Cyber threat bulletin: Non-state activity targeting Canadian operational technology

The Canadian Centre for Cyber Security (Cyber Centre) has continued to observe non-state cyber threat actors targeting and attempting to disrupt vulnerable, internet-exposed operational technology (OT) systems in Canada. Non-state actors often use cyber threat activity to intimidate or coerce their targets, either to influence public opinion or government decision making related to international events.

We assess that non-state activity against Canada very likely increases around events like public statements or policy announcements by Canada that these actors perceive as being counter to their ideological goals, and around other high-profile events, for example diplomatic summits or major international sporting events, that amplify the visibility and impact of their activity. However, we assess that some non-state actors likely continuously scan for vulnerable systems in Canada and may conduct disruptive or destructive cyber threat activity at any time.

Although some non-state actors appear to receive support from state actors, we assess that most non-state cyber threat activity against Canadian OT systems is almost certainly independently planned and executed. Relationships between state and non-state actors are frequently ad hoc, and the degree of connection can vary over time. As such, state-aligned non-state activity should not necessarily be interpreted as representing state interests or policy toward Canada.

Tactics, techniques, and procedures

A growing number of non-state actors are targeting internet-connected OT systems intending to cause disruptive or destructive effects. These actors generally demonstrate low to moderate technical sophistication but are effective due to poor exposure hygiene and insecure remote access in OT environments.

In October 2025 alone, there were several incidents of non-state actors affecting OT systems in Canada including:

• A pro-Russia non-state actor compromised a municipal water system and successfully manipulated water pressure valve controls, causing minor impacts to water service delivery.
• A pro-Hamas non-state actor gained access to a fuel tank gauging system located at an airport. The actor was able to view system information but did not gain the ability to manipulate system controls.
• A pro-Russia non-state actor gained access to a grain drying silo's control system. The actor manipulated temperature and humidity levels within the silo, but there was no evidence that damage was caused.

This activity frequently uses publicly available scanning tools to identify internet-connected OT and exploits outdated or insecurely configured remote access tools like virtual network computing (VNC), weak or default passwords, or systems that do not use multi-factor authentication.

After gaining access to these systems, non-state actors attempt to disrupt them by defacing system interfaces, changing configurations, and manipulating system controls. This can lead to operational disruptions, systems operating in unintended ways, and potentially physical damage to the systems. In some cases, this activity may create dangerous conditions that implicate operator or public safety.

Non-state actor OT TTPs mapped to MITRE ATT&CK for ICS

T0888 – Remote System Discovery

Internet wide scanning for exposed OT systems and remote access services

T0866 – Valid Accounts

Exploitation of internet accessible remote access services using weak, default, or reused credentials (e.g., VNC, remote desktop, vendor maintenance portals)

T0886 – Remote Services

Use of legitimate remote services to access OT environments

T0856 – Control Device Identification

Direct interaction with human machine interfaces (HMIs), engineering workstations, or control system interfaces

T0831 – Manipulation of Control
T0809 – Modify Controller Tasking

Manipulation of OT system configurations and setpoints (e.g., pressure, temperature, alarms)

Outlook

The cyber threat picture facing OT and OT asset operators is deteriorating. Although Canada has avoided a high-impact OT incident to date, the expanding threat surface associated with vulnerable OT deployments and the increase in threat actor capability and intent against those systems increases the likelihood that future incidents will be more severe.

Cyber threat actors continue to adapt their activities in response to geopolitical events, technological developments, and mitigation efforts by defenders. Artificial intelligence (AI) tools capable of supporting cyber threat activity are rapidly improving and becoming increasingly available. These tools allow even low sophistication cyber threat actors to conduct more complex and disruptive attacks against OT systems.

The cyber threat identified in this advisory can largely be mitigated through awareness and by applying cyber security best practices. The Cyber Centre encourages OT and OT system owners to implement the recommended mitigation advice below.

Mitigations

The Cyber Centre recommends that critical infrastructure organizations implement the following mitigations to help establish robust cyber defences against non-state cyber threat actors. Each of the mitigations below are linked to the Cyber Centre's Cyber Security Readiness Goals (CRGs), which are baseline practices for organizations to bolster their cyber security posture. Further details of each goal can be found in the Cross-Sector Cyber Security Readiness Goals Toolkit.

Primary mitigation

The most effective defence against this threat is the removal of OT systems from direct internet exposure and the establishment of a strictly controlled, monitored boundary between OT and OT networks. Many of the additional controls below are compensating measures and are insufficient on their own if OT systems remain internet‑accessible.

Establish and protect the OT boundary and isolate administrative access

Network segmentation (CRG 2.5)

• This will reduce the likelihood that threat actors will access the OT network after compromising the OT network.
• All connections to the OT network are denied by default unless explicitly allowed (for example, by IP address and port) for specific system functionality. Necessary communications paths between the OT and OT networks must pass through an intermediary, such as a properly configured firewall, bastion host, jump box, or a demilitarized zone, which is closely monitored, captures network logs, and only allows connections from approved assets.
  • Note that segmentation could break or disrupt processes and services as legacy OT environments are often flat. Segmentation should be done when possible, and under controlled processes.

