Operational Technology (OT) networks have long been viewed as ‘air-gapped’ or insulated from the public internet, a perception that has historically allowed threat actors to focus less on industrial control systems than on corporate IT. However, recent intelligence reports indicate a stark shift in adversary tactics. Groups like Sandworm and Twill Typhoon are now actively targeting OT environments with sophisticated, stealthy campaigns designed for prolonged espionage rather than immediate disruption.
One of the primary vectors enabling these intrusions is DLL sideloading, a technique that exploits how Windows operating systems load dynamic link libraries. For plant managers and OT engineers managing legacy HMIs, SCADA servers, and engineering workstations, this represents a critical blind spot. These systems often run older versions of Windows that are difficult or impossible to patch, making them ideal targets for attackers who do not need to exploit a vulnerability in the application itself, but rather abuse the operating system’s trust mechanisms.
Understanding DLL Sideloading in an OT Context
To defend against DLL sideloading, we must first understand its mechanics. When a Windows application is launched, it may require dynamic link libraries (DLLs) to function correctly. The operating system follows a specific search order to locate these files. If an attacker places a malicious DLL with the same name as a legitimate one in a directory that is searched before the application’s installation path, the malicious file will be loaded and executed instead.
In a corporate IT environment, this might result in data exfiltration or ransomware deployment. In an OT environment, the consequences are far more severe because the target is not just data, but physical processes. A successful sideloading attack on an engineering workstation can provide an attacker with persistent access to critical assets like PLCs, RTUs, and safety instrumented systems.
This technique is particularly effective in OT because of the ‘legacy trap.’ Many industrial facilities rely on equipment from vendors such as Rockwell Automation, Siemens, and Schneider Electric that runs on outdated operating systems. These systems are often treated as ‘if it ain’t broke, don’t touch it,’ leading to a lack of endpoint protection software that might otherwise detect anomalous DLL loading behavior.
Why OT Environments Are Prone to This Attack
The industrial landscape presents unique challenges that make DLL sideloading an attractive option for threat actors. Unlike IT networks, where patch management is relatively standardized, OT environments are fragmented and constrained by operational continuity requirements.
Legacy Operating Systems and Unpatched Software
A significant portion of the industrial base still runs on Windows 7, Windows Server 2008, or even older versions. Microsoft has ended support for many of these operating systems, meaning no security updates are available to mitigate known DLL search order hijacking vulnerabilities. Furthermore, the specialized software used for configuration and monitoring—often from vendors like ABB or Honeywell—is rarely updated frequently enough to address modern security standards.
When an engineer cannot patch the OS or the application, they inadvertently leave the door open for sideloading. An attacker only needs to drop a malicious DLL into a writable directory that is accessible by the legacy application to gain execution privileges.
Reliance on Third-Party Remote Support Tools
OT networks are increasingly connected to support remote troubleshooting, creating additional attack surfaces. In our assessments, we have found multiple legitimate remote-support pathways active or permitted on industrial endpoints. For example, in recent engagements, we identified installations of tools like AteraAgent, TeamViewer, Splashtop, and Dell SupportAssist.
These tools are essential for maintaining operations, but they also introduce complexity. They often require elevated privileges to function and may create network exceptions that bypass standard firewalls. If an attacker can compromise a system with these tools installed, they can use DLL sideloading to hijack the remote support application itself. This allows them to maintain access through a ‘trusted’ channel, making detection significantly harder for security teams who are monitoring for malicious traffic but not for legitimate-looking processes.
Note on sample size: The observation of multiple remote-support tools was found in two specific endpoint assessments within the same industrial organization. This highlights a common configuration pattern we see in walkdowns, but it does not establish a universal prevalence across all customers.
Defense-in-Depth Strategies for OT Networks
Because patching is often not an option in legacy OT environments, defenders must rely on defense-in-depth. This approach involves layering controls to reduce the risk of exploitation, even if one control fails.
1. Restrict Write Access to Critical Directories
The most effective way to prevent DLL sideloading is to ensure that malicious actors cannot place files in the directories where legitimate applications reside or execute from. For OT engineers, this means auditing the permissions on program folders and temporary directories.
- Identify all writable directories for legacy applications.
- Restrict write access to only authorized service accounts or administrators.
- Use file integrity monitoring (FIM) to alert on any changes to these directories.
This step is crucial because it removes the attacker’s ability to deliver the malicious payload. Without the ability to write a DLL to the target location, the sideloading attack cannot proceed.
2. Implement Application Whitelisting
Application whitelisting allows only approved programs to run on a system. In an OT context, this is challenging due to the need for flexibility in engineering tasks. However, tools like AppLocker or Windows Defender Application Control (WDAC) can be configured to allow only signed executables from trusted vendors.
For legacy systems that may not support modern whitelisting features, consider using third-party endpoint protection solutions that offer legacy OS compatibility. These tools can enforce strict execution policies, preventing unsigned or unauthorized DLLs from loading into memory.
3. Enhance Network Segmentation and Monitoring
Even if an attacker successfully executes a sideloading attack, effective segmentation can limit their ability to move laterally. IEC 62443 standards emphasize the importance of security zones and conduits in industrial networks.
- Ensure that engineering workstations are isolated from production networks.
- Monitor traffic between zones for anomalous behavior, such as unexpected connections to external IPs or unusual protocol usage.
- Deploy network detection and response (NDR) solutions that can identify lateral movement attempts.
In one of our assessments, we observed a workstation with two active default routes while Internet Connection Sharing was running. This configuration created an unintended transit path between networks, highlighting the need for rigorous network boundary management. Such misconfigurations can allow an attacker to bypass segmentation controls and reach critical assets.
4. Harden Remote Access Protocols
Given the prevalence of remote support tools in OT environments, it is essential to secure these channels. Ensure that all remote access connections are encrypted, authenticated, and logged. Disable unnecessary protocols and services on endpoints.
For example, if a system does not require TeamViewer, remove it entirely. If it must remain installed, restrict its usage to specific IP addresses and enforce multi-factor authentication. Regularly audit installed software on OT endpoints to ensure that only authorized tools are present.
Validating Remediation Without Compromising Operations
Implementing these controls requires careful planning to avoid disrupting operations. Every remediation project should validate that controls meet design objectives without compromising operational performance.
- Start with passive discovery to map out existing applications and network flows.
- Test controls in a non-production environment whenever possible.
- Coordinate with engineering teams to schedule changes during maintenance windows.
- Monitor system performance and application functionality after implementation.
This iterative approach ensures that security improvements do not inadvertently cause downtime or safety issues. It also allows for the identification and resolution of false positives, which are common in complex OT environments.
Conclusion
DLL sideloading represents a significant threat to OT networks, particularly those running legacy systems. By understanding the mechanics of this attack and implementing defense-in-depth strategies, industrial operators can reduce their risk profile. Focus on restricting write access, enforcing application whitelisting, enhancing segmentation, and securing remote access channels.
As threat actors continue to evolve their tactics, staying proactive is essential. Regular assessments and continuous monitoring are key to maintaining a secure OT environment.
If you are unsure about the security posture of your OT assets, Red Trident offers specialized assessment services tailored to industrial environments. We help plant managers and CISOs identify vulnerabilities and prioritize remediation without disrupting operations.
Contact us today for a free consultation on hardening your OT network against advanced threats like DLL sideloading. Let us help you secure your critical infrastructure.
