{"source_checked_on":"2026-10-19","schema_version":1,"key":"ics/T0828","id":"T0828","name":"Loss of Productivity and Revenue","domain":"ics","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T0828","source_file":{"file":"ics.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/ics-attack/ics-attack-20.0.json","sha256":"c9ca0ce523a1b5e512060a390415e8aefe8f6d32c5f82d7de81264960c1e1183","bytes":5266683},"source_object_sha256":"fef90f142b819c54702e3321ff70ec8001258a485c919fc81295dcfee0f11f89","description":"Adversaries may cause loss of productivity and revenue through disruption and even damage to the availability and integrity of control system operations, devices, and related processes. This technique may manifest as a direct effect of an ICS-targeting attack or tangentially, due to an IT-targeting attack against non-segregated environments. \n\nIn cases where these operations or services are brought to a halt, the loss of productivity may eventually present an impact for the end-users or consumers of products and services. The disrupted supply-chain may result in supply shortages and increased prices, among other consequences. \n\nA ransomware attack on an Australian beverage company resulted in the shutdown of some manufacturing sites, including precautionary halts to protect key systems. (Citation: Paganini, Pierluigi June 2020) The company announced the potential for temporary shortages of their products following the attack. (Citation: Paganini, Pierluigi June 2020) (Citation: Lion Corporation June 2020) \n\nIn the 2021 Colonial Pipeline ransomware incident, the pipeline was unable to transport approximately 2.5 million barrels of fuel per day to the East Coast.  (Citation: Colonial Pipeline Company May 2021)","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T0828","external_id":"T0828"},{"source_name":"Colonial Pipeline Company May 2021","description":"Colonial Pipeline Company 2021, May Media Statement Update: Colonial Pipeline System Disruption Retrieved. 2021/10/08 ","url":"https://www.colpipe.com/news/press-releases/media-statement-colonial-pipeline-system-disruption"},{"source_name":"Lion Corporation June 2020","description":"Lion Corporation 2020, June 26 Lion Cyber incident update: 26 June 2020 Retrieved. 2021/10/08 ","url":"https://lionco.com/2020/06/26/lion-update-re-cyber-issue/"},{"source_name":"Paganini, Pierluigi June 2020","description":"Paganini, Pierluigi 2020, June 14 Ransomware attack disrupts operations at Australian beverage company Lion Retrieved. 2021/10/08 ","url":"https://securityaffairs.co/wordpress/104749/cyber-crime/ransomware-attack-hit-lion.html"}],"platforms":["None"],"environments":["ics-ot"],"visibility":"no_standard_source_mapping","visibility_note":"Analyst-proposed lab instrumentation, not an official ATT&CK component mapping or a validated detection. It may observe effects without establishing malicious intent.","parent":null,"children":[],"telemetry":[{"id":"proposed-production-throughput-and-downtime","name":"Production throughput and downtime","page":"telemetry/proposed-production-throughput-and-downtime/","kind":"proposed_input","category":"Industrial operations and physical process","description":"Output-rate and downtime measurements indicating operational consequences.","collection_focus":"Export approved production counters and downtime intervals with baseline, units and change-ticket context.","providers":[{"name":"OPC UA audit-capable servers","scope":"Auditable actions where supported and enabled; inspect server conformance and vendor documentation.","source_id":"opc"},{"name":"Controller, HMI and historian exports","scope":"Vendor-specific process values, quality flags, alarms and operational context.","source_id":"ot"},{"name":"Independent lab sensors / safety records","scope":"Physical-effect corroboration, not a universal cybersecurity log format.","source_id":"ot"}],"configuration":["Agree the measurement points, read-only interfaces, sampling intervals and safety boundary with the process owner. Use a simulator or non-production fixture.","Subscribe to supported audit/alarm events or approved historian exports. Preserve source timestamp, quality, engineering units, asset/tag identity and clock offset.","Compare independent measurements and record gaps/latency. Do not enable intrusive polling, change controller logic or alter safety setpoints merely to generate