Threats and Notable Incidents

Threat actors in OT

The general types of threat actors are described in the Security topic. In OT they show up with their own patterns:

• Nation-states are behind most of the incidents on this page that were designed for industrial systems. Their goals range from espionage to pre-positioning — gaining quiet access now, to be able to disrupt later — to actual sabotage during a conflict. They behave as advanced persistent threats: patient, well-resourced and careful not to be noticed.
• Criminals, mostly ransomware groups, usually encrypt IT systems, not controllers. They still stop operations: the business cannot plan, bill or verify, or decides to shut the process down as a precaution, as Colonial Pipeline did in 2021.
• Hacktivists and other politically motivated groups look for whatever is easy: HMIs and control panels reachable from the internet with weak or default passwords. The technical skill is often low, but the effect on a small water or energy installation can be real.
• Insiders — employees, contractors, vendors — have legitimate access. Most insider incidents are mistakes rather than malice, which is why change procedures and limits on what a single action can do matter as much as access control. See insider threats.

For a transmission system operator, all four are relevant, but the scenarios that are likely to shape defense planning are a state actor preparing disruption of the grid and ransomware cutting off the IT services that operations depend on.

MITRE ATT&CK for ICS

MITRE ATT&CK is a public knowledge base of attacker tactics and techniques based on real-world observations. MITRE ATT&CK for ICS is its separate matrix for industrial control systems. As of 2026 (content version 19) it has 12 tactics — the attacker's goals at each stage:

Initial Access · Execution · Persistence · Privilege Escalation · Evasion · Discovery · Lateral Movement · Collection · Command and Control · Inhibit Response Function · Impair Process Control · Impact

The two tactics in bold are what make the ICS matrix different. Inhibit Response Function covers preventing safety systems, protection functions and alarms from responding to a dangerous situation — disabling alarm logic, for example. Impair Process Control covers manipulating the control of the physical process itself, such as sending unauthorized commands or changing parameters. Defenders use the matrix to check which techniques their monitoring can actually see, and to describe incidents in a shared language. Each incident below can be read as a path through these tactics.

Incidents at a glance

The incidents on this page are publicly documented, mostly by government agencies (such as CISA, the US Cybersecurity and Infrastructure Security Agency) or by the security companies that investigated them. They are described here only as far as those sources report them, to draw the defensive lessons.

Landmark incidents (2010–2017)

Stuxnet (discovered 2010)

Stuxnet is malware that was first identified in June 2010, reportedly by the Belarusian security company VirusBlokAda. It targeted Siemens S7 PLCs and is widely reported to have been aimed at the uranium-enrichment centrifuges at Natanz, Iran. It is regarded as the first known PLC rootkit: code on the controller that hid its own presence.

Attribution: it is widely attributed in press reporting to the United States and Israel, but this has never been officially acknowledged.

Lesson: malware on a controller can change what it does and hide that change. Defenses: protect the engineering workstations and everything else that can reach the controllers, control what enters the control network (removable media, contractor laptops), and compare the logic running on controllers with known-good copies.

Ukraine power grid (December 2015)

What happened: on 23 December 2015, three regional electricity distribution companies in Ukraine had outages affecting about 225,000 customers. According to CISA, the attackers operated breakers remotely using legitimate credentials. They also wiped computers with KillDisk malware, corrupted the firmware of serial-to-Ethernet converters and disrupted uninterruptible power supplies. The initial access came earlier, through BlackEnergy malware delivered by spear-phishing emails.

Attribution: in July 2021 the US Government attributed the attack to Russian nation-state cyber actors.

Lesson: the attack used the utilities' own tools and accounts. Defenses: phishing-resistant multi-factor authentication on every remote access path into OT, strict IT/OT segmentation, monitoring for unusual operator actions, offline backups of device firmware and configurations, and practiced manual operation.

