Abstract:  In the field of network security， only by better understanding the attack， can we master the defense technology. This article focuses on the industrial control equipment in the industrial control system that is closest to the industrial production equipment - the programmable logic controller PLC， which is no longer limited to the traditional “host computer-PLC-cascading equipment” attack mode. Through the combination of PLC worm and PLC agent， the attack mode of “PLC-PLC-cascade device” with stronger attack adaptability is realized， and a complete attack chain that can make all PLCs in the Intranet environment be attacked by the PLC exposed to the directly accessible environment is realized. Different attack forms are added to the attack chain and the attack model is finally constructed. By building an experimental environment to conduct simulation experiments， it is proved that the attack model can change the operation state of the industrial control system and pose a threat to the safe operation of the industrial control system. Finally， targeted protection suggestions are given for this attack mode.

Key words: Key words： industrial control system, PLC, worm, proxy mode