Ransomware & SCADA:
Protecting Industrial Operations

Back to Blog

Explore the full security & certification article series - 60+ practitioner guides.

How Ransomware Reaches SCADA and OT Networks

Almost every publicly documented industrial ransomware case follows the same arc, and none of it is exotic. Initial access comes through the IT side: a phishing email that harvests a credential, a remote-access service exposed to the internet without multi-factor authentication, or a vulnerable edge device that was never patched. From there, attackers move laterally - often for days or weeks - collecting credentials and mapping the network before triggering encryption broadly, timed for maximum leverage.

What matters for an OT operator is the last hop. In some incidents, ransomware crosses into the OT network directly, because the plant network was flat or shared a Windows domain with corporate IT. In many others - Colonial Pipeline, the incident behind the joint CISA/FBI DarkSide ransomware advisory (AA21-131A), is the best-known example - the OT systems were never encrypted at all, yet operations still shut down as a precaution because the company could no longer trust its visibility, billing, or safety margins. Both outcomes stop production. Your defenses have to address both: keeping malware out of OT, and keeping enough trusted visibility and recovery capability that an IT-side incident does not force a plant-wide stop.

Note what is not on that list: zero-day exploits against PLCs. Ransomware crews are businesses; they take the cheapest path in, and the cheapest paths are credentials, exposure, and flat networks. That should shape where you spend first.

Why Ransomware Hurts OT More Than IT

In IT, ransomware costs data and time. In OT, it costs production, and sometimes safety margin. Three differences drive that:

• Availability is the mission. An office can work from laptops and paper for a week. A gas plant that loses its SCADA visibility either runs blind or shuts down - and restarting a process facility is itself a risk-laden, days-long procedure.
• The recovery surface is bigger than servers. A full SCADA restore means historian data, tag databases, screens, alarm setpoints, PLC programs, and gateway configurations. If the only copy of a PLC program lived on an encrypted engineering workstation, recovery becomes re-engineering.
• Windows lives longer in plants. SCADA servers and HMIs commonly run operating system versions that are years past mainstream support because upgrades mean downtime and revalidation. Old, unpatched Windows is exactly what commodity ransomware is built to spread through.

For the deeper background on why IT security playbooks translate poorly to plants, see our companion piece on OT vs IT security differences.

Layer 1 - Segmentation: Contain the Blast Radius

Segmentation is the single control that most reliably turns an enterprise-wide ransomware event into an IT-only event. The principles are the same ones the ISA/IEC 62443 series of standards formalizes as zones and conduits: group assets by criticality, and force every crossing between groups through a firewall with explicit, minimal rules. In practice, the ransomware-relevant rules are:

• No shared Windows domain between IT and OT. Domain-wide credential theft is the standard lateral-movement technique; a shared domain hands attackers the plant along with the office.
• No flat network paths from corporate laptops to SCADA servers or PLCs. File-sharing protocols and remote-desktop access between zones are the highways ransomware travels; block them at the boundary by default.
• OT traffic originates outbound. Data leaves through a DMZ; nothing outside initiates connections inward. An outbound-only cloud gateway - the model Merobix uses, where the gateway makes only outbound TLS connections and requires zero inbound firewall rules - fits this pattern without exceptions.
• Kill dual-homed machines. The engineering laptop with one interface in each network defeats every firewall you own.

Our secure SCADA for OT networks guide covers zone-and-conduit design in more depth, including where data diodes fit.

Layer 2 - Close the Access Doors Ransomware Uses

Exposed remote access and weak credentials are the front door in the majority of industrial ransomware cases. The fixes are unglamorous and high-yield:

• Eliminate internet-exposed remote-desktop, VNC, and vendor-support services. If remote access is required, broker it through an authenticated, MFA-protected path - never a raw port forward.
• Require multi-factor authentication on every remote login. A password alone in front of an industrial system is no longer defensible - MFA on remote and privileged access is a baseline in CISA's Cross-Sector Cybersecurity Performance Goals. Prefer phishing-resistant methods (FIDO2 passkeys) over SMS codes.
• End shared logins and enforce least privilege, so one stolen credential does not carry plant-wide permissions. Our guide to credential security in SCADA covers the details, from hashing to device secrets.
• Lock out brute force. Automated credential stuffing should hit rate limits and account lockout, and generate an alert - not run quietly for weeks.

This is one place a modern platform does the heavy lifting for you: Merobix ships TOTP MFA and FIDO2 passkey support, role-based access with site-level authorization, brute-force detection with persistent account lockout, and session expiry and revocation as standard platform behavior - the full control set is documented on the security page.

