For decades, the air gap was our shield. It kept the noisy, chaotic internet away from the precision of our control systems. Today, that shield is gone. We rely on cellular links, remote maintenance tunnels, and edge gateways to keep operations running across dispersed sites. But in doing so, we have inadvertently invited a new class of threat into our demilitarized zones: industrial routers.
These devices are not merely conduits for data; they are the critical choke points where operational technology meets the public internet. When these gateways are misconfigured or left with default credentials, they cease to be bridges and become open doors. The threat landscape has shifted from isolated espionage campaigns to coordinated botnet operations that target this exact layer. For plant managers and OT engineers, the question is no longer if you need to secure your edge devices, but whether you can afford the downtime of an exploited gateway.
The urgency is dictated by active exploitation in the wild. Recent intelligence from CrowdSec highlights a rising wave of activity targeting Four-Faith industrial cellular routers. Threat actors are leveraging critical authentication bypass vulnerabilities in the F3x36 series to recruit devices into expanding botnets. This is not theoretical research; it is active, coordinated botnet operation across critical infrastructure sectors.
Simultaneously, CERT Polska has confirmed active exploitation of six vulnerabilities in MikroTik RouterOS. A specific two-flaw chain dubbed ‘MikroTrick’ allows attackers to chain bugs for remote code execution and privilege escalation. These are not obscure zero-days in a corner case; they are critical flaws being weaponized right now against the hardware sitting on your site.
The False Security of “Industrial” Hardware
There is a pervasive misconception in operational technology that hardware labeled as “industrial” or “ruggedized” possesses inherent security. A device rated for -40°C to 75°C and immune to vibration does not automatically possess immunity to network-based attacks. In fact, the ruggedization often masks deeper vulnerabilities because these devices are frequently deployed in unmanaged locations—remote substations, water pumping stations, or pipeline monitoring nodes—where physical access is rare but network exposure is constant.
When we assess OT environments, we frequently encounter industrial routers configured as transparent bridges. In this mode, the device passes traffic without inspecting it, effectively extending the broadcast domain of the internet directly into the control network. If that router has a default password or an unpatched management interface, an attacker does not need to breach your firewall; they simply need to reach the router.
The challenge is compounded by the heterogeneity of the OT stack. Unlike IT, where you might have a standardized fleet of servers, OT environments are a patchwork of vendors. You may have Rockwell PLCs talking to Siemens HMIs via OPC UA, while a Schneider gateway bridges the gap to a legacy Honeywell system. The routers facilitating this traffic often come from different manufacturers, each with its own firmware update cadence and documentation quality. This fragmentation makes centralized hardening nearly impossible without deep protocol awareness.
Lessons from the Field: The Cost of Complexity
The difficulty of securing these devices is not theoretical; it is evident in our own engagement data. In a recent assessment of an OT remote-operation environment, Red Trident observed a configuration failure that illustrates the danger of unmanaged edge devices.
On one workstation assessed for an OT remote-operation environment, we observed two simultaneously active network interfaces on separate networks, with a default gateway on each interface, while the Windows Internet Connection Sharing service was also running. This specific configuration created a segmentation failure. The intended security boundary between the corporate network and the operational technology network collapsed because of a single workstation’s network stack behavior. While this was a host-level finding, it highlights a systemic issue: when we allow unmanaged connectivity or rely on consumer-grade services like Internet Connection Sharing in OT environments, we inadvertently create unintended transit paths that bypass all other security controls.
This finding serves as a microcosm of the broader router problem. Just as that workstation became an accidental bridge between networks due to misconfiguration, industrial routers often become accidental bridges due to default settings. The “default gateway on each interface” created a routing ambiguity that could be exploited for man-in-the-middle attacks or lateral movement. In the context of an industrial router, this risk is magnified because the device is always on, always connected, and rarely monitored.
