From Cyberattacks to Physical Risks: The Changing Threat Landscape for OT and Critical Infrastructure

Last month, at the AI & Digital Bridge 2026 International Forum, our CTO, Denis Laskov, presented "Modern Risks for OT and Critical Infrastructure" - an overview of how the threat landscape is changing for operational technology, manufacturing, and industrial robotics.

One of the key trends we see is that cyberattacks on OT and critical infrastructure are becoming physical risks.

Attackers are no longer focused only on stealing data, encrypting systems, or compromising credentials. We see growing interest in industrial processes themselves, where a successful attack can stop production, damage equipment, and potentially put human safety at risk.

In OT, a cyber vulnerability is not just about compromising a system. It is also about what happens to the physical process when that system is compromised.

Two Major Threat Patterns

Looking closer at this trend, we can identify two major directions:

Hybrid warfare and state-sponsored attacks
State-sponsored and state-aligned groups target critical infrastructure as part of larger geopolitical operations. These attacks can be complex, coordinated, and focused on disrupting essential services or industrial processes.
Recent examples include attacks against Poland's energy infrastructure in December 2025 and water and wastewater systems in the United States in 2026.
Hacktivism and ideologically motivated attacks
Organized groups and individual attackers who are motivated by political or ideological goals. Their objective is often to create disruption, demonstrate capabilities, or cause damage to companies, infrastructure, or society.
One example of the physical risks involved is the April 2025 cyberattack against a dam in Norway, where attackers gained unauthorized control of a remotely operated valve.

Of course, the line between these two groups is not always clear. Hacktivist activity can overlap with state interests, and identifying who is behind an attack is not always straightforward.

What We See in the Field

During the last 12 months, our experts at Big4 Security have observed increasing scanning activity targeting industrial systems exposed to the internet.

Three protocols appear particularly frequently in our observations:

TCP/502 - Modbus TCP
TCP/102 - Siemens S7comm
TCP/44818 - EtherNet/IP

What is interesting is that many of these activities follow a similar pattern.

First, automated reconnaissance:

Connect to the exposed service and identify the device vendor and model.
Attempt to identify the software or firmware version and extract available configuration information.
In some cases, stop activity for approximately 6-12 hours.

Then, a possible second stage involving a human operator:

Connect again and verify the identified service.
Run additional queries using specialized tools.
Perform more detailed analysis of the exposed host.
Attempt to access management interfaces or modify device configurations.

In other words, what starts as automated scanning can continue as targeted activity against a specific industrial device.

Based on our observations, the energy sector is one of the main areas of interest, particularly renewable energy, energy storage, and electricity transmission infrastructure.

What Does It Mean for OT and Critical Infrastructure Operators?

The main concern is not only whether an attacker can compromise your systems, but what happens to your operations when an attack succeeds.

Can you continue production? Can you maintain control over critical processes? Can you keep the equipment and people safe?

Our recommendation is simple:

Know what is exposed on your OT network perimeter.
Identify your critical industrial processes and understand their dependencies.
Pay particular attention to remote access, exposed industrial protocols, and management interfaces.
Evaluate cyber risks based on their potential impact on availability, operational continuity, equipment integrity, and physical safety.

Remember, in industrial environments, cybersecurity is not only about protecting networks and systems.

It is about protecting the operation. And when it comes to critical infrastructure, it is also about public safety.

Big4 Security Team