Pre-positioning (PP)

Taxonomies › Critical Infrastructure › PP · Pre-positioning

Access taken in peacetime and held for a crisis: where it hides, how it survives, and how it is staged towards the process. Part of The Campaign deck, ranked Ace to 2 by severity in the game. This page is part of the Critical Infrastructure (Cyberwarfare) Threat Taxonomy, the reference for the Black Start card game.

Mappings at a glance

STRIDE, CAPEC 3.9, CWE 5.0, ATT&CK for ICS v20.0, the Cyber-Informed Engineering principles (main one first) and standards, entry by entry. The same mappings are in each entry below and in the Excel, SKOS and STIX downloads.

Entries

BKS-PP-A · Access held for a crisis

The adversary takes access to IT and OT networks and then does nothing visible for years, waiting for a crisis or a political moment. Detection designed to catch active intrusion never fires, and the access is ready to switch to disruption.

Case: Volt Typhoon pre-positioning, 2024 advisory.

Principle. Assume dormant access already exists, and hunt for it on a schedule rather than waiting for an alert.

Design measures.

1. Run threat hunts against published state-actor techniques at least yearly and after each relevant advisory.
2. Baseline normal administrative behaviour and review accounts and sessions that deviate, even when quiet.
3. Design OT so that critical functions can be isolated from IT and remote access at short notice.

Mappings: STRIDE S, E · CAPEC-560 · CWE-778 · ATT&CK for ICS T0859, T0886 · CIE 6, 10

BKS-PP-K · Edge devices as home

VPN concentrators, firewalls and routers are exposed, often unpatched, cannot run endpoint detection and keep few logs. The adversary enters through them and lives on them, outside the view of every other control.

Case: Volt Typhoon pre-positioning, 2024 advisory; Danish energy sector, 2023.

Principle. Devices at the boundary are monitored and maintained as critical assets, not as appliances.

Design measures.

1. Send edge device logs and configuration changes to central collection, and alert on changes nobody requested.
2. Patch or mitigate edge devices first and fastest; replace models the vendor no longer supports.
3. Check edge device integrity against vendor tools or known-good images on a schedule.

Mappings: STRIDE S, T, E · CAPEC-542 · CWE-778, CWE-1104 · ATT&CK for ICS T0819, T0822 · CIE 6, 5

BKS-PP-Q · Dormant logic in controllers †

A modified controller program carries a trigger, a date, a condition or a command, and behaves normally until then. Routine checks look at the running process, not the logic, so the change waits unseen until it fires.

Case: Stuxnet, 2010.

Principle. Controller logic is verified against an authoritative, signed version, not judged by how the process behaves.

Design measures.

1. Compare controller programs with the approved version on a schedule and after every maintenance visit.
2. Store approved logic offline with hashes, and require two people to approve logic changes.
3. Use controllers with a physical run/program key and keep it in run.

Mappings: STRIDE T, E · CAPEC-441 · CWE-511, CWE-506 · ATT&CK for ICS T0889, T0821 · CIE 2, 8

BKS-PP-J · The IT-to-OT route is pre-built

Before any effect is needed, the adversary collects jump-host credentials, finds dual-homed machines and changes firewall rules. The step from office network to control network is ready in advance, so action takes minutes.

Case: Volt Typhoon pre-positioning, 2024 advisory.

Principle. The path into OT is narrow, monitored, and cannot be prepared without someone noticing.

Design measures.

1. Allow access into OT only through a dedicated, monitored broker with separate credentials and MFA.
2. Alert on any change to IT/OT firewall rules and review the rule set against a documented baseline.
3. Find and remove dual-homed hosts and unmanaged links between IT and OT.

Mappings: STRIDE E, T · CAPEC-700 · CWE-653 · ATT&CK for ICS T0886, T0867, T0859 · CIE 3, 5

BKS-PP-10 · Firmware implants survive rebuilds

Implanted firmware in controllers, network devices or server management chips survives an operating system rebuild. Recovery reuses compromised hardware and the adversary keeps its place.

Principle. Firmware integrity is verifiable from a trusted root, and recovery plans include hardware that cannot be trusted.

Design measures.

1. Buy devices that verify signed firmware at boot from a hardware root of trust.
2. Record firmware versions and hashes and check them after incidents and before returning devices to service.
3. Hold spare hardware for critical functions so suspect devices can be replaced, not reflashed.

Mappings: STRIDE T, E · CAPEC-638 · CWE-1326, CWE-347 · ATT&CK for ICS T1693 · CIE 2, 10

BKS-PP-9 · Project files carry the implant †

Infected project files on an engineering workstation are carried to controllers at the next routine download. The engineering process itself spreads the adversary’s change.

Case: Stuxnet, 2010.

Principle. Project files are integrity-checked and engineering workstations are dedicated and controlled.

Design measures.

1. Keep project files in a version-controlled repository with hashes, and verify before download to a controller.
2. Dedicate engineering workstations to engineering work, with no email or web browsing.
3. Scan and verify project files received from integrators before use.

Mappings: STRIDE T · CAPEC-441 · CWE-494, CWE-353 · ATT&CK for ICS T0873, T0843 · CIE 11, 2

BKS-PP-8 · Living off the land

The adversary uses built-in administration tools and legitimate accounts rather than malware. Detection tuned for malicious files sees nothing unusual, and the activity looks like routine administration.

Case: Volt Typhoon pre-positioning, 2024 advisory.

Principle. Detection is based on behaviour and context, not only on known-bad files.

Design measures.

1. Restrict administrative tools on OT hosts to named accounts and approved hosts.
2. Log command-line and remote-session activity and alert on administrative use at unusual times or from unusual hosts.
3. Follow national living-off-the-land guidance and test detections against its techniques.