logs."],"configuration_example":null,"required_fields":["line","units_per_minute","baseline_units_per_minute","downtime_seconds"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-production-throughput-and-downtime","collector":"illustrative-lab-collector","observation":{"line":"lab-fixture","units_per_minute":8,"baseline_units_per_minute":10,"downtime_seconds":0}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"There is no universal PLC event ID or configuration command. Visibility depends on vendor, protocol and process. An alarm or process deviation demonstrates an effect, not necessarily a cyberattack.","sources":[{"id":"opc","title":"OPC UA audit event model","url":"https://reference.opcfoundation.org/specs/OPC-10000-3/9.5"},{"id":"ot","title":"NIST SP 800-82 Rev. 3: OT security","url":"https://csrc.nist.gov/pubs/sp/800/82/r3/final"}],"association":"proposed_input","anomaly_design":"Per asset, operating mode and engineering change window: deviations in command/state sequences, measurement residuals and communication freshness. Use a simulator or approved test rig; never generate hazardous physical effects."},{"id":"proposed-business-impact-records","name":"Business impact records","page":"telemetry/proposed-business-impact-records/","kind":"proposed_input","category":"Industrial operations and physical process","description":"Operational records that document business consequences rather than intrusion mechanics.","collection_focus":"Use approved downtime/incident exports with timestamps, attribution confidence and process-owner review.","providers":[{"name":"OPC UA audit-capable servers","scope":"Auditable actions where supported and enabled; inspect server conformance and vendor documentation.","source_id":"opc"},{"name":"Controller, HMI and historian exports","scope":"Vendor-specific process values, quality flags, alarms and operational context.","source_id":"ot"},{"name":"Independent lab sensors / safety records","scope":"Physical-effect corroboration, not a universal cybersecurity log format.","source_id":"ot"}],"configuration":["Agree the measurement points, read-only interfaces, sampling intervals and safety boundary with the process owner. Use a simulator or non-production fixture.","Subscribe to supported audit/alarm events or approved historian exports. Preserve source timestamp, quality, engineering units, asset/tag identity and clock offset.","Compare independent measurements and record gaps/latency. Do not enable intrusive polling, change controller logic or alter safety setpoints merely to generate logs."],"configuration_example":null,"required_fields":["incident_id","service","downtime_minutes","cause"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-business-impact-records","collector":"illustrative-lab-collector","observation":{"incident_id":"LAB-42","service":"fixture-line","downtime_minutes":5,"cause":"undetermined"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"There is no universal PLC event ID or configuration command. Visibility depends on vendor, protocol and process. An alarm or process deviation demonstrates an effect, not necessarily a cyberattack.","sources":[{"id":"opc","title":"OPC UA audit event model","url":"https://reference.opcfoundation.org/specs/OPC-10000-3/9.5"},{"id":"ot","title":"NIST SP 800-82 Rev. 3: OT security","url":"https://csrc.nist.gov/pubs/sp/800/82/r3/final"}],"association":"proposed_input","anomaly_design":"Per asset, operating mode and engineering change window: deviations in command/state sequences, measurement residuals and communication freshness. Use a simulator or approved test rig; never generate hazardous physical effects."}],"detection":{"key":"ics/T0828","id":"T0828","name":"Loss of Productivity and Revenue","domain":"ics","platforms":["None"],"environments":["ics-ot"],"source_url":"https://attack.mitre.org/techniques/T0828","technique_page":"techniques/ics/T0828/","page":"detections/ics/T0828/","status":"guidance_only","counts":{"sigma":0,"atlas_basic":0,"atlas_anomaly":0,"strategies":1,"analytics":1,"live_validated":0},"sigma_rules":[],"atlas_basic":[],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0757","name":"Detection of Loss of Productivity and Revenue","url":"https://attack.mitre.org/detectionstrategies/DET0757","stix_id":"x-mitre-detection-strategy--c7737640-99e8-4efb-90ee-39332b623b33","relationship_id":"relationship--c19a88bb-b98c-4a2e-9b8f-9dcacd73a9c0","description":"","analytics":[{"id":"AN1889","name":"Analytic 