·
Jul 3
In December 2016, large sections of Kyiv abruptly lost power. While outages caused by severe weather or equipment failure are commonplace, this event was anything but ordinary. Investigators would later determine that the disruption had been deliberately orchestrated by one of the most sophisticated pieces of industrial malware ever discovered:
In a rush? Here are our key takeaways, so you don’t miss out and can come back later for the details.
Industroyer demonstrated that malware can directly manipulate industrial control systems rather than simply compromising traditional IT infrastructure.
AI is unlikely to replace the specialist engineering expertise required for industrial cyberattacks, but it significantly accelerates reconnaissance, malware development and operational planning.
The convergence of enterprise IT and operational technology continues to expand the attack surface available to sophisticated adversaries.
Effective defence depends upon network segmentation, continuous monitoring, OT-aware threat hunting and close collaboration between engineering and cybersecurity teams.
AI should be regarded as a force multiplier for both attackers and defenders, making resilience and visibility more important than ever.
The original Industroyer campaign demonstrated that sophisticated adversaries no longer needed to destroy physical infrastructure directly. By manipulating the digital systems responsible for controlling substations, attackers could achieve the same operational outcome while remaining geographically distant from their targets. The malware represented a convergence of traditional cyber intrusion techniques with detailed industrial engineering knowledge, a combination that remains relatively rare but increasingly achievable as artificial intelligence reduces the effort required to support complex cyber operations.
Get up to speed with MITRE's analysis
It is important to emphasise that AI does not eliminate the need for human expertise. Successfully compromising operational technology (OT) environments still requires a detailed understanding of industrial processes, electrical engineering and the unique constraints of critical infrastructure. However, AI is steadily lowering the cost of many activities surrounding an attack, allowing skilled operators to spend less time on repetitive analysis and more time making strategic decisions. The result is not a fundamentally different form of cyber warfare, but a more efficient one.
Every sophisticated cyberattack follows a lifecycle. Initial access, privilege escalation, reconnaissance, lateral movement and objective execution are all familiar stages within enterprise environments. Attacks against industrial control systems (ICS) are no different, although they often involve additional phases focused on understanding physical processes before any disruptive actions are taken.
Artificial intelligence has the potential to influence almost every one of these stages. Reconnaissance is perhaps the clearest example. Large organisations generate enormous quantities of technical documentation, ranging from engineering diagrams and maintenance manuals to configuration files and network inventories. Traditionally, analysing these resources required teams of analysts painstakingly identifying relationships between systems and building an accurate picture of the environment.
Modern AI systems excel at processing large volumes of structured and unstructured information. Given access to documentation obtained during an intrusion, they can rapidly identify references to programmable logic controllers (PLCs), remote terminal units (RTUs), engineering workstations and supervisory control and data acquisition (SCADA) servers. Rather than replacing human analysts, AI enables them to navigate complex environments more efficiently, highlighting areas that warrant closer investigation.
Similarly, industrial environments often contain proprietary software and bespoke hardware interfaces that require extensive reverse engineering. AI-assisted coding tools cannot independently understand complex binaries, but they can accelerate documentation, explain unfamiliar programming constructs and assist researchers working with reverse engineering platforms. Tasks that previously required days of manual analysis may now take hours, allowing offensive teams to iterate much more quickly.
This compression of effort reflects a recurring theme throughout AI-enabled cyber operations. The technology rarely creates new capabilities in isolation. Instead, it enables experienced practitioners to move faster while maintaining the same level of technical sophistication.
One of the defining characteristics of Industroyer was that it did not appear inside a substation by chance. Before malicious commands could be issued, attackers first needed to compromise conventional information technology systems and gradually move towards operational technology.
This distinction remains crucial. Most industrial organisations maintain at least some degree of separation between enterprise networks and industrial environments. Firewalls, demilitarised zones (DMZs) and dedicated engineering workstations are intended to reduce the likelihood that an attacker compromising an employee’s laptop can immediately interact with industrial equipment.
However, operational demands have gradually eroded these boundaries. Remote maintenance allows vendors to troubleshoot equipment from thousands of kilometres away. Cloud platforms collect telemetry to support predictive maintenance. Engineers routinely transfer configuration files between business systems and industrial controllers. These developments have improved operational efficiency, but they have also created additional pathways that determined adversaries can exploit.
Artificial intelligence is unlikely to bypass network segmentation or defeat robust authentication controls directly. Instead, it assists attackers in understanding increasingly complex enterprise environments. AI-generated summaries of Active Directory structures, automated identification of privileged accounts and rapid analysis of system configurations enable attackers to navigate corporate infrastructure more efficiently before approaching operational technology.
