The Cat Photo That Disabled Production: The Rise of Steganography-Based OT Cyberattacks

  • First and foremost, economic espionage
  • Secondly, they could be used to get deep insights into software/hardware design and find zero-day vulnerabilities that can be then exploited in attacks against enterprises that use these products
  • Thirdly, one of major and more common techniques for highly-skilled hackers is to embed a malware or a backdoor in this type of product for later use at their deployments (as was the case in CCleaner and NotPetya)
  • Finally, the stolen suppliers’ credentials can be used for initial access into to their customers’ networks during periodic maintenance and service (like in the famous “Cloud Hopper” campaign)

Prevention and Mitigation

Preventing steganography-based cyberattacks requires both making sure that employees don’t activate the hidden malware (e.g., by opening a photo or allowing macros in MS Office documents), and, as a second line of defense, had an employee activated the malware, detecting the network activity triggered by the malware.

  • Network segmentation and segregation: one of the key structural changes all industrial organization should implement is maintaining separation between operational and IT networks using firewalls and DMZs
  • Human/social engineering: this activity involves employee training on what steganography and phishing attacks are, what to look for in illegitimate emails, and procedures for reporting to IT department; some organizations actually hold phishing-preventing exercises for senior/sensitive position-holders, and even penalize employees for not following email safety guidelines
  • Detection by an IDS: while files containing hidden malware can’t always be detected prior to human activation, Intrusion Detection Systems (IDSs) such as Radiflow’s iSID are able to detect minute changes in network behavior that indicate the triggering and the propagation of malware, such as connecting to a previously unused hosting server, opening new external connections, and/or unusual data traffic patterns


The slew of attacks described above yet again demonstrates that it is imperative that stakeholders in industrial enterprise cybersecurity (CISO, OT security manager, Chief Risk officer, and so on) manage their organization’s cyber risk properly, validate the security posture of suppliers, monitor third-party network access, and deploy threat detection tools at the production lines to alert on possible exploits.



Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store
International Society of Automation - ISA Official

International Society of Automation - ISA Official


The International Society of Automation ( is a non-profit professional association founded in 1945 to create a better world through automation.