Security for the Manufacturing Industry: containing the ransomware that halts your production line

Why manufacturing became a priority target for ransomware

For decades, the shop floor was an isolated world. PLCs, HMIs, and SCADA systems ran on proprietary networks, physically separated from corporate IT, speaking protocols that no one outside of automation understood. That obscurity worked as a crude form of security. The problem is that it is gone. Industry 4.0, the demand for real-time production data, predictive maintenance, ERP-MES-SCADA integration, and remote vendor access tore down the wall between IT and OT. Today, the process historian talks to the data lake in the cloud, the engineer accesses the HMI over VPN from home, and the robot receives production orders that came from the same Active Directory that authenticates email. Convergence brought efficiency — and opened a direct path from an operator's inbox to the hydraulic press.

For the attacker, manufacturing is an extremely high-value target for a simple reason: tolerance for downtime is nearly zero. An automotive line, a food plant with perishable products, a steel mill with a furnace that cannot cool down, or a pharmaceutical company with a batch in process do not have the luxury of sitting offline for a week analyzing logs. Every hour of downtime costs tens or hundreds of thousands of reais in lost production, contractual penalties with automakers, spoilage of raw materials, and SLA penalties with customers. Ransomware groups know this. They time attacks for the weekend or for peak production, encrypt precisely the servers that control the line, and calibrate the ransom knowing that every day of downtime is a negotiating lever in their favor.

Add to this the silent asset that every factory carries: intellectual property. Process recipes, machine parameters fine-tuned over years, product designs, tooling, chemical formulas, and manufacturing know-how. Industrial espionage — by competitors or by state actors — targets exactly these files, and it rarely makes noise. IP theft can go unnoticed for months because, unlike ransomware, there is no red screen demanding bitcoin; there is only data slowly leaving through a channel that no one was monitoring.

The anatomy of the attack: how ransomware jumps from IT to OT

Understanding the attack path is what makes it possible to cut it off. In nearly every industrial incident that halts production, the sequence is the same and it does not start on the shop floor. It starts in a mundane place: an email. An operator, a production planning analyst, or a process engineer receives a message with an attachment or a link. The endpoint is compromised. From there, the attacker is inside the IT network, at Level 4/5 of the Purdue model — the world of the ERP, email, and Active Directory.

Phase 1 — Foothold and reconnaissance in IT

With the first endpoint under control, the attacker does not go straight to OT. They establish themselves. They harvest credentials with memory-dumping tools, map Active Directory looking for service accounts and administrators, identify the file servers, and find where the backups are — because destroying the backups is part of the plan. This reconnaissance period can last days or weeks, and it is precisely the window in which a 24x7 SOC with behavioral detection can catch the intruder before irreversible damage is done.

Phase 2 — Lateral movement and discovery of the bridge to OT

The critical point of the industrial attack is the discovery of the connection between IT and OT. In poorly segmented factories, that bridge is trivial: the engineering workstation that controls the PLCs is in the same domain as corporate Active Directory; the SCADA server has the email agent installed; the operator uses the same password on the ERP and on the HMI. The attacker finds an engineering workstation, a misconfigured jump box, or an account with dual access, and uses that bridge to cross from Level 4 (IT) to Levels 3, 2, and 1 (supervision, control, and field devices). In a well-segmented network, they hit an industrial firewall and a DMZ that do not let that traffic through — and the attack dies at the boundary.

Phase 3 — Detonation on the shop floor

Once in OT, the ransomware encrypts what makes the line run and be visible: SCADA servers and historians, operator stations (Windows-based HMIs), MES and recipe servers, and often also the backups that were accessible over the network. The PLCs themselves are frequently not encrypted — they do not run Windows — but they are orphaned: without the HMI and without SCADA, the operator no longer has any way to supervise the process, read alarms, or command it safely. The practical result is a total stoppage, not because each machine was attacked, but because the nervous system that coordinates them was blinded. And that is exactly when the attacker sends the ransom note, timed for the worst possible moment.

The five threats that define a factory's risk

These five threats are not independent. They chain together. IT→OT lateral movement is the axis: it is what turns an ordinary phishing email into a production disaster, what gives the spy access to the IP files, and what allows a vendor compromise to propagate all the way to the PLCs. That is why Decripte's defense strategy does not treat each threat in isolation — it attacks the structure that enables the chaining, closing the IT/OT boundary, instrumenting both sides, and rehearsing the response for when one layer fails.

The vendor as a vector: the most overlooked link

Every modern factory depends on third parties with deep access: the automation integrator that maintains the PLCs, the machine manufacturer (OEM) that performs remote maintenance, the MES vendor, the telemetry company. Each of these access paths is a door. When an integrator uses the same VPN credential for ten customers, the compromise of one becomes the compromise of all. When an OEM keeps a maintenance connection permanently open, it becomes a tunnel waiting to be abused. Supply chain security in manufacturing means inventorying all of these remote access paths, giving each one least privilege, logging everything, and monitoring behavior — because the attack that comes through a trusted vendor does not trip the obvious alarms.

