OT Attacks on US Critical Infrastructure Could Disrupt Military Operations and Physical Processes

US critical infrastructure faces an operational technology threat that extends beyond civilian service outages.

State-sponsored intrusions and direct attacks on industrial controllers could disrupt physical processes and undermine military operations by targeting electricity, water, telecommunications, transportation, fuel, manufacturing, and logistics providers outside installation boundaries.

Disabling a supporting utility or transportation system could interrupt essential services, constrain logistics, or complicate mobilization, making infrastructure resilience a national-security concern.

China’s Volt Typhoon illustrates the strategic dimension. In their joint advisory, CISA, NSA, and FBI assess with high confidence that the actor is pre-positioning inside critical infrastructure IT networks to enable subsequent disruption of OT functions during a potential crisis or conflict.

Confirmed compromises span communications, energy, transportation, and water systems, including Guam.

Volt Typhoon attack exploits public-facing network appliances, uses valid administrative credentials, and relies on living-off-the-land techniques rather than conspicuous malware.

Agencies observed indications of persistence lasting at least five years in some environments.

Credential theft, network discovery, and collection of industrial documentation help establish pathways toward control systems while malicious activity blends with legitimate administration.

This distinction matters: persistent access represents preparation and capability, not proof that every compromised organization has suffered physical disruption.

Nevertheless, documented movement toward control systems demonstrates why enterprise intrusions cannot be treated solely as data-security incidents.

Other campaigns have already caused operational consequences. Beginning July 27, 2026, water and wastewater utilities in at least seven states reported attacks targeting exposed industrial controllers.

Polyswarm Researchers said that, Military installations depend on these civilian services for readiness and mission execution. Attackers therefore do not necessarily need to penetrate military networks to create operational consequences.

OT Systems Under Threat

The FBI and EPA warning documented pressure loss and flooding, while cautioning that sufficiently reduced pressure could allow untreated groundwater to enter distribution pipes.

That contamination pathway was identified as a potential consequence, not a confirmed outcome.

An April 7 joint advisory separately described Iranian-affiliated actors exploiting internet-facing Rockwell Automation/Allen-Bradley PLCs, including CompactLogix and Micro850 devices.

Attackers used legitimate engineering software, including Studio 5000 Logix Designer, to establish accepted connections, interact with project files, and manipulate information displayed through HMI and SCADA systems.

Some victims experienced operational disruption and financial loss.

Although the advisory references earlier CyberAv3ngers attacks against Unitronics controllers, it does not explicitly attribute the 2026 campaign to that persona.

Maintaining this separation prevents historical similarities from becoming unsupported attribution. The underlying lesson remains consistent: exposed controllers and insufficient access controls can enable disruption without sophisticated, purpose-built industrial malware.

On August 19, NSA and partner agencies warned of another campaign involving targeted reconnaissance and capability development against US-based Siemens S7 PLCs.

Actors used AI-generated exploitation scripts disguised as legitimate monitoring tools. Targeted sectors included manufacturing, energy, water, chemicals, agriculture, and commercial facilities.

The warning establishes developing capability, rather than confirmed physical damage across those sectors.

Defenders should remove direct PLC internet exposure, broker remote access through monitored gateways, enforce multifactor authentication, and maintain tested offline backups of controller logic. Where applicable, physical run-mode switches can restrict remote modification.

Monitoring should flag unexpected engineering connections, operating-mode changes, and unauthorized program updates.

Military and civilian operators must also map shared dependencies, identify single points of failure, and detect enterprise-to-OT intrusion pathways early.

Protecting installation networks alone cannot eliminate risks originating in the infrastructure that sustains them.

IOCs

Threat actor	Hash
Volt Typhoon	e453e6efc5a002709057d8648dbe9998a49b9a12291dee390bb61c98a58b6e95
Volt Typhoon	6036390a2c81301a23c9452288e39cb34e577483d121711b6ba6230b29a3c9ff
CyberAv3ngers	9e5f9dcb5f17efdca727b7b13a5f9ecd3296d28ac10e3675259b660d62739b87
CyberAv3ngers	1b39f9b2b96a6586c4a11ab2fdbff8fdf16ba5a0ac7603149023d73f33b84498

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.