OT-LORAWAN-REPLAYImpact

LoRaWAN Replay / FCnt Reset

Devices that reset their frame counter on reboot allow attackers to replay sniffed up/downlinks — spoofed telemetry, denial of legitimate uplinks.

§ Where this technique fits

OT-LORAWAN-REPLAY is catalogued under the Impact tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 3 on average.

§ Dossiers chaining this technique

LoRaWAN replay → spoof environmental sensor
Capture LoRaWAN uplinks from a target sensor. Devices that reset FCnt on reboot accept replayed frames — feed false readings into the upstream IoT platform.
step 3 / 5

§ What commonly comes next

01
Data Encrypted for Impact
T1486 · Impact
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

LoRaWAN replay → spoof environmental sensor

§ What commonly comes next