarters of 2024, APT groups were responsible for 19% of successful attacks, up from 13% in 2023. These attacks are marked by their precision and stealth, often employing customized social engineering, specialized malware, zero-day exploits, and other advanced methods to infiltrate and maintain control over systems. Custom malware is frequently tailored to bypass corporate security measures, including antivirus tools. Once inside a network, attackers can operate undetected for months or even years, harvesting sensitive data and maintaining persistent access to critical systems.
The goals of APT groups range from cyberespionage and financial theft to disrupting vital infrastructure. Intellectual property, proprietary technologies, business plans, and other confidential data are prime targets. Stolen information can be sold, ransomed, or used to gain a competitive advantage or accelerate technological progress. Prominent APT groups targeting the industry for cyberespionage purposes include Kimsuky, APT31, and Mustang Panda. Research by the Positive Technologies Expert Security Center (PT ESC IR) has also linked groups such as Cobalt, APT31, Dark River, Lazarus, Space Pirates, IAmTheKing, and XDSpy to incidents involving manufacturing companies, industrial sites, and the fuel and energy sectors.
The geography of APT attacks on manufacturing companies
Geopolitical, economic, and technological factors heavily influence where APT groups focus their efforts. Manufacturing companies in specific regions are especially vulnerable:
- Industrially advanced countries. Enterprises in leading economies such as the U.S., China, Japan, Germany, South Korea and others, are prime targets due to their cutting-edge technologies and valuable industry data. Countries with abundant natural resources are also high on the list, as cybercriminals seek to exploit economic advantages.
- Politically unstable regions. Manufacturing companies in areas affected by political unrest, military conflicts, or economic instability face elevated risks. APT groups often target these regions to access critical infrastructure or extract sensitive information for political, economic, or military purposes.
Hacktivism
Hacktivists launch cyberattacks to pursue political, social, or ideological agendas. Their methods include exploiting known vulnerabilities, using social engineering, and deploying common malware like ransomware.
Groups such as Cyber Partisans, GhostSec, Team-Network-Nine, Cyber Av3ngers, Electronic Tigers Unit, DragonForce, Hunt3r Kill3rs, Byte Blitz, STUCX TEAM, and LulzSec frequently target manufacturing companies. Their focus is often on industrial systems with unsecured internet access. By bruteforcing default passwords or exploiting vulnerabilities, hacktivists gain unauthorized access to device web panels or industrial control systems.
Cybercriminals often demonstrate access to infrastructure by issuing threats to shut down equipment or disrupt operations. In April 2024, hacktivists targeted Belarus's state-run fertilizer manufacturer, Grodno Azot, claiming they could halt the plant but refrained from doing so.
However, access to a control panel does not always mean attackers can directly interfere with industrial processes. For example, the hacktivist group GhostSec announced a successful breach of 55 Berghof PLCs, gaining full admin panel access. Investigators found the devices were publicly exposed online and protected by weak passwords. While access to the admin panel enables control over certain functionalities, it does not provide full authority over the industrial process. Nonetheless, as hacktivists refine their techniques, the risk of more severe consequences from such attacks is growing.
Hacktivists are particularly active in regions with political instability. A study on cyberthreats in Iran, covering early 2021 to mid-2024, revealed significant interest from hacktivist groups in the industrial sector. Many successful attacks exploited the widespread use of vulnerable IoT devices in industrial systems, which remain critical weak points in cybersecurity.
Ransomware operators
Ransomware continues to dominate as the most widely deployed malware in industrial cyberattacks. In the first three quarters of 2024, it was used in 52% of incidents targeting the sector. Attackers are increasingly shifting their focus toward specialized industrial systems, amplifying the potential for disruption. In May 2024, the ransomware group Ransomhub claimed to have breached the SCADA system of a Spanish bioenergy plant. This attack highlights the growing trend of targeting industrial control systems directly, where the stakes extend beyond financial losses to include operational paralysis and safety risks.
Figure 17. Types of malware (percentage of successful attacks)
The impact of ransomware attacks on IT infrastructure and technological networks is severe, with financial and operational consequences that can cripple businesses. According to Claroty, ransomware attacks on technological networks are on the rise, and their financial and operational impacts remain significant for businesses. While earlier attacks primarily targeted IT systems, ransomware operators have shifted focus, increasingly threatening industrial processes. This shift is reflected in data trends. In 2021, 32% of ransomware attacks targeted IT infrastructure alone, while 27% affected both IT and technological systems. By 2023, these numbers had changed significantly—only 21% of attacks focused solely on IT, whereas 37% disrupted both IT and operational technologies.
In July 2023, TOMRA faced a major ransomware attack that forced the company to isolate affected systems. The recovery process was massive in scope, requiring the restoration of core data centers, over 5,000 user accounts, and the underlying IT and network infrastructure. According to TOMRA, 82% of reverse vending machines (RVM) within its IoT network were impacted. While no evidence of data encryption or leaks was found, it took two months to fully restore operations, costing the company NOK 120 million in response efforts.
Consequences of cyberattacks
A successful cyberattack can wreak havoc on a manufacturing company, triggering financial losses from production stoppages, supply chain disruptions, raw material delays, and even environmental damage. Core operations grind to a halt, service delivery fails, and the ripple effects can extend far beyond the initial incident.
The aftermath of an attack is rarely isolated to a single issue. Companies often face cascading consequences, where one disruption amplifies others, compounding the damage and escalating recovery costs.
Figure 18. Consequences of attacks on manufacturing companies (percentage of successful attacks, Q1–Q3 2024)
Confidential data breaches
Data breaches continue to dominate as the most frequent outcome of cyberattacks on manufacturing companies. In 2023, 68% of successful attacks resulted in the exposure of confidential information. This trend has held steady, with breaches accounting for 65% of incidents in the first three quarters of 2024.
The primary target for cybercriminals is trade secrets and other critical business data. In 2023, trade secrets made up 42% of all stolen information, underscoring their value to attackers. By Q3 2024, this share had declined slightly to 37%, yet the theft of proprietary data remains a top threat.
Figure 19. Types of stolen data (Q1–Q3 2024)
Cybercriminals exploit stolen confidential data in several ways, with double extortion being one of the most common tactics. In these attacks, data is both encrypted and held hostage, with attackers threatening to leak it publicly unless a ransom is paid. Beyond extortion, stolen data frequently appears for sale on the dark web, where it fuels further criminal activity and amplifies the impact of the initial breach.
On a dark web forum, a user claimed to have access to confidential data from an unnamed company. The offering included control over switches, routers, and internal cameras, along with a file server containing 11 terabytes of sensitive information. The scale and diversity of the stolen data highlight the depth of the breach and the significant risks posed to the compromised organization.
Core activity disruption
In 2023, 48% of cyberattacks on manufacturing companies disrupted production processes. By Q1–Q3 2024, this figure fell to 33%, suggesting a shift in attacker strategies. Cybercriminals are increasingly deploying remote access trojans (RATs) and spyware instead of ransomware, which was a major driver of disruptions in previous years. Despite this decline, the impact of production-targeted attacks remains significant. In February 2024, a cyberattack on German battery manufacturer VARTA AG disrupted operations at five production units.