{
  "id": 15147129,
  "title": "ICS-Sniper: Estimating Critical Time Windows in Encrypted SCADA Traffic for Targeted Packet Dropping",
  "url": "https://urgent.news/2026/10/17/ics-sniper-estimating-critical-time-windows-in-encrypted-scada",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-17T07:25:36.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/anoymask/ics-sniper-estimating-critical-time-windows-in-encrypted-scada-traffic-for-targeted-packet-dropping-4f0m"
  },
  "original_language": "en",
  "account": "Title: ICS-Sniper: Estimating Critical Time Windows for Packet Dropping in Encrypted SCADA Traffic\n\nResearchers from the University of British Columbia have developed a method to disrupt Industrial Control System (ICS) traffic by selectively dropping packets during critical time windows. This attack requires compromising an Internet Service Provider (ISP) router located on the communication path between the factory-side gateway and the cloud SCADA system.\n\nThe attacker observes VPN packet lengths, directions, and arrival times to estimate the base period and time windows likely to contain critical control communications. By selectively dropping data packets during these intervals, the attacker disrupts the delivery of control commands and status reports, potentially causing delayed process responses and supply delays.\n\nVictims may experience control process response latency, intermittent supply delays, or degraded control quality. Administrators may notice packet loss, increased retransmissions, SCADA communication timeouts, and process delays on the historian. The VPN tunnel connection remains maintained throughout the attack.\n\nTo mitigate the risk of this attack, organizations should combine path redundancy with monitoring for communication loss at both VPN ends. Switching to local on-site control during anomalies and securing management interfaces on VPN gateways and routers are also recommended. While securing traffic encryption and gateway defense are important, they are not sufficient to prevent external packet dropping.",
  "summary": "1. Basic Information Article Name: ICS-Sniper: A Targeted Blackhole Attack on Encrypted ICS Traffic Source: University of British Columbia researchers Published Date: 2023-12-11 Updated Date: 2026-10-06 Original: University of British Columbia researchers Related Sources: UBC Dependable Systems Lab: ICS-Sniper , SecurityWeek: ICS-Sniper attack roundup Related Malware: None Related Threat Groups:…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}