Reading · The Monday Brief

A distribution operator can make a network private without making it secure.

In Poland, attackers moved from a compromised wind farm into a combined heat and power plant over an APN managed by the distribution system operator that was private in the telecom sense, but not isolated in the security sense. Once there, they did not need custom malware. The controllers already exposed the functions required to disrupt the process.

The other three stories land somewhere else entirely. A new White House framework pulls private companies into offensive cyber operations. Akira used Safe Mode to strip away endpoint visibility defenders expected to be present. A campaign against Taiwanese government and energy targets shows AI agents taking on more of the operational work inside a real intrusion.

Each one should change a different decision, owned by a different part of the organization.

Get The Monday Brief in your inbox every Monday. Subscribe for free, and share it with someone who’d find it useful.

Thanks for supporting The Monday Brief.

A “private” cellular network is not a security boundary. The Polish CHP intrusion crossed from a wind farm to a plant because the private APN let any device talk to any other device on it. Inventory every OT asset reachable over operator-managed transport and treat that transport as hostile until proven otherwise.
Living off the land in OT means malware signatures buy you nothing. Attackers placed Siemens S7 controllers in STOP mode using legitimate functions, deployed no malware, and then factory-reset devices to destroy logs. Behavioral monitoring of PLC state changes is the detection layer that matters here, not endpoint AV.
Offensive authority is moving from government to the private sector. The White House memo authorizing companies to hack criminal organizations shifts legal and reputational risk onto firms that may not fully grasp the exposure. This is a boardroom conversation before it is a capability.
AI-agent-assisted intrusions have now moved beyond demonstrations and into real operations against government and critical-infrastructure targets. An open-source AI framework adapted mid-operation against Taiwanese government and energy targets. The detection window you designed around human attacker tempo no longer describes the adversary.
What not to over-index on: endpoint AV signatures as your OT detection story. Two of this week’s most serious incidents, the Polish plant and Akira, succeeded specifically because the defenders leaned on endpoint or signature controls that the attacker either bypassed by rebooting or never triggered by using native functions.

Why it matters: Attackers pivoted from compromised renewable-energy infrastructure into a Polish combined heat and power plant supplying heat to roughly 50,000 residents, using legitimate industrial-control functions rather than custom malware. The private cellular APN connecting the environments turned what was assumed to be isolated transport into a pivot path.

What is being misread: The story is being read as another firewall-and-MFA failure, and the exposed FortiGate did matter. The deeper problem is architectural. Utilities have treated operator-managed private APNs as if the “private” label implied segmentation. It did not. The APN allowed any device on it to reach any other device, so a single compromised site inherited a flat path into a second site’s OT.

Think Red (Douglas McKee): The wind farm is a juicy target because it depends on shared telecom and history shows nobody is inspecting. Once I am on that private APN, the hard part is already done, because the network was built to let its devices talk freely and the plant assumed that meant they were safe. I do not need malware compiled for an odd platform. The Siemens controllers already ship with STOP mode and password protection, so I use the plant’s own functions against it and then factory-reset the router to erase the trail. What still works in my favor is the gap between what “private network” means to a telecom engineer and what it means to a plant operator. One of them thinks it is isolated. Neither of them is watching the traffic between sites.

Act Blue (Ismael Valenzuela): A private APN is transport, not segmentation. Inventory every OT asset reachable over operator-managed cellular, whether the operator is a telecom or the grid operator itself, and put an inspecting, deny-by-default boundary between that network and the control environment. Then monitor what actually matters in OT. PLC state changes, STOP commands, program uploads, password changes, and new device-to-device communication between sites. None of that requires malware, so endpoint signatures will not save you. Send network and controller logs somewhere the field device cannot erase, and require whoever operates the APN to document exactly what isolation and logging it provides. If you cannot independently verify segmentation on infrastructure someone else operates, treat that infrastructure as untrusted.

Supporting sources:

Why it matters: The Trump administration issued a memo creating a framework for vetted private companies to participate in cyber surveillance and cyber-effects operations against specified foreign transnational criminal organizations under federal direction and oversight.

