They Are Mapping Your Control Loops Before They Touch Them

The finding that should reset OT threat models

The main annual review of industrial cyber threats, published in February 2026, led with ransomware: attacks on industrial organisations rose 49 percent in 2025, affecting around 3,300 organisations, with 119 ransomware groups tracked that have demonstrated capability to affect operational environments.

The more consequential finding sits underneath it. Adversaries have moved past establishing and holding access. They are now mapping control loops, which means learning the operational logic of a facility rather than its network topology.

The review describes one threat group conducting systematic reconnaissance of United States industrial devices between March and July 2025, targeting operator interfaces, variable frequency drives, metering points and remote gateways in a sequence that indicated deliberate mapping of entire control loops. In December 2025, a second group targeted combined heat and power facilities and renewable energy management systems in Poland with attempts to affect operational assets directly.

What a control loop is, and why mapping one is the whole game

A control loop is the smallest complete unit of automation: a sensor measures a process variable, a controller compares it against a setpoint, and an actuator changes something physical until the measurement returns to where it should be. A plant is thousands of these, nested and interlocked, with safety systems sitting outside them to catch the cases where the loop itself fails.

An attacker who owns a controller but does not understand the loop it belongs to can cause an outage. An attacker who understands the loop can cause a specific outcome, and can often cause it while the operator's screen continues to show normal values, because the screen is fed by the same measurement path the attacker now influences.

This is the distinction between disruption and consequence. Disruption requires access. Consequence requires knowledge, and knowledge is what this reconnaissance phase is for. It is also why the mapping happens months before anything visibly breaks.

What the reconnaissance looks like on the wire

Nothing in this phase resembles an attack. The traffic is read operations, using documented function codes, from a host that is allowed to speak the protocol, against devices that answer those requests all day for legitimate reasons.

MITRE ATT&CK for ICS has names for the pieces. Remote System Discovery, T0846, is the enumeration of what is present on the network. Point and Tag Identification, T0861, is the collection of point and tag values, which are the process variables themselves: the inputs, outputs and memory locations that describe what the plant is doing. Monitor Process State, T0801, is watching the process run to learn its rhythm.

Taken individually, each of those is indistinguishable from engineering work. An integrator commissioning a system reads tags. A historian polls points continuously. A maintenance contractor enumerates devices. There is no payload to match, no CVE being exploited, and frequently no malware on disk anywhere in the environment.

• Reads rather than writes, so no process value changes and no alarm fires.
• Documented function codes, so protocol validation alone sees a conforming session.
• Legitimate source hosts, often an engineering workstation or a jump server that already has the right to speak.
• Slow cadence spread across months, so volume-based thresholds never trigger.

Why IT-shaped detection misses it entirely

An IT SIEM with OT protocol parsers receives these events as parsed strings and evaluates them against rules written for known-bad patterns. There is no known-bad pattern here. Every event is individually benign, and the signal exists only in the relationship between events: this host, reading these tags, on these devices, in this order, for the first time.

Signature detection asks whether an event matches something previously seen and judged malicious. The premise fails when the adversary's tradecraft is to use the environment exactly as it was designed to be used. Industrial threat researchers have been explicit that many organisations lack the visibility to detect reconnaissance, lateral movement and data exfiltration before objectives are achieved, and industry reporting through 2026 has repeatedly put OT network monitoring coverage in the single digits as a share of industrial networks worldwide.

There is a second reason this evades IT-shaped tooling. Much of what the adversary is collecting is not on the network at all in an obvious sense. Configuration files, alarm lists, logic backups and historian exports are the fastest route to understanding a process, and they usually live on engineering workstations, file shares and vendor laptops rather than inside the controllers.

What actually detects control loop mapping

If the individual operations are legitimate, detection has to work at the level of relationships, sequence and physics. That means the environment needs a model of its own normal behaviour that is specific enough to notice when a legitimate operation happens in an illegitimate pattern.

Spharaka Signal builds that model passively. Assets are identified from traffic that already exists, using deep packet inspection across its industrial and IT protocol decoders, stack behaviour, TLS fingerprints, vendor prefixes and identity objects devices expose in normal operation. Nothing is probed, because probing a safety controller is not an available move.

On top of that model, four detection engines annotate the same event rather than raising four separate alerts. Signature matching catches the known. Protocol conformance catches an implementation that is not the one the environment normally uses, which is how a generated script gives itself away. Behavioural models catch first-seen relationships, off-hours activity and function codes unusual for an asset's role. Process physics validation catches the case where measurements and commands stop being consistent with how the plant can actually behave.

Against reconnaissance specifically, the behavioural layer is where it surfaces. A host that has never spoken to a variable frequency drive beginning to read from several of them, in sequence, in the same week it enumerated the meters those drives affect, is not a signature match. It is a pattern, and a pattern is what a baseline exists to reveal.

The questions to ask of your own environment this quarter

None of these require a purchase to answer, and the answers tell you whether you would see the phase the 2026 research described. Most teams discover that the honest answer to at least three of them is no.

If you cannot answer them from data you already hold, the gap is not detection content. It is the absence of a device-of-record and a behavioural baseline to evaluate anything against.

• Which hosts are permitted to read tags from safety-related controllers, and would you know if a new one started?
• Do you have a record of which assets speak to which, so that a first-seen relationship is visible as first-seen?
• Where do your logic backups, alarm lists and configuration exports live, and who has read them in the last quarter?
• If a measurement and the physical state it describes diverged, would anything other than an operator's intuition notice?
• Can you place any of the above on a timeline against a maintenance window, or is that reconstruction manual?

Evidence, zones and the compliance byproduct

Reconnaissance that crosses a zone boundary is also a governance event. IEC 62443 organises an environment into zones and conduits precisely so that a crossing is a defined thing rather than an incidental one, and NERC CIP asks bulk electric system operators to demonstrate monitoring rather than assert it.

Signal maps each detection automatically to the corresponding MITRE ATT&CK for ICS tactic and technique, and carries a structured audit trail from detection through investigation to resolution, so evidence of monitoring is produced by the monitoring rather than assembled afterwards by a person with a spreadsheet. Continuous compliance reporting runs against IEC 62443-3-3, NERC CIP, NIST SP 800-82r3 and AWWA G430.

The practical value during a reconnaissance investigation is that the ATT&CK mapping turns a set of individually unremarkable events into a named adversary behaviour, which is the form a regulator, an insurer and an executive committee can all read.

What this changes about the OT security programme

The traditional OT security argument is about prevention: segment the network, control remote access, patch what can be patched during the outage window. All of that remains correct and none of it addresses an adversary already inside, reading values, learning the plant.

What the 2026 findings ask for is a detection posture aimed at the phase before impact. That means passive visibility across the estate rather than at the perimeter, a baseline specific to each asset rather than a generic ruleset, and correlation that can hold a sequence together across months rather than evaluating events one at a time.

The adversaries described in the 2026 research were not fast. The group mapping control loops spent roughly five months on reconnaissance. That is the one advantage defenders still have in OT, and it is only an advantage if something is watching in a way that can recognise a slow, quiet, entirely legitimate-looking pattern for what it is.