What stops attackers wrecking industrial plants is knowing how
Engineers at an Israeli food producer spent most of a week rebuilding a refrigeration system after an intruder switched the gas cooler and receiver valves to manual and pinned them open. Liquid CO2 flooded the compressors and destroyed them. The replacement units did not match the originals, so the whole system had to be reworked and recharged with gas.
That incident is one of roughly forty in Kaspersky ICS CERT’s quarterly roundup of attacks on industrial organizations covering the second quarter of 2026. Most of them are the usual: phishing, backdoors, ransomware. The handful that reach the machinery sort along one axis, and it is not nationality or motive. It is whether the attacker understood the machinery well enough to break it.
“Despite their increasing frequency, many of the modern attempts to do something illegitimate with industrial automation systems appear either timid, lazy, or clumsy,” Kaspersky researchers explained. What changed this quarter is what is now available to close the gap.
Profero, which handled the response at the food plant, attributes the campaign to Cyber Isnaad Front, an Iranian state-directed persona targeting Israeli defense, telecom, fuel and transport logistics, and food production. The attacker also changed the central controller’s credentials, locking operators out of managing the system, and in a separate case wiped a controller’s configuration outright.
None of that is protocol knowledge. Sending a write command to an industrial controller is easy and has been for years. Knowing which valve positions send liquid refrigerant back into a compressor, and that the compressor will not survive it, is refrigeration engineering. That is the scarce ingredient, and it is what separates a defaced HMI from a capital loss.
The high end of the scale turns out to be twenty years old
SentinelLabs uncovered a sabotage framework called fast16 whose core components date to 2005, five years before Stuxnet. It never touches machinery. It spreads through Windows networks and quietly corrupts the output of engineering simulation software.
The domain knowledge shows in the trigger conditions. Symantec, reviewing the hook engine, described three separate mechanisms for corrupting the math. One fires only during explosion and compression simulations above 30 g/cm³, the density uranium or weapons-grade plutonium reaches when compressed before the implosion. Another touches a calculation used only for high explosives. Engineers got distorted results and no sign anything was wrong. Whoever wrote it understood nuclear weapon design well enough to corrupt it selectively, which is a category of attacker that barely exists.
The same quarter’s other end
Darktrace pulled apart ZionSiphon, malware built for operational technology and aimed at Israeli water treatment and desalination plants. It never reaches its payload. A logic error in its own targeting check fires the self-destruct routine instead.
Darktrace says an activated ZionSiphon could have done real damage, raising chlorine and maximizing flow and pressure. The function meant to do it finds the config file, appends a block of text, and returns. Modbus support is partial, DNP3 and S7comm incomplete. The USB spreader is the one component that works. Someone who could finish the propagation routine left the function that opens a valve unwritten.
That is the distribution Kaspersky’s summary is built around, and it is why cyber-physical attacks have stayed rare while cyber-physical intent has not. Wanting to destroy a plant is common. Knowing how takes years in an industry, and attackers have not generally had that time.
Monterrey is where the gap starts closing
Between December 2025 and February 2026, an unidentified actor breached nine Mexican government entities and exfiltrated large volumes of data, using the Claude and GPT-4.1 APIs for much of the technical work, according to Gambit’s report. Dragos examined one of those intrusions, at the municipal water utility in Monterrey, and found that a compromise of the enterprise IT network had escalated into an attempt on the OT side.
The post-compromise framework was a 17,000-line Python script written entirely by Claude, which named it “BACKUPOSINT v9.0 APEX PREDATOR” and refined it during the intrusion in response to operational feedback. The attacker was hunting for data to steal until learning the network contained an OT interface. Claude identified the utility’s industrial gateway as a high-value critical asset. Instructed to attack it, the model produced password spraying, which failed against decent password hygiene. Dragos found no evidence the adversary ever saw anything behind the gateway.
The attack was worthless. The pointing was not, and pointing is the step the ZionSiphon developers could not perform for themselves. A model that can recognize an industrial gateway in a network map and explain its significance supplies exactly the ingredient that has been rationing this class of attack.
This is not an isolated case. Elsewhere in the quarter, HeartlessSoul shipped AI-generated stagers alongside a RAT built with generative AI, GOFFEE used modules with characteristics typical of LLM generation against Russian defense enterprises, and Check Point assessed that Nimbus Manticore likely used AI-assisted development while building a new backdoor. Kaspersky’s reading is that industrial firms are feeding OT problems to public models, and that the domain knowledge accumulating there will eventually be turned against them.
Meanwhile the controllers are still reachable
CISA and federal partners have been tracking a group they believe to be Iran-affiliated, hitting programmable logic controllers in US government facilities, water systems, and energy since at least March 2026. The method requires no exploit. The actors install legitimate vendor configuration software on leased infrastructure and open an accepted connection to exposed controllers. The FBI traced the results: project files extracted from the devices, and manipulated data on HMI and SCADA displays. Operators watching those screens saw numbers the attacker chose.
Cato Networks measured the background noise this sits in. Between September and November 2025 it counted 14,426 unique targeted IPs across 70 countries, most in the United States, drawing more than 235,000 automated read requests against Modbus registers. Reads are cheap and everywhere. The write attempts came from one machine, all following the same structure, starting at the same register address and writing 27 to 122 registers at a time. Cato flagged them as the finding that concerned the researchers most, and stopped there.
Compressors in an Israeli food plant were destroyed by someone who understood refrigeration cycles well enough to flood them with liquid CO2. A water sabotage tool aimed at the same country deleted itself over a coding error and never opened anything. Domain knowledge is the whole distance between those outcomes, and for twenty years it has been the reason most attempts on industrial systems ended as nuisances. In Monterrey, a model spent an intrusion explaining an industrial gateway to an attacker who had not known it was there.
Download: The ultimate guide to network operations management