What is being misread: Coverage is framing this as a tooling or capability question, whether private firms can hack back effectively. That misses where the exposure actually sits. The hard part is not technical. It is that authorization does not equal indemnification, attribution errors hit third parties, and a company that misidentifies infrastructure can find itself liable in ways the government never would be. This is a governance decision wearing an operations costume.

Think Red (Douglas McKee): This one is a bit humorous from the attackers side. The risk doesn’t really sit with the attacker. It is with the defender’s, and it just got worse. If I run criminal infrastructure, I want a private company chasing me instead of a nation-state, because a company has shareholders, lawyers, and a brand I can damage. I can host my C2 on compromised third-party assets, so when a firm strikes back it hits a hospital or a small business that had nothing to do with me. Now the responder is the one explaining collateral damage. What caught my attention is how much easier this makes it to turn a defender’s aggression into my defensive shield.

Act Blue (Ismael Valenzuela): This is an enterprise-risk decision before it is a security operation. Any organization considering participation needs written rules of engagement before the first incident, covering who can authorize an operation, what attribution confidence is required, how third-party infrastructure is handled, what legal review is mandatory, and what conditions immediately stop the action. Preserve the evidence behind every decision and keep authorization separate from the team executing the operation. Criminal infrastructure routinely sits on systems belonging to innocent third parties, so technical confidence alone is not enough. Pre-position legal, executive, and incident-response leadership now. Offensive capability without a defensible decision process creates a different kind of risk.

Supporting sources:

Why it matters: An Akira ransomware affiliate defeated endpoint detection by rebooting the compromised machine into Safe Mode with Networking, which stopped both the Huntress agent and Microsoft Defender’s real-time protection. The attacker stole data even though the encryption stage ultimately failed.

What is being misread: This is being filed as another EDR-evasion trick, one more entry in the bring-your-own-driver lineage. The real point is architectural. Safe Mode is a legitimate, signed, Microsoft-blessed operating state that many EDR agents are not configured to run in. The attacker did not exploit a flaw. They asked Windows to boot into a mode where the defender’s primary sensor is off by design.

Think Red (Douglas McKee): To be honest, I am surprised we haven’t heard more about this sooner. Your team tuned Defender and deployed EDR, and I moved to the boot state where neither of them runs. I do not have to disable your agent or smuggle in a vulnerable driver. I just reboot into Safe Mode with Networking, which Windows supports, Microsoft signs, and your detection strategy quietly ignores. From there I have network access and no watchdog. There is nothing exotic about this. The advantage is that defenders build their entire visibility story around the assumption the endpoint stays in a normal running state, and I get to decide when it does not.

Act Blue (Ismael Valenzuela): Safe Mode creates a telemetry gap by design, so detect the transition before you lose the endpoint sensor. Configure your EDR to run in Safe Mode where supported, but also alert on bcdedit changes, service startup modifications, and unexpected Safe Mode with Networking reboots outside approved maintenance. Then keep an independent detection layer at the network tier. If the endpoint agent disappears and that host continues authenticating, transferring data, or reaching internal systems, the loss of telemetry should itself become a signal. The broader lesson is simple. If one boot-state change can remove your entire detection stack, you do not have defense in depth.

Supporting sources:

Why it matters: Israeli firm Dream documented what researchers describe as the first publicly known near-autonomous AI attack against a government target, striking Taiwanese government and energy infrastructure with an open-source agent framework that adapted mid-operation, corrected its own mistakes, and expanded scope as it went. Taiwan’s Ministry of Digital Affairs confirmed that government agencies were targeted in July by an overseas campaign combining manual operations with AI-agent-assisted attacks.

What is being misread: The reflex is to treat this as hype, another AI-does-hacking headline, and to note the agents still needed human setup. That is true and beside the point. The shift that matters is tempo and adaptation. A framework that corrects its own errors and expands during the operation compresses the detection and response window that human-attacker assumptions were built around. Separately, CyberScoop’s research shows mid-tier AI models, not just frontier ones, have gotten dramatically better at this, which lowers the cost of running these operations at scale.