In effect, AI reduces the cognitive burden associated with understanding large environments. This is particularly concerning because many industrial organisations continue operating legacy infrastructure that was never designed to coexist with modern enterprise networks. Security teams therefore face the challenge of defending environments where decades-old industrial equipment interacts with contemporary cloud services and AI-enabled business applications.
The emergence of AI-assisted offensive operations does not render existing defensive practices obsolete. If anything, it reinforces their importance.
Network segmentation remains one of the most effective mechanisms for protecting industrial environments. Separating enterprise IT from operational technology limits an attacker’s ability to move laterally towards critical systems. Where remote access is essential, organisations should ensure that connections are tightly controlled, monitored and authenticated using modern identity management practices.
Visibility is equally important. Many traditional security tools were designed for enterprise environments and provide limited insight into industrial protocols. Passive monitoring technologies capable of analysing communications such as IEC 60870-5-104, Modbus and DNP3 allow defenders to establish normal patterns of behaviour without interfering with industrial processes. By understanding how substations typically communicate, security teams are better positioned to identify anomalous control commands or unexpected device interactions.
Threat hunting also assumes greater significance within AI-enabled environments. If adversaries can automate portions of reconnaissance and lateral movement, defenders must become equally adept at identifying subtle indicators of compromise before attackers reach operational technology. This requires close collaboration between information technology and engineering teams, disciplines that have historically operated independently within many organisations.
Incident response planning should likewise reflect the realities of converged IT and OT environments. Disconnecting a compromised office network may be relatively straightforward. Isolating a live electrical substation or manufacturing facility is considerably more complex. Response procedures must therefore balance cybersecurity objectives against operational safety, regulatory requirements and the potential consequences of disrupting essential services.
Although discussions surrounding AI frequently focus on offensive applications, defenders stand to benefit just as significantly.
Security operations centres increasingly rely upon AI to triage alerts, identify anomalous behaviour and accelerate investigations. Within industrial environments, these capabilities may prove particularly valuable because experienced OT security specialists remain relatively scarce. AI-assisted analysis can help less experienced analysts interpret industrial telemetry, understand protocol behaviour and correlate seemingly unrelated events across enterprise and operational networks.
Similarly, vulnerability management benefits from AI-driven prioritisation. Industrial organisations often struggle to determine which vulnerabilities require immediate remediation because patching critical infrastructure may involve planned outages, regulatory approvals or extensive testing. AI systems capable of correlating vulnerability data with asset criticality and known adversary behaviour enable organisations to make more informed decisions about where limited resources should be allocated.
The objective is not to automate cybersecurity entirely. Rather, AI should enable human defenders to focus on complex analytical tasks while repetitive activities are handled more efficiently by automated systems. This mirrors the same advantage sought by attackers.
The significance of Industroyer extends well beyond the Ukrainian power grid. It demonstrated that industrial control systems are no longer insulated from the geopolitical realities of cyberspace. Electricity, water, transportation and manufacturing infrastructure have become strategic targets whose disruption can produce consequences extending far beyond the organisations that operate them.
Artificial intelligence does not fundamentally alter this reality. Instead, it changes the economics of cyber operations. Reconnaissance becomes faster. Malware development becomes more efficient. Documentation analysis requires fewer human hours. Social engineering campaigns become more convincing. Security researchers often describe AI as a force multiplier, and Industroyer provides an excellent illustration of why that characterisation is accurate. The malware itself remains a highly specialised tool requiring exceptional expertise, but the surrounding activities necessary to plan, develop and execute such an operation are steadily becoming more accessible.
For defenders, the lesson is equally clear. Protecting critical infrastructure cannot rely solely upon identifying individual malware families or responding to yesterday’s attacks. Organisations must understand the operational behaviours that enable industrial compromise and invest in visibility, segmentation, resilience and collaboration between IT and OT teams. Artificial intelligence should be viewed neither as a silver bullet nor as an existential threat, but as a technology that amplifies the capabilities of whoever employs it most effectively.
Nearly a decade after the lights went out in Kyiv, Industroyer continues to offer valuable lessons for the cybersecurity community. Its code may eventually become obsolete, and industrial technologies will undoubtedly evolve, but the principles it embodied remain strikingly relevant. In an era where artificial intelligence is reshaping both cyber offence and defence, the attack serves as a reminder that the greatest risks often emerge not from entirely new ideas, but from established techniques executed with unprecedented speed, precision and scale.
As discussed in our earlier article, How Cybercriminals are Using AI, artificial intelligence is best understood as an accelerator of existing offensive techniques rather than the creator of entirely new ones.
No posts
Comments
Nothing yet. Say the first thing.
Sign in to join the conversation.