Prohibit connection of unauthorized devices (CRG 2.17)

• Maintain policies and processes to ensure that unauthorized media and hardware are not connected to OT assets, such as by limiting use of USB devices and removable media or disabling AutoRun.
• Establish procedures to remove, disable, or otherwise secure physical ports in OT environments to prevent the connection of unauthorized devices, or establish procedures for granting access through approved exceptions.

Limit OT connections to public internet (CRG 2.18)

• Ensure no OT assets are on the public internet, unless explicitly required for operation.
• Require that exceptions be justified and documented and that excepted assets have additional protections in place to prevent and detect exploitation attempts. For example, logging, multi-factor authentication (MFA), mandatory access via proxy or another intermediary.

No exploitable services on the internet (CRG 2.20)

• Ensure assets on the public internet do not expose any exploitable services, such as remote desktop protocol. Where these services must be exposed, implement appropriate compensating controls to prevent common forms of abuse and exploitation. Disable all unnecessary OS applications and network protocols on internet-facing assets.

Secure administrator workstation (SAW) (CRG 2.21)

• Provide administrators with SAWs to perform their administrative tasks. Create secure and hardened SAWs by implementing the following:
  • Isolate SAWs from the public OT network, and when present, from the data plane.
  • Deactivate capability to install other software.
  • Restrict access to the internet or email services.
  • For cloud administration from this dedicated workstation, ensure it requires a VPN or allow lists to access the cloud tenancy.

Use strong access controls

Changing default password (CRG 2.0)

• Enforce an organization-wide policy or process that requires changing default manufacturer passwords for all hardware, software, and firmware before putting them on any internal or external networks. This includes OT assets for OT, such as OT administration web pages. This should be done in consultation with vendor advice and guidance or following an approved vendor process.
• Enforce a policy to change default credentials for all new or future devices. This reduces potential risk in the future if adversary TTPs change and requires significantly less work than changing default passwords on an organization's existing OT.

Minimum password length (CRG 2.1)

• Implement a system-enforced policy that requires a minimum password length of 15 or more characters for all password-protected OT assets where technically feasible.
• OT assets that use a central authentication mechanism (such as Active Directory) are most important to address. Examples of low-risk OT assets that may not be technically feasible include those in remote locations, such as on offshore rigs or wind turbines.

Unique credentials (CRG 2.2)

• Provision unique and separate credentials for similar services and asset access on OT networks.
• Ensure users do not and cannot reuse passwords for accounts, applications, services, etc.
• Require that service accounts/machine accounts have unique passwords from all member user accounts.

Separating user and privileged accounts (CRG 2.4)

• User accounts do not always have administrator or super-user privileges. Administrators should maintain separate user accounts for all actions and activities not associated with the administrator role (for example, for business email, web browsing).
• Reevaluate privileges on a recurring basis to validate continued need for given permissions.

Phishing-resistant multi-factor authentication (MFA) (CRG 2.7)

• Within OT environments, enable MFA on all accounts and systems that can be accessed remotely, including vendors/maintenance accounts, remotely accessible user and engineering workstations, and remotely accessible human-machine interfaces.

Understand and reduce exposure

Asset inventory and network topology (CRG 1.0)

• Maintain a regularly updated inventory of all assets within the organization's OT (including IPv6) and OT networks (if applicable).
• Include in the inventory accurate documentation of network topology and identified data assets, in particular sensitive or classified information.
• Update this inventory on a regular basis for both OT and OT and immediately log in the existing inventory any new asset that is integrated into the organization's infrastructure.

Mitigate known vulnerabilities (CRG 1.1)

• Patch all known exploited vulnerabilities (listed in CISA 's Known Exploited Vulnerabilities Catalog) in internet-facing systems within a risk-informed timespan, prioritizing more critical assets first. Identify security vulnerabilities in your systems by conducting penetration tests and using automated vulnerability scanning tools, activities which are part of a comprehensive vulnerability management strategy.
• For assets where patching is not possible or may substantially compromise availability or safety, apply and record compensating controls (e.g., segmentation, monitoring). Sufficient controls either make the asset inaccessible from the public internet or reduce the ability of threat actors to exploit the vulnerabilities in these assets.
• Carefully select automated vulnerability detection tools as they can scan systems aggressively. These tools may cause devices to behave erratically, stop working/crash, or restart, or need manual intervention to revert to an operational state.

