- Join Our Company
- Email: sanjay@pjnetworks.com
- Phone: +91-9818361787
India’s power grids, water treatment facilities, pharmaceutical manufacturers, and port logistics operators share a dangerous blind spot: millions of operational technology (OT) and industrial control system (ICS) devices that were never designed with cybersecurity in mind. In 2025 and into 2026, nation-state threat actors and financially motivated ransomware gangs have pivoted hard toward these environments, exploiting firmware vulnerabilities that traditional IT security tools simply cannot see.
This post outlines why firmware-level attacks on OT/ICS are escalating in India, what the attack surface looks like, and the layered defence architecture that Indian enterprise security teams and CISOs can deploy today.
Industrial environments were historically air-gapped. Today, business pressures — remote monitoring, ERP integration, Industry 4.0 automation, and cloud-connected SCADA — have collapsed that gap. The result is a hybrid IT/OT estate where Modbus, DNP3, and PROFINET devices communicate across the same IP fabric as Windows workstations and SaaS applications.
Firmware exploits are particularly dangerous in this landscape for three reasons:
Real-world incidents — from the Colonial Pipeline ransomware event in the United States to repeated intrusion attempts against Indian power sector assets documented by CERT-In — demonstrate that threat actors have operationalised these techniques. India’s National Critical Information Infrastructure Protection Centre (NCIIPC) has flagged sustained campaigns targeting energy, telecom, and water utilities.
Understanding how a firmware attack unfolds helps defenders prioritise correctly. The typical kill chain has five stages:
Attackers enter through the IT layer: a phishing email to an engineer’s workstation, a vulnerable VPN appliance, or an internet-exposed remote desktop session. Once inside the corporate network, they pivot toward the historian server or the engineering workstation that has connectivity into the OT DMZ.
Tools like Shodan, Censys, and purpose-built OT scanners reveal which protocols are reachable from the IT network. Internally, attackers map the OT environment passively, watching Modbus and DNP3 traffic to fingerprint device types and firmware versions without triggering alarms.
Using default or harvested credentials, the attacker accesses the HMI or engineering workstation responsible for firmware updates. In many Indian industrial sites, these workstations run Windows 7 or Windows 10 with no EDR, no network segmentation policy, and local admin accounts shared across the operations team.
The attacker uses a legitimate firmware update mechanism — the same tool that a maintenance engineer would use — to push a modified firmware image. The implant typically adds a backdoor, modifies process setpoints silently, or installs a destructive payload triggered by a future condition (a specific date, an operator command, or a remote signal).
The implant survives OS reinstalls, hard resets, and even physical power cycles on some device classes. Impact ranges from covert data exfiltration and intellectual property theft to process manipulation (particularly dangerous in chemical or power environments) or outright ransomware detonation across the OT network.
India’s OT attack surface is large and growing. Several factors amplify the risk:
No single control stops a determined firmware attacker. Defence-in-depth, adapted for the OT context, is the only viable approach.
The most impactful single control is aggressive segmentation between IT, OT DMZ, and process control networks. FortiGate next-generation firewalls support OT-aware deep packet inspection for Modbus, DNP3, IEC 61850, and EtherNet/IP, allowing security teams to write policies based on industrial protocol semantics — not just IP addresses and ports.
A reference architecture for Indian manufacturing environments typically includes:
Remote access to OT environments — essential for vendor support, multi-site monitoring, and post-pandemic operations — is one of the highest-risk vectors. Traditional VPN grants broad network access once authenticated. ZTNA enforces least-privilege access at the application and device level, verifying user identity, device posture, and context on every session.
PJ Networks deploys FortiClient-based ZTNA for clients with distributed plant floors, replacing legacy VPN with per-session, per-asset access controls that can distinguish between a vendor engineer accessing a specific HMI and a lateral-moving attacker attempting to reach the same device.
You cannot protect what you cannot see. Many Indian industrial operators cannot enumerate all the devices on their OT network, let alone their firmware versions. Passive network monitoring — non-intrusive, read-only traffic analysis — builds this inventory without risking process disruption from active scanning. This baseline is the foundation of every subsequent security control.
OT environments have highly predictable traffic patterns. A PLC polling a sensor every 500 ms for years suddenly polling every 5 seconds is anomalous. A firmware upload outside a scheduled maintenance window at 2 AM is anomalous. These behavioural signals are only useful if someone is watching around the clock.