Hardening Strategies for the OT Edge
Given the active exploitation of devices like Four-Faith and MikroTik, and the systemic risks illustrated by our own findings, a proactive hardening strategy is mandatory. We cannot wait for patches; we must assume compromise until proven otherwise. Here is how to approach this.
1. Inventory and Classification
You cannot secure what you do not know exists. Many OT networks contain “shadow routers” installed by maintenance contractors or previous engineers. Conduct a passive network scan to identify all routing devices. Classify them by function: which ones are purely for remote access? Which ones bridge critical control zones? Prioritize those that have direct internet exposure.
2. Eliminate Default Credentials and Management Access
This is the low-hanging fruit that botnets exploit most aggressively. Ensure that all administrative interfaces on industrial routers are changed from factory defaults immediately. More importantly, disable remote web management if it is not strictly required. If remote access is necessary, enforce multi-factor authentication (MFA) and restrict access to specific whitelisted IP addresses. Never rely on the router’s built-in VPN for critical OT traffic without additional network-level controls.
3. Segment at the Gateway
Treat the industrial router as a perimeter device, not just a pass-through. Configure firewall rules on the router itself to restrict traffic to only what is absolutely necessary. For example, if a cellular link is used for monitoring data only, block all incoming initiation requests from the internet. Use application-layer filtering to allow only specific protocols (such as DNP3 or Modbus TCP) and deny everything else. This limits the attack surface significantly.
4. Firmware and Patch Management
The recent alerts regarding Four-Faith and MikroTik underscore the importance of timely patching. However, in OT, we know that patching is risky. Before applying any updates to your industrial routers, validate them in a lab environment to ensure they do not disrupt communication with PLCs or HMIs. Establish a relationship with the vendor to receive immediate alerts for critical vulnerabilities. If a device cannot be patched, it must be isolated.
5. Monitor for Anomalous Behavior
Industrial routers often generate minimal logs. Configure them to send syslog data to a centralized SIEM or OT monitoring platform. Look for signs of abnormal outbound traffic, which may indicate botnet activity. For instance, if an industrial router begins making DNS queries to known malicious domains or attempts connections to non-business IPs, it is likely compromised.
The Trade-off: Security vs. Operational Continuity
We recognize that hardening these devices introduces friction. Changing a default gateway, disabling a service, or applying a firmware update can cause temporary disruption. In an OT environment, availability is paramount. However, the trade-off must be weighed against the cost of a breach.
Consider the scenario where a botnet compromises your industrial router. The device may not just stop working; it may be used as a pivot point to attack upstream systems. An attacker using a compromised router can inject false commands into your control network, potentially causing physical damage or safety incidents. The downtime from an emergency incident response is far greater than the planned downtime for hardening.
Furthermore, compliance frameworks such as NIST SP 800-82 and IEC 62443 explicitly require secure remote access and network segmentation. Failing to harden your edge devices leaves you non-compliant with industry standards and potentially liable in the event of an incident.
Conclusion
The era of the air gap is over, but that does not mean we are defenseless. It means we must be more disciplined than ever before. The active exploitation of industrial routers by botnets is a clear signal: the attackers are already here, and they are targeting the weakest links in your OT perimeter.
By prioritizing inventory, eliminating defaults, segmenting at the gateway, and monitoring for anomalies, you can significantly reduce your risk. Remember the lesson from our recent assessment: even small misconfigurations, like multiple active default gateways, can collapse your security architecture. Ensure your industrial routers are hardened, monitored, and managed with the same rigor as your core IT infrastructure.
Don’t wait for the next botnet to find you. Take control of your OT edge today.
Secure Your OT Infrastructure
Is your industrial network ready for the current threat landscape? Red Trident specializes in OT/ICS cybersecurity, providing expert assessments and remediation roadmaps tailored to your operational needs. We help you identify vulnerabilities, harden your edge devices, and secure your remote access architectures without compromising uptime.
Schedule a free OT security assessment consultation with our team of industrial cybersecurity experts today.
