In early 2023, the US government informed Rockwell Automation of APT activity against a select set of their ControlLogix communication modules used widely across critical infrastructure.
With help of US Government partners, Rockwell was able to call up an A-Team of defenders from partners such as Dragos, Tenable, Mandiant, and Talos to power charge their efforts mitigating this threat and shield customers from exposure. This was the first effort of its kind to successfully bridge the competitor communication gap to head-off a real APT exploit at the pass before customers were impacted.
Despite industry narratives about the unlikely success of such cross-vendor collaboration, these defenders put aside their affiliations and worked closely with Rockwell and each other for the benefit of all customers potentially impacted. In turn, Rockwell was able to defend customers at a level we could not have achieved alone.
Maggie shares this story as a win for the community, a model for future use, and an insight into lessons learned fighting an APT threat as a true cross-vendor team.