PJ Networks’ 24/7 NOC/SOC provides continuous monitoring for both IT and OT layers, with alert correlation logic that understands the difference between a normal process event and an indicator of compromise. For clients with CERT-In reporting obligations, our SOC maintains runbooks specifically designed to meet the six-hour incident reporting window.
One of the persistent challenges in OT security is the tooling gap: IT security teams run SIEM and SOAR platforms built for Windows event logs and cloud APIs, while OT environments generate completely different telemetry — network flows, serial protocol logs, historian data, and physical sensor events. The result is two separate monitoring silos, and threat actors exploit the gap between them.
PrahiX Ora is a unified SecOps platform built by PrahiX Tech Pvt Ltd. PJ Networks is its primary field deployment and operations partner, and we operate Ora on behalf of clients across manufacturing, utilities, and multi-site enterprise estates.
SIEM: Ora’s SIEM ingests logs from IT infrastructure — firewalls, endpoints, cloud — and OT data sources simultaneously. Correlation rules are mapped to the MITRE ATT&CK for ICS framework, so a reconnaissance scan of Modbus devices appears in the same attack timeline as the phishing email that granted initial IT foothold. Attack storylines are reconstructed as a graph, giving defenders the full picture rather than isolated alerts. For Indian operators, Ora’s tiered retention architecture — hot, cold, and archive — directly supports CERT-In’s direction on 180-day in-country log retention, keeping audit-ready logs on Indian infrastructure.
NMS: Ora’s Network Management System provides unified observability across FortiGate firewalls, managed switches, wireless APs, WAN links, and SD-WAN overlays in a single operational view. LLDP and CDP topology discovery auto-maps the network, and network path tracing helps NOC teams isolate faults in complex multi-site estates. ML-based anomaly detection flags deviations from learned baselines — precisely the kind of subtle firmware-upload-outside-maintenance-window signal that manual monitoring misses. This is especially valuable for multi-vendor OT environments where NOC visibility is typically fragmented across four or five separate management consoles.
Video Surveillance (VMS): Physical security is inseparable from cyber security in industrial environments. Ora’s video surveillance (VMS) module manages ONVIF, Hikvision, and Dahua cameras with integrated video analytics. For manufacturing and retail multi-site estates, physical access events — an engineer entering the server room at an unusual hour — appear in the same operational dashboard as network alerts, enabling correlation between a physical badge-in event and a simultaneous firmware upload attempt on the same segment.
SOAR: CERT-In’s six-hour incident reporting window is not achievable through manual processes when an incident spans multiple plants and dozens of affected devices. Ora’s SOAR module provides playbook automation with pre-built connectors, including direct integration with FortiGate to push blocklists, quarantine devices, and isolate network segments without requiring individual human approvals for each action. This automation is what makes the six-hour reporting timeline realistic — the platform handles triage and initial containment while the SOC analyst focuses on investigation and stakeholder communication.
If your organisation is running IT and OT security monitoring from separate tools with no shared visibility, we recommend a conversation about how the platform we deploy and operate for clients can close that gap. Reach out to PJ Networks for an OT/IT convergence assessment.
Beyond network-layer defences, leading-edge OT security programmes are beginning to implement firmware integrity verification — cryptographically checking that device firmware matches a known-good hash before and after maintenance windows. This is the only way to definitively detect a firmware implant that has survived a device restart.
For Indian operators beginning this journey, a pragmatic starting point is to establish firmware baseline hashes for the highest-criticality devices — process controllers, protective relays, safety instrumented systems — and build a change-management workflow that triggers a firmware hash check after any vendor visit or remote access session. Even this basic control significantly raises the cost of a persistent firmware attack.
Indian organisations operating critical infrastructure face a regulatory landscape that shapes how OT security incidents must be handled:
PJ Networks’ SOC maintains dedicated incident response runbooks for each of these reporting obligations, ensuring that clients can meet regulatory timelines even during the most chaotic phase of an OT incident response.
If you are an IT leader or CISO at an Indian enterprise with OT exposure, here is a practical roadmap:
Firmware-level attacks on OT and ICS environments represent one of the most technically sophisticated and business-impactful threats facing Indian enterprises today. The combination of long-lifecycle devices that cannot be patched, expanding IT/OT convergence, and a tightening regulatory environment creates urgency that cannot be deferred to the next budget cycle.
PJ Networks provides end-to-end OT security services — from FortiGate segmentation and ZTNA deployment to 24/7 NOC/SOC monitoring and CERT-In-aligned incident response — for Indian enterprises across manufacturing, utilities, logistics, and multi-site operations. If your organisation is ready to close the gap between IT and OT security visibility, contact our team for an initial assessment.