Cybercriminals Pivot to Physical Infrastructure Attacks
Attackers are increasingly targeting building automation systems to create real-world chaos and extortion leverage.
1Physical Systems Under Siege
Cybercriminals are moving beyond data theft to disrupt physical infrastructure, as seen in recent French grocery store refrigeration hacks. These attacks manipulate building management systems to spoil food or trigger fires. Such incidents demonstrate that digital intrusions now frequently yield severe, real-world consequences, forcing executives to address immediate operational failures.
2The Rise of BAS Targets
Building Automation Systems (BAS) control critical facilities like HVAC, lighting, and security access. Armis Labs reports that 73 percent of organizations own BAS used in ransomware attacks, while 91 percent of these systems communicate over insecure protocols. This creates a massive, vulnerable attack surface for groups seeking high-impact, high-pressure extortion targets.
3Hiding in Operational Technology
Threat actors utilize BAS and Operational Technology (OT) as persistent hiding spots because these environments often lack robust security controls. Unlike IT networks, OT systems require constant uptime, making patching or vulnerability scanning difficult. Attackers frequently pivot from these compromised OT systems back into primary IT networks to maintain long-term access.
4AI Accelerates Threat Capabilities
Artificial intelligence is lowering the barrier to entry for attacking complex industrial control systems. Criminals now use AI to analyze obscure protocols and proprietary software, such as VxWorks or older Unix systems. This capability allows attackers to manipulate critical equipment, like airline weight and balance systems, without needing deep domain expertise.
5Industrial Attack Trends Escalating
Dragos data shows a sharp increase in ransomware attacks against industrial organizations, rising from 995 incidents in 2023 to significantly higher volumes by 2026. The number of active ransomware groups targeting these sectors grew from 50 to 80 in just one year. Most incidents remain opportunistic, driven by the desire for rapid disruption.
6Visibility Gaps in OT
Many organizations lack sufficient visibility into their OT environments, with fewer than 10 percent of networks worldwide having adequate monitoring. In 30 percent of investigated incidents, detection did not come from automated alerts but from manual observation of operational anomalies. This lack of oversight leaves critical infrastructure dangerously exposed to future threats.
7Compliance as an Attack Vector
Regulatory compliance requirements often force organizations to connect hardware to the internet, creating unintended security risks. Refrigeration units, for example, are connected to prove temperature maintenance to health departments. These internet-facing connections provide unpatched entry points for attackers, turning simple compliance tools into significant vectors for large-scale physical disruption and damage.
8Shifting Focus from IT
As organizations improve security and patching for traditional IT systems, attackers are shifting their focus toward internet-connected OT. Experts like Matt Hayden anticipate that OT will face increased scrutiny as the 'low-hanging fruit' of IT becomes harder to exploit. This transition marks a critical shift in the global cybersecurity threat landscape.
9Future Risks of Automation
The intersection of IT and OT, combined with the rise of AI agents, presents a dark future for infrastructure security. Without proactive measures to protect these interconnected systems, the potential for catastrophic physical damage grows. Organizations must prioritize securing OT environments to prevent opportunistic attackers from causing widespread, real-world operational failures.