Think Red (Douglas McKee): The interesting part is not that AI wrote the payloads. It is that the framework did the tedious stuff in the middle of the intrusion without someone babysitting it. Recon, pivoting, fixing its own broken commands, expanding as it found more, all at machine speed and across more targets than I could hand-run. The kicker is not needing a frontier model for this either, because the cheaper mid-tier ones now clear the bar. What that buys me is volume. I can parallelize reconnaissance, exploitation attempts, and follow-on actions instead of working each target serially, while your response process is still organized around human attacker tempo.

Act Blue (Ismael Valenzuela): Do not build a separate detection strategy for an “AI attacker.” The agent still has to enumerate systems, use identities, execute code, move laterally, and reach its objective through infrastructure you control. What changes is the density of those actions. Baseline privileged and service identities for normal access patterns, then look for rapid resource discovery, authentication across multiple systems, and execution sequences that would be abnormal for any human operator. Correlate identity, endpoint, network, and OT telemetry so those individual actions show up as one attack path instead of unrelated alerts. For critical infrastructure, enforce hard IT-to-OT access boundaries so faster automation does not create a larger blast radius. You do not need to determine whether the operator is human or AI. You need an architecture that constrains both.

Supporting sources:

Private does not mean segmented.

The Polish power plant intrusion shows that “private” operator-managed networks carry the same trust assumptions we abandoned for enterprise networks years ago. Ask specifically whether any OT asset is reachable over a carrier-managed private APN, and whether the segmentation and logging guarantees exist in a contract or only in an assumption.
The White House offensive-hacking framework is a legal, reputational, and enterprise-risk decision, not just a security-team decision. If the organization is considering participation, general counsel and the board should own the authorization framework, attribution threshold, and analysis of third-party exposure before any capability is stood up.
AI-agent-assisted intrusions are now showing up in real operations against government and energy targets. The board-level question is not whether an attack was “autonomous,” but whether our architecture limits what any fast-moving operator can reach. Identity scope, segmentation, and blast-radius controls matter more than identifying whether the keyboard is being driven by a person or an agent.

Design Principle Impact: Segmentation cannot be inherited from a network label. The Polish incident collapsed because a private APN was treated as an isolation boundary when it was flat any-to-any transport. Any network you do not control and inspect is untrusted transport, regardless of who calls it private.
New Constraint/Dependency: Security architecture cannot assume its primary telemetry source will remain available. Safe Mode can remove endpoint visibility by design, while automated attack frameworks can generate dense sequences of otherwise ordinary activity. Detection needs independent coverage across identity, endpoint, network, and OT layers so the loss or evasion of one sensor does not remove the entire attack path from view.

Implementation Watch Item: Monitor for unexpected reboots into Safe Mode with Networking on servers and workstations, and configure EDR to operate in Safe Mode wherever the product supports it. Production systems have almost no legitimate reason to enter that state.
Common Failure Mode: Relying on endpoint agents or malware signatures as the primary OT and ransomware detection layer. Akira rebooted past the agent, and the Polish attackers used native PLC functions that produced no signature. Both defeated signature-and-endpoint-centric visibility.
Monitoring Patterns: PLC STOP-mode commands, controller program uploads, and OT device password changes; bcdedit bootloader modifications and service startup-type changes on Windows; burst or rapid-sequential activity from a single identity indicating agent-driven operation; new device-to-device traffic across private APN links.
Signal vs Noise Guidance: A single Safe Mode boot during a scheduled maintenance window is noise. A Safe Mode reboot outside change control, followed by outbound network connections, is a genuine indicator. Likewise, fast sequential recon from one identity is signal; a busy admin working normally is not, and the differentiator is inhuman tempo and the absence of a corresponding change ticket.
Adversarial edge item: Treat loss of visibility as an event, not merely a monitoring failure. An EDR agent disappearing after boot-configuration changes, a controller losing logs after a reset, or a previously quiet APN link suddenly carrying new east-west traffic should trigger investigation even when no malware alert exists. Attackers benefit when defenders only investigate what their surviving sensors can still see.

See you next Monday!

The Monday Brief is produced by Douglas McKee and Ismael Valenzuela. The opinions expressed are our own and do not reflect those of our employers.

No posts

Attackers Reached a Polish Power Plant's Controls Through a Private Cellular Network Nobody Was Watching

Comments