Industroyer / CrashOverride (December 2016)

Industroyer, also called CrashOverride, is malware built to attack electric grids. According to CISA it can speak the grid protocols IEC 60870-5-101, IEC 60870-5-104 and IEC 61850 (and OPC DA), can send commands directly to remote terminal units, and includes a wiper component. It has been attributed to Russian nation-state actors. It was used in December 2016 against a transmission substation near Kyiv (reported as Pivnichna), with a reported outage of about one hour.

Lesson: an attacker who understands industrial protocols does not need the HMI; any device on the right network can send valid commands. Protocols are explained in Industrial Protocols. Defenses: restrict which hosts may send control commands on each conduit, and monitor industrial protocol traffic for commands from unexpected sources or at unexpected times.

Triton / Trisis (2017)

Triton (also Trisis or HatMan) is malware that targeted Schneider Electric Triconex safety controllers — the safety instrumented system (SIS) that brings a plant to a safe state when something goes dangerously wrong. It was found in 2017 at a petrochemical facility in the Middle East (widely reported as Saudi Arabia). According to CISA, the safety systems initiated automatic shutdowns, and the refinery shut down for several days.

Attribution: in March 2022 the US Department of Justice unsealed charges against an employee of TsNIIKhM, a research institute of the Russian Ministry of Defense.

Lesson: this was the first publicly known attack on a safety system, the last line of defense for people and plant — the clearest example of the safety-security interplay. Defenses: keep the safety system in its own zone with minimal connections, keep controllers in run mode with physical keys where the hardware supports it, and alert on any engineering connection to the safety system. See Safety and Reliability.

Recent incidents (2021–2026)

Oldsmar water plant (February 2021) — disputed

As first reported: in February 2021 the Pinellas County Sheriff announced a remote intrusion at the water treatment plant of Oldsmar, Florida. An operator saw the mouse cursor move and the sodium hydroxide setting raised from about 100 to 11,100 parts per million, through the TeamViewer remote-access tool.

Later: in April 2023 the city's former manager said it had been a "non-event", likely caused by employee error rather than a hack. No official FBI findings were ever publicly released. The incident is therefore best described as originally reported as a hack, later disputed, and never officially resolved in public.

Lesson: whatever the cause, the weaknesses that made the story plausible were real and common: a remote-access tool on a control system, shared credentials, and setpoints that could be changed to dangerous values. Defenses: remove unmanaged remote-access tools, use individual accounts, and enforce engineering limits on setpoints in the controller itself. Also: check how a story ended before using it as an example.

Colonial Pipeline (May 2021)

What happened: on 7 May 2021, Colonial Pipeline, a major US fuel pipeline operator, proactively shut down its pipeline after ransomware hit its IT systems. The FBI confirmed on 10 May that the DarkSide ransomware was responsible. The pipeline restarted on 12–13 May.

Impact: the company reported IT systems affected, including billing; it did not report a compromise of its OT. The shutdown of the pipeline was a precaution — and it still caused fuel shortages.

Lesson: an IT incident can stop physical operations without touching a single controller. Defenses: know which IT services operations depend on (billing, scheduling, metering), segment IT and OT so that OT can keep running safely when IT is down, and decide in advance under which conditions OT is shut down or isolated. See Incident Response in OT.

Industroyer2 (April 2022) — foiled

What happened: according to the security company ESET, a new variant of Industroyer was prepared against high-voltage substations of a Ukrainian energy company, with the disconnection scheduled for 8 April 2022. The malware contained hard-coded IEC 60870-5-104 settings for its targets. The researchers attributed it to the group tracked as Sandworm.

Impact: none on supply — the attack was foiled by CERT-UA (Ukraine's computer emergency response team) working with ESET and Microsoft. Unlike Industroyer in 2016, there was no outage.

Lesson: detection and cooperation work. Monitoring, threat intelligence sharing and a national CERT with industry partners stopped a prepared attack in time.

Danish energy sector (May 2023)

What happened: according to SektorCERT, the Danish critical-infrastructure CERT, 22 Danish energy companies were compromised through vulnerabilities in Zyxel firewalls, in two waves (11 May and 22–30 May 2023). Some companies switched to island mode, disconnecting from external networks and operating locally.

