Industrial IoT Visibility in OT Environments: Ukraine Energy Sector

Operational technology (OT) environments—the industrial control systems managing power plants, oil and gas facilities, water treatment plants, and other critical infrastructure—have historically operated in isolation from enterprise IT networks, with security through obscurity providing de facto protection. The increasing convergence of IT and OT networks, combined with the deployment of modern industrial IoT sensors and monitoring equipment, has connected OT environments to enterprise networks and to the internet in ways that dramatically change their threat exposure. Ukraine's energy sector, under sophisticated OT-targeted attack, has accelerated deployment of specialized OT visibility and monitoring platforms.

The OT Asset Discovery Problem

You cannot protect what you cannot see. Before deploying security monitoring in OT environments, operators must first achieve comprehensive asset inventory—knowing every device, its firmware version, network connections, and communication patterns. In legacy OT environments, asset inventory is frequently incomplete: devices installed decades ago, upgraded incrementally with poor documentation, with unofficial network connections made by engineers for convenience that were never formally recorded. This undocumented complexity creates security blind spots where threat actors can operate undetected.

A 2022 assessment of Ukrainian energy sector OT environments conducted with international partner support found that most operators could not provide complete inventories of their industrial control system devices, with estimated undocumented device percentages ranging from 15% to 40% depending on facility age and documentation practices. This baseline assessment drove a priority program for OT asset discovery before deploying monitoring tools.

Dragos Platform in Ukrainian Energy

Dragos Inc., a US industrial cybersecurity firm, has provided its OT-specific security monitoring platform to Ukrainian energy sector operators through a combination of commercial agreements and US government-facilitated assistance programs. The Dragos Platform performs passive network monitoring of OT communications—capturing industrial protocol traffic (Modbus, DNP3, IEC 61850, EtherNet/IP) and analyzing it for indicators of compromise and anomalous behaviors distinctive of known OT threat actor techniques.

Dragos tracks the threat group it designates ELECTRUM (attributed by external researchers to Sandworm/GRU Unit 74455)—the group responsible for the 2015, 2016, and 2022 Ukraine power grid attacks using Industroyer/Crashoverride and INDUSTROYER2 malware. Within the Dragos Platform, Ukrainian energy operators receive specific behavioral detections tuned for ELECTRUM's documented TTPs, providing earlier warning capability for the specific threat actor responsible for the most severe documented attacks on their systems.

OT Monitoring Platform Comparison

Passive vs. Active Scanning in OT Environments

The fundamental tension in OT security monitoring is between comprehensive visibility and operational safety. Active network scanning—sending probes to discover devices and enumerate their configurations—is standard practice in IT security but can cause serious problems in OT environments. Industrial controllers, PLCs, and SCADA systems often run real-time operating systems that cannot handle unexpected network traffic: an active scan packet can cause a PLC to crash or a relay to trip, causing operational disruption or physical process failure. Active scanning an operating power plant control network is potentially equivalent to knocking systems offline.

Passive monitoring—capturing and analyzing network traffic without sending any probes—is therefore the primary approach for OT asset discovery and security monitoring in safety-critical environments. Passive monitoring achieves high accuracy for devices that communicate on the network but may miss devices that are powered on but silent, or devices on network segments without monitoring taps. Supplementing passive monitoring with careful, controlled active scanning during maintenance windows and physical walkdowns for legacy documentation provides the most complete picture.

IT/OT Convergence Monitoring Challenges

Modern industrial facilities increasingly deploy equipment with IT-like connectivity: engineering workstations running Windows connected to PLCs, historians linking real-time process data to enterprise reporting systems, and remote access gateways enabling vendor support—all creating pathways between IT networks and OT process environments. Monitoring these convergence points requires simultaneous IT and OT security visibility with correlation across the IT/OT boundary, detecting when suspicious activity in the IT environment is followed by anomalous OT traffic—the pattern characteristic of the Industroyer attacks that crossed from enterprise IT to power grid OT systems.

FAQ

What is INDUSTROYER2 and how was it detected in Ukraine?

INDUSTROYER2 was a destructive ICS malware deployed against Ukrainian power grid equipment in April 2022, designed specifically to communicate with IEC 104 protocol substations to send unauthorized commands. CERT-UA and ESET researchers detected the malware before it could fully execute its payload, attributing it to Sandworm/GRU. The detection success was partially due to improved OT monitoring deployed after the 2015/2016 attacks, demonstrating the defensive value of the monitoring investments made in intervening years.

Why does OT security require specialized tools rather than standard IT security products?

OT environments use industrial protocols that standard IT security tools do not understand, run on hardware and operating systems not compatible with IT security agents, operate in real-time with latency and availability requirements that preclude many standard security interventions, and have safety implications for incorrect security actions. OT-specific tools understand industrial protocols, operate passively to avoid disruption, and present threat intelligence in operational context meaningful to process engineers and control room staff.

What percentage of Ukrainian energy sector OT is now monitored?

Complete monitoring coverage of all Ukrainian energy sector OT is not publicly confirmed. International assessments from 2022-2023 indicated significant coverage gaps, with major generation and transmission facilities having better monitoring than distribution substations and smaller regional utilities. Coverage improvement has been a priority of international assistance programs, but achieving comprehensive national OT monitoring of all critical sites represents a multi-year program.

Can Dragos Platform detect Sandworm attacks on Ukrainian energy systems?

Dragos Platform includes specific behavioral detections for techniques used by groups it tracks, including ELECTRUM (Sandworm's ICS-focused capability). These detections are based on documented TTPs from previous attacks—meaning they provide coverage for known techniques. Novel attack techniques not previously observed may not be immediately detected by signature-based components, though behavioral anomaly detection provides broader coverage against previously unseen attacks.

What is a historian in OT network architecture?

A historian is a specialized database server deployed in OT environments to collect and store long-term time-series process data from SCADA and DCS systems—enabling trend analysis, compliance reporting, and process optimization. Historians are one of the most common IT/OT boundary crossing points because they need to receive data from OT process systems while also being accessible from enterprise IT networks for reporting. Historian servers have been targeted in multiple documented attacks as a stepping stone between IT and OT network segments.

Sources

1. Dragos — "ELECTRUM Threat Intelligence: Ukraine Power Grid Operations," dragos.com 2022-2023
2. ESET Research — "Industroyer2 Technical Analysis," welivesecurity.com 2022
3. CERT-UA — "APT Attack on Ukrainian Energy Infrastructure, Alert #4435," cert.gov.ua 2022
4. Idaho National Laboratory — "OT Asset Discovery Methodologies for Critical Infrastructure," inl.gov
5. Claroty — "State of CPS Security, Energy Sector Edition," claroty.com 2023