Adversarial Targeting of Critical Infrastructure Linchpins

Three adversary tiers

Kyle Cas and colleagues profile OT/ICS threat actors at rising sophistication: Army of Russia Reborn (CAR), Cyber Avengers, and Volt Typhoon (Vanguard Panda). They use a sports analogy from freshman to varsity skill levels.

Disruption-focused groups

CAR, linked to Russian activists and poor OPSEC, brute-forces exposed VNC/HMI systems, publishes playbooks, and has caused real facility flooding and pressure manipulation. Cyber Avengers—a small IRGC-affiliated team—targets Israeli OT vendors like Unitronics, compromising perimeter devices and developing Linux ICS-oriented malware.

Strategic espionage

Volt Typhoon differs by sustained collection of OT project data, work logs, alerts, safety systems, and remediation procedures—intelligence to craft disruptive capabilities, not mere espionage. They live off the land with NPS tunnels, Impacket, web shells, and Soho router botnets, targeting interdependent fuel, water, and power providers serving military customers—the linchpins of critical infrastructure.