Layer 3 - Backups That Survive the Attack

Ransomware crews know backups are your alternative to paying, so mature crews hunt them: encrypting network-attached backup shares, deleting snapshots, and using stolen administrator credentials to purge cloud backup accounts before triggering encryption. This is why the joint #StopRansomware Guide from CISA, the FBI, and NSA puts offline, encrypted, regularly tested backups at the top of its preparation list, and why CISA's data backup options guidance (PDF) recommends the 3-2-1 pattern. A backup strategy that survives that behavior looks like this:

Backup Approach	Survives Share Encryption	Survives Stolen Admin Credentials	Restore Speed	Verdict
Online copies on a network share / NAS	No - encrypted along with everything else	No	Fast (if it survives)	Convenience copy only; never your last line
Snapshots on the same infrastructure	Sometimes	No - deletable with admin access	Fast	Useful first resort; insufficient alone
Offsite copies, same credentials	Yes	No - reachable and purgeable	Medium	Better; still one credential theft from gone
Immutable / write-once storage, separate credentials	Yes	Yes - retention lock prevents deletion	Medium	The standard to aim for
Offline / air-gapped media, rotated	Yes	Yes - physically unreachable	Slow	Last line of defense; test the media

Two SCADA-specific additions. First, back up the whole recovery surface: historian data, server and application configuration, screens and tag databases, alarm setpoints, PLC and RTU programs, and gateway configurations. Second, prove restores work. A timed restore drill at least twice a year - restoring to clean hardware, measuring hours-to-operational - is the only evidence that counts. Ask the same of vendors: Merobix validates backup archives and maintains controlled restore tooling as part of the platform, and its ongoing validation program is adding regularly exercised restore and failover drills. Our full SCADA backup and disaster recovery guide covers RPO/RTO targets and retention design.

Layer 4 - Detect It Early, While It Is Still an IT Problem

The window between initial access and encryption - often days or weeks - is your best opportunity. Detection in that window turns a catastrophe into an incident report. Watch for the precursors, not just the ransom note:

• Authentication anomalies: repeated failed logins, logins at odd hours or from new locations, privilege-escalation attempts, and disabled accounts suddenly active.
• Lateral-movement noise: new remote-desktop sessions between zones, unusual service installations, and unexpected connections toward the OT boundary.
• Backup tampering: snapshot deletions, backup-job failures, and retention-policy changes are a classic pre-encryption tell - alarm on them like a process trip.

Feed OT security events into the same console your IT security team watches, so the OT side stops being a blind spot. Merobix runs runtime threat monitoring that flags repeated authentication failures, privilege probes, cross-tenant denials, and suspicious control activity, and delivers security notifications through a durable outbox to email, SMS, webhooks, and your SIEM - with retry and dead-letter handling so alerts do not silently vanish mid-incident.

Layer 5 - A Recovery Plan You Have Actually Rehearsed

When encryption hits, the organizations that recover fastest are the ones that already decided what to do. Your OT ransomware playbook should answer, in writing, before the incident:

1. Who declares the incident, and who can order isolation? Disconnecting IT from OT at the boundary is the first move - name the person empowered to make it at 2 AM.
2. Can the process run safely without SCADA visibility, and for how long? Define the manual-operations fallback and its time limit per site.
3. What is the restore order? Domain services, historians, SCADA servers, HMIs, engineering workstations - sequence it, with owners and time estimates from your drills.
4. Who gets called? Incident-response retainer, cyber insurer, legal counsel, CISA/FBI. Early law-enforcement contact sometimes surfaces decryption keys from prior seizures.
5. What is the ransom policy? CISA and the FBI advise against paying - payment funds the ecosystem, decryption tools often underperform, and sanctioned-entity payments carry legal risk. Decide your position with counsel now, not under duress.

Then run a tabletop exercise annually with operations in the room, not just IT - rehearsed, role-assigned response is the core recommendation of NIST SP 800-61 Rev. 3 on incident response. Our OT incident response plan guide provides the full template.

What Cloud SCADA Changes About Ransomware Risk

Buyers evaluating cloud SCADA ask a fair question: does moving supervisory software out of the plant help or hurt against ransomware? Honestly assessed, it shifts the risk profile in your favor on several fronts - with responsibilities that remain yours:

• The platform sits outside your Windows domain. Ransomware that encrypts your file servers does not encrypt a vendor-operated platform; your visibility and historian survive an IT-side event, which is often what decides whether operations continue.
• Patching is continuous and vendor-managed, removing the aging-server problem that makes on-premise SCADA hosts such soft targets.
• An outbound-only gateway removes exposed inbound services - the most common ransomware entry point - and keeps buffering data locally (store-and-forward) if connectivity drops during an incident.
• Still yours: engineering workstations, local HMIs, PLC programs, and network segmentation inside the fence. And verify the vendor's own resilience - backup validation, restore tooling, documented recovery commitments - before you buy.

The cloud vs on-premise comparison weighs the full trade-off beyond ransomware.

Frequently Asked Questions

Sources & Further Reading

• #StopRansomware Guide - CISA, FBI, NSA & MS-ISAC
• StopRansomware.gov - CISA & FBI
• DarkSide Ransomware: Best Practices for Preventing Business Disruption (AA21-131A) - CISA & FBI
• Data Backup Options (PDF) - CISA
• Cross-Sector Cybersecurity Performance Goals - CISA
• ISA/IEC 62443 Series of Standards - International Society of Automation
• NIST SP 800-61 Rev. 3, Incident Response Recommendations and Considerations - NIST