135: The Cassandra Panel: OT Threat Intelligence from April to September 2026

So yeah, you know, again, if, and for those that were at the Level Zero Conference in April or for those on this panel, you know, we talked a lot about... 'Cause right about that time, it was only maybe a couple of weeks after the big announcement came out about, uh, IRGC Iranian, uh, Iranian Net Guard, uh, um, going after Rockwell PLCs.

So, so that's, you know, at this point, that's kind of old news.

I mean, uh, the world is meeting, moving at the speed of AI these days.

Uh, so again, actually I just made this point earlier today is, you know, the, the gap between somebody that has control system security expertise and knowing how to attack control systems, and going from that gap to being able to apply that like an insider or an insider equivalent, that gap is, is...

I mean, it used to be days, weeks, months at a minimum.

Uh, I mean, I could put attack profile packages together pretty quickly, but being able to get to the level of being able to launch an attack that would really have damaging consequences in OT still may take me months to years.

'Cause I always use the example of, like, I have, uh, two PLCs.

One's a data concentrator bringing back control net, device net, and ethernet IP into one network connection that shares to a historian, and another controller identical that's attached to drives, motors, and controllers and in, and is, you know, the attack is, is, is working in physical areas in the process.

The same vulnerability and the same thing I could launch is gonna have two different potential impacts there, right? So being able to take somebody that has control system knowledge and knowing I can send the SIP reset command or SIP stop or forward open a bunch of times, and I could cause a lot of problems with that Rockwell controller, and knowing the downstream impact, is this attached to a hydrocracker, or is this attached to a dra- data concentrator? That gap is shortening dramatically, and that's actually one of the technical sessions we did There at level zero is I showed using AI tools with some tools they built.

We put them in interactive session, and the AI agent figured out how to turn things on and off on its own in a period of time there.

So, you know, again, that gap is shortening.

It's one thing I've been bringing up quite a bit more.

And I also, just to kind of get us going, just did a really quick open source dig on what has changed since April when we talked about Rockwell.

Well, we talked about now we had CISA update on June 22nd.

It's no longer in scope to Rockwell.

It was now Schneider, Siemens, and potentially other branded PLCs.

There was new TTPs where they were actually looked like they had moved on to doing some measure of safety logic tampering, hearkening back to some of the Tri- and Tricon- Triconex days.

Uh, the threat has potentially pro- proliferated laterally.

Uh, we had CloudSEK and about 60 other agents and act groups who looked like they had been joining since that time.

And now we had ChatGPT and other LLMs that were weaponized doing auto-generated show down queries and exploit scripts to ex- uh, to attack exposed PLCs.

So it really, again, the, the, the point that was made here is that attack, those attacks we saw are, were becoming commoditized.

Incidents keep landing.

Uh, at least seven US states have reported incidents to the FBI since July.

Uh, m- that included Mi- Minnesota, New Jersey, Alabama Utilities, all in public record for 2026 activity.

And Volt Typhoon kind of reminded us, Hey, we're still around.