1889","guidance":"No standard detection method currently exists for this technique.","url":"https://attack.mitre.org/detectionstrategies/DET0757#AN1889","platforms":["None"],"tuning":[],"log_sources":[]}]}],"telemetry_references":[{"id":"proposed-production-throughput-and-downtime","name":"Production throughput and downtime","tag":"Proposed: Production throughput and downtime","page":"telemetry/proposed-production-throughput-and-downtime/","kind":"proposed_input"},{"id":"proposed-business-impact-records","name":"Business impact records","tag":"Proposed: Business impact records","page":"telemetry/proposed-business-impact-records/","kind":"proposed_input"}],"visibility":"no_standard_source_mapping","visibility_note":"Analyst-proposed lab instrumentation, not an official ATT&CK component mapping or a validated detection. It may observe effects without establishing malicious intent.","tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0368","name":"NotPetya","url":"https://attack.mitre.org/software/S0368","kind":"malware","description":"[NotPetya](https://attack.mitre.org/software/S0368) disrupted manufacturing facilities supplying vaccines, resulting in a halt of production and the inability to meet demand for specific vaccines. (Citation: David Voreacos, Katherine Chinglinsky, Riley Griffin December 2019)","relationship_id":"relationship--7258c355-677c-452d-b1fc-27767232437b","references":[{"source_name":"David Voreacos, Katherine Chinglinsky, Riley Griffin December 2019","description":"David Voreacos, Katherine Chinglinsky, Riley Griffin 2019, December 03 Merck Cyberattacks $1.3 Billion Question: Was It an Act of War? Retrieved. 2019/12/06 ","url":"https://www.bloomberg.com/news/features/2019-12-03/merck-cyberattack-s-1-3-billion-question-was-it-an-act-of-war"}]},{"id":"S0372","name":"LockerGoga","url":"https://attack.mitre.org/software/S0372","kind":"malware","description":"While Norsk Hydro attempted to recover from a [LockerGoga](https://attack.mitre.org/software/S0372) infection, most of its 160 manufacturing locations switched to manual (non-IT driven) operations. Manual operations can result in a loss of productivity. (Citation: Kevin Beaumont)(Citation: Hydro)","relationship_id":"relationship--46bc86e4-e20b-4778-80d2-8891039e6fb4","references":[{"source_name":"Hydro","description":"Hydro Kevin Beaumont   How Lockergoga took down Hydro  ransomware used in targeted attacks aimed at big business Retrieved. 2019/10/16  Retrieved. 2019/10/16 ","url":"https://www.hydro.com/en/media/on-the-agenda/cyber-attack/"},{"source_name":"Kevin Beaumont","description":"Kevin Beaumont   How Lockergoga took down Hydro  ransomware used in targeted attacks aimed at big business Retrieved. 2019/10/16 ","url":"https://doublepulsar.com/how-lockergoga-took-down-hydro-ransomware-used-in-targeted-attacks-aimed-at-big-business-c666551f5880"}]},{"id":"S0446","name":"Ryuk","url":"https://attack.mitre.org/software/S0446","kind":"malware","description":"An enterprise resource planning (ERP) manufacturing server was lost to the [Ryuk](https://attack.mitre.org/software/S0446) attack. The manufacturing process had to rely on paper and existing orders to keep the shop floor open. (Citation: Kelly Jackson Higgins)","relationship_id":"relationship--383e242a-72d4-4b40-8905-888595c34919","references":[{"source_name":"Kelly Jackson Higgins","description":"Kelly Jackson Higgins   How a Manufacturing Firm Recovered from a Devastating Ransomware Attack Retrieved. 2019/11/03 ","url":"https://www.darkreading.com/attacks-breaches/how-a-manufacturing-firm-recovered-from-a-devastating-ransomware-attack/d/d-id/1334760"}]},{"id":"S0496","name":"REvil","url":"https://attack.mitre.org/software/S0496","kind":"malware","description":"The [REvil](https://attack.mitre.org/software/S0496) malware gained access to an organizations network and encrypted sensitive files used by OT equipment. (Citation: Selena Larson, Camille Singleton December 2020)","relationship_id":"relationship--ab306654-2abb-4983-8d30-df4058adb06c","references":[{"source_name":"Selena Larson, Camille Singleton December 2020","description":"Selena Larson, Camille Singleton 2020, December RANSOMWARE IN ICS ENVIRONMENTS Retrieved. 