Skip to main content
T0830 Man in the Middle describes adversaries who position themselves between ICS components (engineering workstation ↔ PLC, SCADA ↔ RTU) to observe, modify, or replay traffic.

​
Why ICS is vulnerable

Many industrial protocols (Modbus, classic S7, BACnet/IP, IEC 104 without 62351) lack strong mutual authentication. ARP spoofing, rogue gateways, or compromised jump hosts can place an attacker on-path with little protocol-level resistance. Stuxnet famously replayed normal process values to operators while damaging equipment — a classic MitM integrity attack.

​
Observable patterns

  • Unexpected ARP/gateway changes on OT VLANs
  • Duplicate CIP/Modbus masters
  • Latency or sequence anomalies on telecontrol links
  • Internet-facing “proxies” that terminate ICS protocols

​
Reyhford context

Internet honeypots primarily see edge reconnaissance, not full on-path plant attacks. We still map MitM-relevant technique tags when traffic patterns or enrichment imply spoofing/proxy tooling, and we document T0830 so SOC playbooks connect public IoCs to internal OT detection (SPAN, CIP Security, IEC 62351). Related: T0855, Modbus, IEC 104.