Manufacturing IR: ERP Compromise, CAD Theft, and Shop Floor Ransomware

Cybersecurity

Manufacturing IR spans SAP compromise, intellectual property theft via PLM systems, and ransomware on shop floor OT. This playbook covers the triage priorities when production lines and IP are simultaneously at risk.

By Arjun Raghavan, Security & Systems Lead, BIPI · October 14, 2024 · 11 min read

In 2023, MKS Instruments lost approximately 200 million USD in revenue following a ransomware attack that disrupted manufacturing operations across multiple sites. Applied Materials cited a supplier ransomware incident that cost them 250 million USD in delayed shipments. Manufacturing sector ransomware attacks that reach the shop floor OT environment are no longer primarily data breach incidents; they are operational continuity crises with measurable revenue impact by the hour.

The Manufacturing Attack Surface

A modern manufacturing facility has three distinct layers that IR must address simultaneously: the enterprise IT layer (SAP ERP, email, file servers), the manufacturing operations layer (MES, PLM, CAD systems, engineering workstations), and the shop floor OT layer (PLCs, CNCs, robotics controllers, SCADA). An attacker who gains IT access will frequently pivot through the manufacturing operations layer to reach the shop floor, because the operational disruption potential of the shop floor is what justifies a higher ransom demand.

• SAP ERP holds production orders, BOM (bill of materials) data, customer data, and financial records. A compromised SAP system can disrupt every production order in flight.
• PLM systems (Siemens Teamcenter, PTC Windchill, Dassault ENOVIA) hold CAD files, engineering change orders, and product specifications that represent years of R&D.
• MES (Manufacturing Execution Systems) connect the ERP order to the shop floor machine. A compromised MES can push incorrect production parameters to CNCs and robotics.
• Engineering workstations on the manufacturing floor often run unpatched Windows versions and have direct connectivity to both the enterprise network and the shop floor OT network.

ERP (SAP) Compromise: Immediate Triage

SAP is frequently the crown jewel of manufacturing IR incidents. A fully compromised SAP environment can expose customer lists, supplier contracts, product costings, and financial data simultaneously. SAP-specific attack toolkits (including those documented by Onapsis Research) target SAP RFC connections, ABAP vulnerabilities, and SAP Gateway misconfigurations.

1. Engage your SAP Basis team immediately. Standard DFIR analysts without SAP expertise will miss SAP-specific indicators. Onapsis or a firm with SAP security expertise should be on the IR team.
2. Pull SAP Security Audit Log (transaction SM20) for the compromise window. This log records authentication events, authorization failures, and RFC calls.
3. Check for RFC connections from unusual source systems. SAP RFC is a common pivot path between SAP and adjacent systems.
4. Review user master records (SU01) for accounts created or modified during the incident window. Attackers create SAP service accounts to maintain persistence.
5. Identify whether SAP Solution Manager (SolMan) was compromised. SolMan has administrative access to all managed SAP systems; a compromised SolMan is a compromised SAP landscape.

CAD and PLM System Exfiltration: IP Theft Response

Intellectual property theft from PLM and CAD systems is often a secondary objective in manufacturing ransomware attacks: the attacker exfiltrates CAD files and engineering specifications before detonating the ransomware. This creates a double-extortion scenario where paying the ransom does not recover the stolen IP. IP theft incidents may also trigger export control obligations if the stolen files contain ITAR or EAR-controlled technical data.

• Pull PLM access logs for bulk download activity in the 30 days prior to ransomware detonation. Exfiltration typically precedes encryption by days to weeks.
• Identify which product lines and projects had files accessed. Prioritize identifying whether any ITAR or EAR controlled designs were in scope.
• Notify General Counsel and export compliance officer within the first four hours if controlled technical data may have been accessed.
• Preserve PLM audit logs as forensic evidence. These logs may be needed for regulatory reporting and potential civil litigation against the attacker (if attributable).

Shop Floor Ransomware: Production Line Triage

When ransomware reaches the shop floor, the first decision is which production lines can be safely shut down and which must continue under manual supervision. A CNC machining center that is mid-operation when the MES loses connectivity will typically enter an alarm state and stop; this is usually safe. A continuous chemical process or casting operation may not be safely interrupted.

Manufacturing ransomware recovery is not just a system restore exercise. Every CNC program, robot path, and process parameter must be validated against the engineering baseline before production restarts.

Recovery Sequencing: IT to OT

• Restore Active Directory and core identity infrastructure first. Everything else depends on authentication.
• Restore SAP ERP from backup after confirming the backup predates the compromise and the infection vector is closed.
• Restore PLM and CAD systems after verifying backup integrity. Do not restore from a backup that may itself contain backdoors or malware.
• Reimage engineering workstations that connect to both IT and OT networks. These are the most likely pivot points.
• Validate PLC programs and CNC part programs against the engineering baseline before restarting automated production. Do not trust programs stored on a compromised MES.
• Conduct a test production run on each line under engineering supervision before returning to full production speed.

Read more field notes, explore our services, or get in touch at info@bipi.in. Privacy Policy · Terms.