Containment under pressure: what Decripte does in the first hour

When a factory calls us in with the line going down, there is no time for deliberation. The first hour determines whether the incident stays contained in IT or consumes all of OT. Decripte's Incident Response operates with a containment SLA of up to 1 hour precisely because, in manufacturing, that clock competes directly with the attacker's clock encrypting servers. But containing in industry is not simply shutting down machines — shutting down the wrong thing at the wrong time can damage equipment, ruin a batch, or create a safety risk for those on the shop floor.

In practice, the containment sequence prioritizes isolating the boundary above all else: blocking traffic between the IT and OT levels, tearing down vendor remote access connections, disabling compromised accounts in Active Directory, and cutting the command-and-control channels the attacker uses to communicate with external infrastructure. These four moves, executed in parallel, make the attacker lose their grip on the environment. Only then does the team move on to assessing the damage already done in OT and to the decision — always jointly with operations — about which systems need to be shut down in a controlled way and which can keep operating in safe manual mode.

Industrial monitoring: seeing what IT logs do not show

Most factories that suffer an OT attack find out too late because their monitoring stopped at IT. They collected logs from the corporate firewall, the antivirus, and Active Directory — and were completely blind to what was happening in industrial traffic. An anomalous command to a PLC, an engineering workstation communicating with a destination it has never used, a setpoint being changed outside the operating window: none of this shows up in IT logs. Decripte's 24x7 SOC for manufacturing is built to see both sides.

That visibility changes the game for detection. Instead of discovering the attack when the line has already stopped, the SOC sees the signs of the reconnaissance and lateral movement phase: the network scan coming from IT toward OT, the authentication attempt on an engineering workstation at an unusual hour, the first communication of a historian with an external IP. It is these early signals, correlated across IT logs and OT traffic, that let the analyst intervene while the attacker is still on this side of the boundary — before the jump happens.

IT/OT segmentation: the barrier that stops the jump

If the IT→OT jump is the point of no return, segmentation is the wall that stops it. But segmentation in industry is frequently misunderstood. Many factories believe they are segmented because they created separate VLANs for IT and OT — and a VLAN is not security. A VLAN organizes traffic, but it does not filter it; an attacker with access to the switch crosses VLANs with ease. Real segmentation means controlling the flow between zones with firewalls that inspect and block, organized according to a recognized reference model.

Decripte structures segmentation while respecting the reality of the plant: you cannot stop production to reorganize the network all at once. The work is phased. We start by mapping all the communication flows that actually exist between IT and OT — frequently discovering connections that no one had documented. Then we design the zones and conduits according to the Purdue model, implement the industrial DMZ, and migrate the legitimate flows to pass through it in a controlled way, one by one, validating that production is not affected at each step. Vendor remote access is redirected to a secure broker with strong authentication, session recording, and time-limited access — putting an end to permanent tunnels.

Vulnerability management in OT: patching without stopping the line

The question every industrial manager asks is: how do you apply security patches to systems that cannot be rebooted? The honest answer is that, in OT, you often cannot patch — at least not at the pace of IT. A critical PLC can only receive an update during a scheduled outage that happens twice a year; a SCADA system may depend on a specific version that the vendor does not certify on a newer operating system; a machine still under warranty loses coverage if you alter its software. Industrial vulnerability management does not ignore this — it works with it.

The process is continuous and calibrated for industry. We maintain a live inventory of OT assets — fed by passive monitoring, without aggressive scans that could take down a fragile controller. We cross-reference that inventory with known vulnerabilities and advisories from vendors and sector bodies. We prioritize by the combination of severity, real exposure, and the asset's criticality to production. And, fundamentally, we plan the patching in sync with the plant's maintenance windows — because the best patch in the world is useless if it is applied when the line is running a critical batch.

OT-aware Pentest: testing the boundary without taking down production

Testing the security of an industrial environment is different from testing a web application. An aggressive scan that would be harmless on an IT network can freeze an old PLC and stop production. That is why Decripte's Pentest for manufacturing is designed with extreme care and with rules of engagement built together with the client's OT team. On sensitive OT assets, we favor the passive approach and architecture analysis; active, intrusive tests are concentrated in IT, at the IT/OT boundary, and in test environments that mirror production, never in critical production without explicit approval and supervision.

The goal of the industrial pentest is not only to find technical vulnerabilities — it is to validate the central hypothesis of the defense: can the attacker, in fact, jump from IT to OT? We simulate the complete path of a realistic adversary, from the initial phishing to lateral movement, and we test whether the segmentation holds, whether the industrial DMZ filters what it should, whether the engineering workstations are protected, whether vendor remote access is exploitable. The result is an assessment that shows exactly where the wall has gaps — and a remediation plan prioritized by impact on production.

