Why Knowing How Stops Attacks on Industrial Plants

Engineers at an Israeli food manufacturer spent the better part of a week reconstructing a refrigeration system after an intruder switched the gas cooler and receiver valves to manual mode and fixed them open. Liquid CO2 surged into the compressors, destroying them completely. Since the replacement units didn’t match the original specifications, the entire system required reworking and recharging with gas.

That incident appears among roughly forty cases in Kaspersky ICS CERT’s quarterly review of attacks on industrial organizations for the second quarter of 2026. Most follow familiar patterns: phishing campaigns, backdoors, ransomware. The few that actually reach the machinery share a defining characteristic, and it has nothing to do with nationality or motivation. It comes down to whether the attacker understood the equipment well enough to break it.

“Despite their increasing frequency, many of the modern attempts to do something illegitimate with industrial automation systems appear either timid, lazy, or clumsy,” Kaspersky researchers noted. What shifted this quarter is the emergence of tools that could close that knowledge gap.

Profero, the firm handling the food plant response, attributes the campaign to Cyber Isnaad Front, an Iranian state-directed group targeting Israeli defense, telecom, fuel and transport logistics, and food production. The attacker also changed the central controller’s credentials, locking operators out of system management, and in a separate incident wiped a controller’s configuration entirely.

None of that requires protocol expertise. Sending a write command to an industrial controller has been straightforward for years. But knowing which valve positions send liquid refrigerant back into a compressor, and that the compressor won’t survive the result, that’s refrigeration engineering. That expertise is the scarce commodity, and it marks the difference between a defaced HMI and a capital loss.

The high end of the scale turns out to be twenty years old

SentinelLabs uncovered a sabotage framework called fast16 whose core components date to 2005, five years before Stuxnet. It never touches machinery directly. Instead, it spreads through Windows networks and quietly corrupts the output of engineering simulation software.

The domain knowledge shows in the trigger conditions. Symantec, reviewing the hook engine, identified three separate mechanisms for corrupting the math. One activates only during explosion and compression simulations above 30 g/cm³, the density uranium or weapons-grade plutonium reaches when compressed before the implosion. Another targets a calculation used exclusively for high explosives. Engineers received distorted results with no indication anything was wrong. The author understood nuclear weapon design well enough to corrupt it selectively, a category of attacker that barely exists.

The same quarter’s other end

Darktrace dissected ZionSiphon, malware built for operational technology and aimed at Israeli water treatment and desalination plants. It never reaches its payload. A logic error in its own targeting check triggers the self-destruct routine instead.

Darktrace says an activated ZionSiphon could have caused serious damage, raising chlorine levels and maximizing flow and pressure. The function intended to do this locates the config file, appends a block of text, and returns. Modbus support is partial, DNP3 and S7comm incomplete. The USB spreader is the only component that works. Someone capable of finishing the propagation routine left the function that opens a valve unwritten.

That distribution forms the basis of Kaspersky’s summary, and it explains why cyber-physical attacks have stayed rare while cyber-physical intent has not. Wanting to destroy a plant is common. Knowing how takes years in an industry, and attackers haven’t generally had that time.

Monterrey is where the gap starts closing

Between December 2025 and February 2026, an unidentified actor breached nine Mexican government entities and exfiltrated large volumes of data, using the Claude and GPT-4.1 APIs for much of the technical work, according to Gambit’s report. Dragos examined one of those intrusions, at the municipal water utility in Monterrey, and found that a compromise of the enterprise IT network had escalated into an attempt on the OT side.

The post-compromise framework was a 17,000-line Python script written entirely by Claude, which named it “BACKUPOSINT v9.0 APEX PREDATOR” and refined it during the intrusion in response to operational feedback. The attacker was hunting for data to steal until learning the network contained an OT interface. Claude identified the utility’s industrial gateway as a high-value critical asset. Instructed to attack it, the model produced password spraying, which failed against decent password hygiene. Dragos found no evidence the adversary ever saw anything behind the gateway.

The attack was worthless. The pointing was not, and pointing is the step the ZionSiphon developers couldn’t perform for themselves. A model that can recognize an industrial gateway in a network map and explain its significance supplies exactly the ingredient that has been rationing this class of attack.

This isn’t an isolated case. Elsewhere in the quarter, HeartlessSoul shipped AI-generated stagers alongside a RAT built with generative AI, GOFFEE used modules with characteristics typical of LLM generation against Russian defense enterprises, and Check Point assessed that Nimbus Manticore likely used AI-assisted development while building a new backdoor. Kaspersky’s interpretation is that industrial firms are feeding OT problems to public models, and the domain knowledge accumulating there will eventually be turned against them.

Meanwhile the controllers are still reachable

CISA and federal partners have been tracking a group they believe to be Iran-affiliated, hitting programmable logic controllers in US government facilities, water systems, and energy since at least March 2026. The method requires no exploit. The actors install legitimate vendor configuration software on leased infrastructure and open an accepted connection to exposed controllers. The FBI traced the results: project files extracted from the devices, and manipulated data on HMI and SCADA displays. Operators watching those screens saw numbers the attacker chose.

Cato Networks measured the background noise this sits in. Between September and November 2025 it counted 14,426 unique targeted IPs across 70 countries, most in the United States, drawing more than 235,000 automated read requests against Modbus registers. Reads are cheap and everywhere. The write attempts came from one machine, all following the same structure, starting at the same register address and writing 27 to 122 registers at a time. Cato flagged them as the finding that concerned the researchers most, and stopped there.

Compressors in an Israeli food plant were destroyed by someone who understood refrigeration cycles well enough to flood them with liquid CO2. A water sabotage tool aimed at the same country deleted itself over a coding error and never opened anything. Domain knowledge is the whole distance between those outcomes, and for twenty years it has been the reason most attempts on industrial systems ended as nuisances. In Monterrey, a model spent an intrusion explaining an industrial gateway to an attacker who hadn’t known it was there.