FrostyGoop: Modbus Attack on OT Heating Controls

A district-heating utility's internet-facing edge appliance was compromised via default credentials, giving an attacker access to the IT/historian segment. From there they deployed a purpose-built Modbus TCP tool to overwrite operating setpoints on three ENCO district-heating controllers, cutting off heat to hundreds of downstream customers in the middle of winter. Reconstruct the intrusion chain from SIEM (Windows/Sysmon + SCADA alarms), PCAP (Modbus write transactions), and firewall logs.