Red Team in critical infrastructure
Scenario-driven offensive assessments with attention to safety, continuity and process impact.
OTRedOps · Industrial Offensive Security
Security that understands the process.
I’m David Andrade, a Red Team specialist with hands-on experience in industrial environments. I combine automation, vulnerability research and offensive security to uncover risks before they affect operations.
3 CVEspublished
Hall of ThanksSiemens · 2024
ICS / OTcore specialty
01 · Profile
From industrial automation to offensive security.
My approach to cybersecurity began on the factory floor — programming controllers, integrating systems and troubleshooting industrial networks. Today, I draw on that foundation to assess critical environments with technical depth and operational context.
Offensive security
Penetration testing, Red Team, controlled exploitation, social engineering and threat scenario development.
Industrial
PLCs, HMIs, SCADA, Siemens S7-1200/1500, Modbus TCP and automation networks.
02 · Background
Experience on both sides of the IT/OT boundary.
Electronics and automation
Technical training and work in instrumentation, integration, commissioning and maintenance of industrial environments.
PLC, HMI and SCADA
Programming and integration of controllers and supervisory systems, network troubleshooting and operational support.
Red Team & research
Offensive testing in industrial, healthcare and financial sectors, alongside independent research into OT products.
03 · Certifications
Continuous technical development.
Select an image to view the certificate at a larger size.
Certified Ethical Hacker — CEH
Ethical hacking methods, vulnerability assessment and stronger security practices.
ICS Security with GRFICS
Hands-on security exercises and assessments for industrial control systems.
Ethical Hacking Malware Development Essentials
Windows API, implants, C2, persistence, syscalls, obfuscation and anti-reverse techniques.
Defense Evasion
Practical training in evasion techniques and fundamentals for controlled offensive operations.
Internet-Exposed PLCs
Security lessons from the 2026 attacks on water systems with exposed PLCs.
04 · Research
Vulnerabilities with real-world impact.
Responsible research into industrial technologies, documented in official Siemens and CISA advisories.
Username Enumeration
Enumeration of valid users in the web server of SIMATIC products, remotely exploitable without authentication.
Open Redirect
Open redirect in the web server of SIMATIC S7-1200 and S7-1500 CPUs, allowing users to be sent to attacker-controlled addresses.
Cross-Site Request Forgery
CSRF flaw in the web interface of SIMATIC S7-1200 CPUs before version 4.7, with the potential to trigger actions within an authenticated session.
Siemens Hall of Thanks
Recognition for responsibly reporting vulnerabilities in industrial products.
↗Recognition for responsibly reporting vulnerabilities in industrial products.
BSides São Paulo · 2025
From reconnaissance to impact.
A look at offensive operations in critical infrastructure, connecting discovery, responsible exploitation and impact scenarios based on original research.
Red Team · ICS/OT · CVE-2024-46886