BACnet - Reyhford Threat Intelligence

BACnet (Building Automation and Control Networks) is the dominant open protocol for building management systems: HVAC, lighting, access control, and fire panels. It is ISO 16484-5 and runs widely over IP (UDP/TCP 47808).

How BACnet works

Devices expose objects (analog inputs, binary outputs, schedules) that clients read and write. BACnet/IP uses broadcast and unicast discovery. Many deployments leave devices on corporate or even public networks with weak or no authentication.

How attackers abuse it

Device discovery — Who-Is / I-Am enumeration to map a site
Property reads — temperatures, occupancy, door states for physical reconnaissance
WriteProperty — change setpoints, unlock doors, disable alarms
Denial of service — flood Broadcast Management Devices (BBMD)

Building systems often bridge to corporate IT, making BACnet a pivot into both physical security and enterprise networks.

What Reyhford observes

BACnet traffic on our sensors is lower volume than Modbus/S7 but high signal: probes tend to be deliberate discovery rather than blind internet noise. Indicators typically map to reconnaissance and unauthorized command patterns (MITRE T0855, T0830 when on-path).

Facilities and campuses should treat BACnet/IP exposure with the same seriousness as Modbus — building automation is OT.