Compliance and continuity: what industry needs to demonstrate

Industrial security is increasingly a contractual requirement, not a choice. Automakers impose cybersecurity requirements on their automotive supply chain vendors; multinationals audit the security maturity of anyone entering their supply chain; certifications such as ISO/IEC 27001 become a prerequisite for winning a contract. And although the factory may not look like a "data" company, it is subject to the LGPD: employee data, contractor data, corporate customer data, and the intellectual property that, if leaked, causes material and regulatory harm. The ANPD is the competent authority, and a breach affecting personal data may require notification to the agency and to the data subjects.

But compliance without continuity is just paper. What actually protects production is the ability to recover. That means offline, immutable backups of the systems that control the line — SCADA, historians, recipes, PLC configurations — kept in a way that ransomware cannot reach them over the network. It means recovery procedures that are tested, not merely documented: the factory needs to know, with confidence, how long it takes to restore SCADA and get back to producing. And it means having an incident response plan rehearsed with the participation of operations, because the first time the OT team coordinates with the security team cannot be during the real crisis.

Anatomy of a real case: the ransomware that jumped from the corporate network to the shop floor

How Decripte responds to an incident in a manufacturing operation

Incident response in manufacturing is different because the clock competes with the attacker and with the cost of every hour of downtime, and because containing in OT requires knowing what not to shut down. These are the steps Decripte follows, always side by side with the client's operations team:

1. Immediate engagement and triage: we classify the severity and identify whether the attacker has already reached the IT/OT boundary or is still contained in the corporate network — that is the first question that changes the entire response strategy.
2. Containment of the IT→OT jump within 1 hour: we block traffic between the networks, tear down vendor remote access, disable compromised accounts, and cut off command-and-control channels, closing the attacker's route before it reaches the shop floor.
3. Coordination with operations for physical decisions: no OT system is shut down without the automation team and the plant's safety engineer — containment is surgical, preserves local control when possible, and never creates a risk for those on the shop floor.
4. Eradication in IT: we identify all compromised endpoints and accounts, isolate and rebuild the machines from clean images, reset credentials, and remove the attacker's persistence mechanisms.
5. Forensic analysis of the vector and the path: we reconstruct how the attack got in and where it moved, confirming the exact point at which it was contained and preserving the evidence for any regulatory obligation or legal action.
6. Verified recovery of production: we validate the integrity of SCADA, historians, and engineering workstations before reconnecting anything, restore from intact backups when necessary, and confirm that the line returns to safe operation.
7. Assessment of impact to personal data and IP: we check whether there was exfiltration of data under the LGPD or of intellectual property, advising on any notification to the ANPD and to the data subjects when applicable.
8. Executive and technical report with a hardening plan: we deliver the complete timeline, the lessons learned, and the prioritized roadmap to close the gaps the incident revealed, turning the crisis into the starting point for maturity.

How Decripte structures a factory's security

Responding well to an incident is necessary, but the goal is for it not to stop production. Decripte's industrial security structuring rests on pillars that, together, close the attack's route and give the factory the ability to detect, contain, and recover:

Recommended plans for Manufacturing

Frequently asked questions

Sector terms

OT (Operational Technology)

The set of hardware and software that monitors and controls physical processes on the shop floor: PLCs, HMIs, SCADA systems, process historians, robots, and field devices. It differs from IT by prioritizing availability and physical safety above confidentiality.

ICS/SCADA

Industrial Control Systems (ICS) and, within them, the Supervisory Control and Data Acquisition (SCADA) systems, which give operators visibility and command over the production line. Compromising SCADA blinds the operation and forces a stoppage.

PLC (Programmable Logic Controller)

A rugged industrial device that runs the control logic for machines and processes on the shop floor. It has a life cycle of 15 to 25 years and rarely runs conventional operating systems, which completely changes the approach to patching and monitoring.

Purdue Model

A reference model that organizes the industrial environment into levels, from the field (sensors and actuators) up to corporate IT and the internet, defining where the security boundaries should sit — in particular the industrial DMZ between the IT and OT worlds.

Industrial DMZ

A demilitarized zone positioned between the IT network and the OT network that mediates all communication between the two worlds. No traffic crosses directly from one side to the other: everything passes through the DMZ, is inspected, and only what is strictly necessary moves forward.

IT→OT lateral movement

A technique by which an attacker who has compromised the corporate network (IT) crosses into the production network (OT), exploiting poorly segmented bridges such as engineering workstations, dual-access accounts, or vendor remote access. It is the vector that turns an IT incident into a factory stoppage.