Attribution: SektorCERT saw indications that might link one wave to Sandworm; that link is tentative, and was later questioned by the security company Forescout.

Lesson: the edge devices that are supposed to protect a network are themselves a target. Defenses: patch internet-facing firewalls and VPN devices quickly (faster than OT systems), keep their management interfaces off the internet, and take part in sector information sharing.

FrostyGoop (January 2024)

What happened: the OT security company Dragos discovered FrostyGoop in April 2024 and called it the ninth known ICS malware. Dragos linked it to an incident around 22–23 January 2024 in Lviv, Ukraine, where controllers of a district heating company were sent Modbus TCP commands (port 502). The initial access was likely through a vulnerable internet-facing router, and the network was poorly segmented.

Impact: more than 600 apartment buildings were reportedly without heating for about two days, in winter.

Attribution: Dragos made no firm state attribution.

Lesson: Modbus has no authentication, so reaching the controller was enough. Defenses: segmentation so that controllers cannot be reached from the edge, firewall rules that allow Modbus only between known hosts, patched edge devices, and monitoring for Modbus traffic from unexpected sources. See segmentation in OT Security Fundamentals.

Volt Typhoon (advisory February 2024)

Volt Typhoon is the name for a cyber actor that US agencies attribute to state-sponsored actors of the People's Republic of China (PRC). CISA's advisory AA24-038A of 7 February 2024 warned that it was pre-positioning on IT networks of critical infrastructure — communications, energy, transportation and water — "to enable lateral movement to OT assets to disrupt functions". In some victims, its access had lasted at least five years.

Volt Typhoon relies on living off the land: using the legitimate tools and administrative features already present on the victim's systems (built-in command-line tools, remote management, valid accounts) instead of custom malware. Little or nothing new is installed, and what is installed is often a legitimate or publicly available tool, so antivirus has little to find and the activity blends in with normal administration.

Lesson: the absence of malware is not the absence of an intruder. Defenses: detailed logging of administrative activity, baselines of normal behavior, threat hunting for unusual use of legitimate tools (see Security Monitoring and the SOC), hardened and patched edge devices, and privileged access management.

Bremanger dam, Norway (April 2025)

What happened: on 7 April 2025, attackers reportedly reached a web-accessible control panel of a dam in Bremanger, Norway — reportedly protected by a weak password — and opened a valve. About 500 liters per second flowed for around four hours.

Impact: no damage was reported.

Attribution: in August 2025 the head of the Norwegian Police Security Service (PST) publicly cited the incident as an example of activity by pro-Russian cyber actors. There is no formal written attribution report.

Lesson: a control interface on the internet with a weak password needs no skill to misuse. Defenses: no direct internet exposure of control interfaces, strong unique passwords and multi-factor authentication, and alarms on unexpected changes in the process.

Internet-exposed PLCs: CISA AA26-097A (April 2026)

What happened: CISA's advisory AA26-097A (7 April 2026, updated 22 July 2026) describes Iranian-affiliated cyber actors, a group the advisory associates with the cyber unit of Iran's Islamic Revolutionary Guard Corps (IRGC), manipulating internet-exposed PLCs from Rockwell, Schneider and Siemens in US government, water and energy organizations.

Impact: according to the advisory, the actors modified project files and HMI/SCADA displays and disabled shutdown and alarm logic.

Lesson: the advisory's mitigations are basic: remove PLCs from the internet, use the controller's physical run/mode key so its program cannot be changed remotely, and use multi-factor authentication. Disabling alarm and shutdown logic is a clear case of the Inhibit Response Function tactic.

Lessons learned

Put side by side, the incidents teach surprisingly few distinct lessons — and most of them are basic controls, not advanced technology.

Those controls match CISA's five primary mitigations for OT (May 2025): remove OT connections to the public internet, change default passwords, secure remote access with phishing-resistant MFA, segment IT and OT, and practice manual operations. How to put them into practice is covered in OT Security Fundamentals, Remote Access and Third Parties and Asset Inventory and Monitoring.