Modbus TCP Write to PLC

§ Where this technique fits

§ Dossiers chaining this technique

• HMI default credentials → operations disruption

  Wonderware / iFix HMI exposed to the corporate network with vendor-default credentials. Operators see attacker-controlled values + commands sent to PLCs through legit channels.

  step 4 / 5

• Open MQTT broker → smart-estate takeover

  Shodan-indexed MQTT broker on TCP/1883 with no auth. Subscribe to '#' to harvest every device topic; publish to relays/locks/lights/thermostats.

  step 4 / 5

• Reachable Modbus PLC → direct register override

  Modbus has no authentication. From a foothold on a reachable OT network, write to coils / holding registers directly with pymodbus.

  step 4 / 5

• Engineering workstation → push payload to PLC

  Compromise the OT engineer's laptop (corporate-network adjacent, jumphost-reachable). Use legit engineering tools (TIA Portal / Studio 5000) to download attacker ladder logic to the PLC.

  step 5 / 6

• Zigbee network key sniff → smart-home control

  Sniff a fresh device-join with an Atmel RZRAVEN — Zigbee broadcasts the network key in plaintext during pairing. Decrypt all subsequent traffic + send commands.

  step 5 / 5

§ What commonly comes next

1. 01
   Data Encrypted for Impact

   T1486 · Impact
   seen 2×
2. 02
   Safety Instrumented System Override

   OT-SAFETY-OVERRIDE · Impact
   seen 1×
3. 03
   Valid Accounts

   T1078 · Initial Access
   seen 1×