Uncovering regionally targeted ICS/SCADA scanning and enumeration

GreyNoise outlines how it extended its Precursor tool—combining PCRE2-based labeling and TLSH similarity hashing—to rapidly triage ICS/SCADA payloads observed targeting sensors in Israel, enabling flexible analysis without protocol parsers. Preliminary findings indicate most activity resembles routine scanning/enumeration (e.g., Nmap/ZGrab2), with no reliable signatures or attribution yet; the team plans to open-source the tool and expand protocol coverage.