Cybercriminals Pivot to Physical Infrastructure Attacks
Hackers increasingly target building automation systems to force extortion payments through real-world disruption.
1Escalation to Physical Sabotage
Cybercriminals are moving beyond data theft to disrupt physical infrastructure, as seen in recent attacks on French refrigeration systems. These incidents, which caused food spoilage and fires, highlight a shift toward targeting operational technology. Attackers now leverage physical consequences to increase pressure on executives, forcing them to pay multi-million dollar ransom demands.
2Vulnerabilities in Automation Systems
Building automation systems (BAS) manage critical functions like HVAC, lighting, and security access. Armis Labs reports that 73 percent of organizations own BAS used in ransomware attacks, with 91 percent relying on insecure protocols. These systems serve as attractive targets because they often lack the robust security controls found in standard IT environments.
3Persistence Through OT Backdoors
Threat actors frequently use BAS to hide within networks, as these systems are harder to scan or patch without causing operational downtime. In one instance at a financial institution, attackers built backdoors into building management systems to maintain persistent access after being evicted from the primary IT network by security teams.
4AI-Driven Threat Intelligence
Artificial intelligence is lowering the barrier to entry for attacking complex industrial hardware. Criminals now use AI to analyze obscure operating systems like VxWorks and proprietary protocols that were previously considered black boxes. This capability allows attackers to manipulate sensitive equipment, such as airline weight and balance systems, without needing deep expertise.
5Surge in Industrial Attacks
Dragos data shows a sharp rise in ransomware incidents targeting industrial organizations, growing from 995 attacks in 2023 to over 1,140 in the second quarter of 2026 alone. The number of active ransomware groups focusing on these sectors has also expanded significantly, reaching 80 distinct groups by the end of 2024.
6Visibility Gaps in Networks
Many organizations lack sufficient visibility into their operational technology environments, with fewer than 10 percent of OT networks globally having adequate monitoring. In 30 percent of recent incidents, detection did not come from automated alerts but from human operators noticing that something felt wrong, leaving systems exposed to undetected, long-term malicious activity.
7Compliance as an Attack Vector
Regulatory compliance requirements are inadvertently increasing the attack surface by forcing non-critical hardware, like refrigeration units, to connect to the internet. While these connections allow owners to prove temperature compliance to health departments, they also provide unpatched entry points for opportunistic attackers to cause physical damage and supply chain degradation.
8Shift Toward OT Scrutiny
As organizations improve their IT security posture, experts anticipate that attackers will increasingly focus on internet-connected OT as the next low-hanging fruit. Matt Hayden, formerly of the Department of Homeland Security, notes that the transition from targeting data to targeting physical systems represents a significant evolution in the threat landscape for critical infrastructure.
9Future Risks of Automation
The convergence of AI agents and insecure physical systems creates a precarious future for industrial security. Without proactive measures to protect OT, organizations face a reality where automated threats can continuously probe for vulnerabilities. Protecting these systems is no longer just about data privacy, but about ensuring the safety of physical operations.