2021/04/12 ","url":"https://f.hubspotusercontent10.net/hubfs/5943619/Whitepaper-Downloads/Ransomware_in_ICS_Environments_Whitepaper_10_12_20.pdf"}]},{"id":"S0605","name":"EKANS","url":"https://attack.mitre.org/software/S0605","kind":"malware","description":"[EKANS](https://attack.mitre.org/software/S0605) infection resulted in a temporary production loss within a Honda manufacturing plant. (Citation: Davey Winder June 2020)","relationship_id":"relationship--a6519c11-e9d4-4b6f-8d92-8efaa2144c28","references":[{"source_name":"Davey Winder June 2020","description":"Davey Winder 2020, June 10 Honda Hacked: Japanese Car Giant Confirms Cyber Attack On Global Operations Retrieved. 2021/04/12 ","url":"https://www.forbes.com/sites/daveywinder/2020/06/10/honda-hacked-japanese-car-giant-confirms-cyber-attack-on-global-operations-snake-ransomware/?sh=2725c35753ad"}]},{"id":"S0606","name":"Bad Rabbit","url":"https://attack.mitre.org/software/S0606","kind":"malware","description":"Several transportation organizations in Ukraine have suffered from being infected by [Bad Rabbit](https://attack.mitre.org/software/S0606), resulting in some computers becoming encrypted, according to media reports. (Citation: ESET Bad Rabbit)","relationship_id":"relationship--d7ea83fa-87c7-4d36-96d5-aee554504040","references":[{"source_name":"ESET Bad Rabbit","description":"M.Léveille, M-E.. (2017, October 24). Bad Rabbit: Not‑Petya is back with improved ransomware. Retrieved January 28, 2021.","url":"https://www.welivesecurity.com/2017/10/24/bad-rabbit-not-petya-back/"}]},{"id":"S0608","name":"Conficker","url":"https://attack.mitre.org/software/S0608","kind":"malware","description":"A [Conficker](https://attack.mitre.org/software/S0608) infection at a nuclear power plant forced the facility to shutdown and go through security procedures involved with such events, with its staff scanning computer systems and going through all the regular checks and motions before putting the plant back into production. (Citation: Catalin Cimpanu April 2016)","relationship_id":"relationship--51f9963c-c041-4bec-b482-5fda2fb5bca4","references":[{"source_name":"Catalin Cimpanu April 2016","description":"Catalin Cimpanu 2016, April 26 Malware Shuts Down German Nuclear Power Plant on Chernobyl's 30th Anniversary Retrieved. 2019/10/14 ","url":"https://news.softpedia.com/news/on-chernobyl-s-30th-anniversary-malware-shuts-down-german-nuclear-power-plant-503429.shtml"}]}],"actors":[],"mitigations":[{"id":"M0953","name":"Data Backup","url":"https://attack.mitre.org/mitigations/M0953","kind":"course-of-action","description":"Take and store data backups from end user systems and critical servers. Ensure backup and storage systems are hardened and kept separate from the corporate network to prevent compromise.  Maintain and exercise incident response plans  (Citation: Department of Homeland Security October 2009), including the management of gold-copy back-up images and configurations for key systems to enable quick recovery and response from adversarial activities that impact control, view, or availability.\n","relationship_id":"relationship--dda89758-9d0b-446d-b594-85acc7f9cb90","references":[{"source_name":"Department of Homeland Security October 2009","description":"Department of Homeland Security 2009, October Developing an Industrial Control Systems Cybersecurity Incident Response Capability Retrieved. 2020/09/17 ","url":"https://us-cert.cisa.gov/sites/default/files/recommended_practices/final-RP_ics_cybersecurity_incident_response_100609.pdf"}]}],"candidates":[],"simulation":{"atomic_status":"no_atomic_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use a process simulator or isolated test rig with no connection to production controllers or physical actuators. Preserve safety interlocks; destructive effects require synthetic evidence, not real equipment damage.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T0828":"/ttp-simulation/techniques/ics/T0828/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"ics/T0828","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-production-throughput-and-downtime","collector":"illustrative-lab-collector","observation":{"line":"lab-fixture","units_per_minute":8,"baseline_units_per_minute":10,"downtime_seconds":0}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"proposed-business-impact-records","collector":"illustrative-lab-collector","observation":{"incident_id":"LAB-42","service":"fixture-line","downtime_minutes":5,"cause":"undetermined"}}]}}