Mappings: STRIDE E, R · CAPEC-560 · CWE-778 · ATT&CK for ICS T0859, T1701 · CIE 6

BKS-PP-7 · Access borrowed from criminals

Footholds bought from access brokers or taken over from a ransomware intrusion give the adversary deniable access. Operators treat the criminal incident as closed once systems are restored and do not look for what stayed behind.

Principle. Every intrusion, whatever its apparent motive, is followed by a hunt for persistence.

Design measures.

1. After any intrusion, hunt for persistence in IT, edge devices and OT before declaring recovery complete.
2. Rotate every credential that could have been exposed, including service and vendor accounts.
3. Report criminal intrusions to the national authority so links to state activity can be made.

Mappings: STRIDE S, E · CAPEC-555 · ATT&CK for ICS T0859, T0822 · CIE 6, 12

BKS-PP-6 · Service accounts that never expire

Vendor, integrator and service accounts keep standing privileges, are never rotated and are often shared across sites. Once taken, they give the adversary lasting, legitimate-looking access.

Principle. Privileged and service accounts are owned, scoped, time-limited and rotated.

Design measures.

1. Give every service and vendor account a named owner, a scope and an expiry date.
2. Rotate service credentials automatically and on staff or supplier change.
3. Grant vendor privileges just in time, for the session, rather than standing.

Mappings: STRIDE S, E · CAPEC-560 · CWE-262, CWE-798 · ATT&CK for ICS T0859, T1694 · CIE 9, 3

BKS-PP-5 · Logging gaps the adversary relies on

OT hosts and devices keep little or no log, logs are local and overwritten, and nothing is collected centrally. The adversary deletes what exists, and after an incident nobody can tell what happened.

Case: Volt Typhoon pre-positioning, 2024 advisory.

Principle. Security-relevant events from OT and edge devices are collected off the device and kept long enough to investigate years-long intrusions.

Design measures.

1. Forward logs from OT hosts, edge devices and controllers that support it to a protected central store.
2. Keep logs for at least the dwell times seen in state-actor intrusions, which can be years.
3. Alert when a source stops sending logs.

Mappings: STRIDE R · CAPEC-268, CAPEC-571 · CWE-778, CWE-223 · ATT&CK for ICS T0872 · CIE 6, 8

BKS-PP-4 · Identities planted for later

The adversary adds its own accounts, SSH keys, certificates, API tokens or VPN profiles. Nobody reconciles identities against an authoritative list, so the additions stay.

Principle. Every identity and credential in OT is reconciled regularly against an authoritative register.

Design measures.

1. Keep an authoritative register of accounts, keys and certificates for OT and remote access.
2. Reconcile live identities against the register monthly and remove anything unregistered.
3. Alert on creation of accounts, keys or tokens outside a change.

Mappings: STRIDE S, E · CAPEC-560 · ATT&CK for ICS T0859 · CIE 8, 6

BKS-PP-3 · Traffic from inside your own country

Command traffic arrives through compromised home and small-office routers in the defender’s own country. Geographic blocking and IP reputation filters let it through as local traffic.

Case: Volt Typhoon pre-positioning, 2024 advisory.

Principle. Access decisions rest on strong authentication of the user and device, not on where traffic appears to come from.

Design measures.

1. Do not rely on country blocking or IP allow-lists as the control for remote access.
2. Require phishing-resistant MFA and device certificates for every remote connection.
3. Watch for logins from residential address ranges to administrative interfaces.

Mappings: STRIDE S · CWE-290 · ATT&CK for ICS T0884 · CIE 3, 6

BKS-PP-2 · Forgotten remote tools

Remote desktop and support tools installed by vendors years ago remain on HMIs and servers, still able to connect out. The adversary reuses them as ready-made, trusted persistence.

Principle. Only approved remote access paths exist, and every installed tool is known and justified.

Design measures.

1. Inventory remote access software on all OT hosts and remove what is not approved.
2. Block outbound connections from OT hosts except to named, approved destinations.
3. Check for new remote access software after every vendor visit.

Mappings: STRIDE S, E · CAPEC-555 · CWE-1188 · ATT&CK for ICS T0822, T0886 · CIE 8, 4

Public cases cited in this suit

• Volt Typhoon pre-positioning, 2024 advisory. A February 2024 joint advisory found PRC state-sponsored actors inside the IT networks of US communications, energy, transport and water organisations, holding access, in some cases for at least five years, to disrupt operational technology in a crisis or conflict. Attribution: Attributed by CISA, NSA and FBI to PRC state-sponsored actors. Sources: CISA advisory AA24-038A
• Danish energy sector, 2023. In May 2023 attackers compromised 22 Danish energy companies in coordinated waves through flaws in the firewalls that protected them, the largest such attack Denmark had seen. Attribution: Unattributed; SektorCERT saw indicators linked to Sandworm in at least one attack, which other researchers later questioned. Sources: SecurityWeek: 22 energy firms hacked in Denmark; SecurityWeek: Russian hackers likely not involved
• Stuxnet, 2010. Malware found in 2010 changed the speed of uranium enrichment centrifuges at Natanz, Iran, while operators saw normal readings, damaging equipment over months. Attribution: No official attribution; widely reported as a US and Israeli operation. Sources: Schneier on Security: More Stuxnet news; iTnews: Stuxnet the first to attack Iran nuclear plant

© 2026 Jonathan Brett Crawley. Licensed under CC BY-NC-ND 4.0 with additional permissions: see the licence on the overview. † marks a physical-safety consequence.