> ## Documentation Index
> Fetch the complete documentation index at: https://docs.reyhford.com/llms.txt
> Use this file to discover all available pages before exploring further.

# IEC 60870-5-104

> Energy-grid telecontrol protocol (IEC 104) — how it works and how it is attacked.

IEC 60870-5-104 (“IEC 104”) is a telecontrol protocol used extensively in **electric power** SCADA for substations and control centers. It carries ASDUs (application service data units) over TCP, commonly on **port 2404**.

## How IEC 104 works

IEC 104 extends the serial IEC 101 profile to TCP/IP. Control centers issue interrogation, setpoint, and command messages to remote terminal units (RTUs) and IEDs. Security was not a first-class design goal of the original profile; modern deployments may add IEC 62351, but many live links remain lightly protected.

## How attackers abuse it

* **Interrogation storms** — map points and process state
* **Unauthorized commands** — open/close breakers, change setpoints (ATT\&CK **T0855**)
* **Inhibit / block** — interfere with monitoring or protection signaling (**T0814**)
* **Man-in-the-middle** on poorly segmented WAN links (**T0830**)

Industroyer-class malware historically focused on grid protocols in this family — a reminder that IEC 104 exposure is a national CERT priority.

## What Reyhford observes

Our Conpot IEC 104 honeypots record connection attempts and ASDU-oriented probing from internet scanners and research infrastructure. Indicators are tagged with protocol context so energy-sector SOCs can prioritize grid-relevant sources.

See also [Real incidents](/threat-landscape/real-incidents) (Ukraine grid, Industroyer2).