Improve detection and response

Detection of unsuccessful (automated) login attempts (CRG 2.6)

• Log all unsuccessful logins and send to an organization's security team or relevant logging system.
• Ensure security teams are notified (e.g., by an alert) after a specific number of consecutive, unsuccessful login attempts in a short period (e.g., 5 failed attempts over 2 minutes). Log and store these alerts in the relevant security or ticketing system for retroactive analysis.
• For OT assets, implement a system-enforced policy that prevents future logins for the suspicious account. For example, this could be for some minimum time or until the account is re-enabled by a privileged user. Enable this configuration when available on an asset. For example, Windows 11 can automatically lock out accounts for 10 minutes after 10 incorrect logins in a 10-minute period.

Log collection (CRG 2.15)

• Collect and store logs for use in both detection and incident response activities (e.g., forensics), including the following logs:
  • access- and security-focused (e.g., intrusion detection systems / intrusion prevention systems (IDS/IDPS)
  • firewalls
  • data loss prevention (DLP)
  • virtual private networks (VPN)
• Security teams are notified when a critical log source is disabled, such as Windows event logging.
• For OT assets where logs are non-standard or not available, collect network traffic and communications between those assets and other assets.

Conduct risk assessments

Detect relevant threat and TTPs (CRG 3.0)

• Document a list of threats and cyber threat actor TTPs relevant to the organization (for example, based on industry, sectors, etc.) and ensure the ability to detect instances of those key threats (for example, through rules, alerting, or commercial prevention and detection systems).

Organizations should conduct self-assessments using the CRGs toolkit to identify gaps and track progress.

Develop incident response plans

Incident response plan (CRG 1.3)

• Develop, maintain, update, and regularly drill OT cyber security incident response plans for both common and organization-specific threat scenarios (for example, by sector or locality) and TTPs.
• Consider engaging with appropriate stakeholders to conduct tabletop exercises focused on emerging threats such as artificial intelligence-enhanced attacks.

Incident planning and preparedness (CRG 5.0)

• Develop, maintain, and execute plans to recover and restore to service business or mission-critical assets or systems that might be impacted by a cyber security incident.
• If a cyber incident does occur, perform a hotwash post-recovery to determine lessons learned and prevent future incidents. Integrate any lessons learned into improvements in governance processes and/or the incident response plan.

Train staff and vendors

Basic and OT cyber security training (CRG 2.8)

• Provide training that covers basic cyber security and privacy concepts, such as phishing, business email compromise, basic operational security, password security, privacy breaches, etc., and foster an internal culture of security and cyber awareness.
• Ensure that personnel who maintain or secure OT as part of their regular duties receive OT-specific cyber security training at least annually.

Maintain backups

System backups and redundancy (CRG 2.14)

• Regularly back up all systems that are necessary for operations. Determine on a case-by-case basis what systems to back up and the exact frequency since every system will have different backup and recovery requirements.
• Store backups separately from the source systems and test on a recurring basis, no less than once per year, to ensure they are usable.
• Ensure stored information for OT assets includes at a minimum:
  • Configurations
  • Roles
  • Programmable controller (PLC) logic
  • Engineering drawings
  • Tools

These mitigations can help critical infrastructure organizations prevent non-state cyber threat actors from exploiting vulnerable systems. We encourage organizations facing a suspected cyber incident to engage with the Cyber Centre for mitigation and recovery assistance.

Resources

• National Cyber Threat Assessment 2025-2026
• Cyber Threat Bulletin: Cyber Threats to Operational Technology
• Cybersecurity & Infrastructure Security Agency. Unsophisticated Cyber Actor(s) Targeting Operational Technology
• U.S. Department of Justice. Justice Department Announces Actions to Combat Two Russian State-Sponsored Cyber Criminal Hacking Groups
• U.S. Cybersecurity & Infrastructure Security Agency. Known Exploited Vulnerabilities Catalog

---

About this document

This cyber bulletin aims to raise awareness among both information technology (IT) and operational technology (OT) system owners and operators and urges all Canadians to be vigilant of this threat. It builds on a Cyber Centre alert issued on October 29, 2025 on Internet-accessible industrial control systems (ICS) being abused by hacktivists, and a joint cyber security advisory on pro-Russia hacktivism authored by the Cyber Centre and international partners in December 2025, to provide additional threat context and mitigation advice.

For follow-up questions or issues, contact the Cyber Centre at contact@cyber.gc.ca.

Assessment base and methodology

The judgements in this bulletin rely on reporting from multiple sources, both classified and unclassified. They are based on the Cyber Centre's knowledge and expertise in cyber security. Defending the Government of Canada's information systems provides the Cyber Centre with a unique perspective to observe trends in the cyber threat environment, which also informs our assessments. The Communications Security Establishment Canada's (CSE) foreign intelligence mandate provides us with valuable insight into adversary behaviour in cyberspace. While we must always protect classified sources and methods, we provide the reader with as much justification as possible for our judgements.

Our judgements are based on an analytical process that includes evaluating the quality of available information, exploring alternative explanations, mitigating biases and using probabilistic language. We use terms such as "we assess" or "we judge" to convey an analytic assessment. We use qualifiers such as "possibly", "likely" and "very likely" to convey probability.

The assessments and analysis are based on information available as of January 23, 2026.