IEC 60870-5-104 - Reyhford Threat Intelligence

IEC 60870-5-104 (“IEC 104”) is a telecontrol protocol used extensively in electric power SCADA for substations and control centers. It carries ASDUs (application service data units) over TCP, commonly on port 2404.

How IEC 104 works

IEC 104 extends the serial IEC 101 profile to TCP/IP. Control centers issue interrogation, setpoint, and command messages to remote terminal units (RTUs) and IEDs. Security was not a first-class design goal of the original profile; modern deployments may add IEC 62351, but many live links remain lightly protected.

How attackers abuse it

Interrogation storms — map points and process state
Unauthorized commands — open/close breakers, change setpoints (ATT&CK T0855)
Inhibit / block — interfere with monitoring or protection signaling (T0814)
Man-in-the-middle on poorly segmented WAN links (T0830)

Industroyer-class malware historically focused on grid protocols in this family — a reminder that IEC 104 exposure is a national CERT priority.

What Reyhford observes

Our Conpot IEC 104 honeypots record connection attempts and ASDU-oriented probing from internet scanners and research infrastructure. Indicators are tagged with protocol context so energy-sector SOCs can prioritize grid-relevant sources. See also Real incidents (Ukraine grid, Industroyer2).