America’s crowded threat environment and the vanishing distance between a computer intrusion and a physical-world emergency

By Jonathan Brown

At approximately 5:45 in the morning on August 7, 2026, malicious software infected and compromised information-technology systems belonging to Suisun City, California. What happened next is more important than whatever label is eventually attached to the malware.

The city took its IT environment offline. City Hall services were disrupted. Records and internal operations were affected. Public-safety systems were affected. Police and firefighters continued responding, but Suisun City dispatchers began taking 911 and non-emergency calls through the neighboring Solano County dispatch center. The city activated its Emergency Operations Center, declared a state of emergency, brought in federal and state partners, and eventually extended City Hall's closure through August 14 while the investigation and recovery continued.

At the time of this writing, there is no public attribution. Suisun City has not identified the malware family, the initial-access vector, the persistence mechanism, or the actor responsible. Nothing presently establishes that Russia did it. Nothing establishes Iran, China, a hacktivist collective, or a ransomware affiliate. There is not even enough public information to conclude confidently that the attacker's principal objective was disruption rather than extortion, espionage, theft, or opportunistic compromise.

That distinction is important. Attribution should not be reverse-engineered from political anxiety.

But there is another distinction that matters just as much.

For the people who needed emergency services, the attacker's ideology was not the most important fact about the incident. The important fact was that somebody touched a computer system and 911 dispatch moved to another jurisdiction.

That is the threshold we need to examine.

Because the emerging danger to American critical infrastructure is larger than the proposition that there are a growing number of hackers who dislike the United States. There certainly are hostile actors whose objectives are explicitly anti-American, anti-NATO, or aligned with governments that regard the United States as an adversary. But that description is too simple for the threat environment now developing.

The more consequential reality is this:

The United States is operating inside an unusually crowded hostile cyber environment in which foreign intelligence services, military cyber units, state-supported operators, ideological hacktivists, criminal affiliates, ransomware franchises, access brokers, and independent opportunists can all converge on many of the same systems—using overlapping tools, exploiting overlapping weaknesses, and sometimes producing similar physical consequences for completely different reasons.

The U.S. Intelligence Community's 2026 Annual Threat Assessment puts essentially that collection of adversaries into the same strategic frame. It assesses that China, Russia, Iran, North Korea, and non-state ransomware groups will continue seeking access to U.S. government, private-sector, and critical-infrastructure networks for intelligence collection, future disruption, and financial gain. China and Russia are characterized as the most persistent and active state cyber threats, while financially and ideologically motivated non-state actors are becoming bolder.

That is not one enemy.

It is an ecosystem of risk.

And increasingly, the same exposed router, VPN concentrator, firewall, hypervisor, mail server, human-machine interface, programmable logic controller, remote-management portal, or municipal server may be useful to several members of that ecosystem.

The disappearing boundary between a cyberattack and an infrastructure attack begins there.

The wrong question: “Why would anyone target us?”

For years, one of the most persistent misconceptions in cybersecurity has been the belief that an organization needs to be important enough to justify an attacker choosing it.

Why would anybody target this little town?

Why this small water utility?

Why a regional hospital?

Why a rural manufacturer?

Why this substation?

Why a municipal wastewater plant?

Why us?

That question assumes a targeting process that often no longer exists.

Internet-scale reconnaissance allows an adversary to reverse the decision. The attacker does not necessarily begin with the organization. The attacker begins with the vulnerability.

Find everything exposing TCP port 5900.

Find every router answering an SNMP request.

Find every VPN gateway running a particular vulnerable build.

Find every HMI presenting a recognizable login interface.

Find every PLC reachable on TCP 502, 102, 44818, or 2222.

Find every obsolete appliance whose manufacturer stopped issuing security fixes.

Then ask who owns it.

In some contemporary campaigns, the organization becomes interesting after the attacker discovers that it is accessible.

This is not theoretical. In its December 2025 multinational advisory on pro-Russian hacktivists, the FBI, CISA, NSA, DOE, EPA and international partners described exactly this kind of targeting. The actors often use superficial criteria such as the availability of a vulnerable system rather than the strategic importance of the organization. The advisory explicitly describes their operations as opportunistic and notes that this can produce a remarkably broad target population ranging from water-treatment facilities to energy systems.

That radically changes the defensive equation.

A small municipality no longer needs to be strategically important enough for Moscow, Tehran, Beijing, Pyongyang or a major ransomware organization to place its name on a target list.

It may only need to own a device that appears in a search result.

Five actors can want the same door for five different reasons

Consider an internet-facing router at an American utility.

A Russian intelligence service might want the router because its configuration reveals internal addressing, neighboring networks, authentication material, routes, management interfaces and relationships that facilitate espionage.

A Chinese state actor might want it as a covert ingress point or as infrastructure that helps conceal long-term access to a strategically important environment.

A ransomware affiliate might want exactly the same device because compromising it establishes initial access into an organization capable of paying.

A hacktivist might want it because a screenshot proving access to an American utility earns attention on Telegram.

An access broker may not care what the victim does at all. Access itself is inventory. It can be sold to whoever cares later.

Different motives.

Different organizations.

Different levels of capability.

Same door.

The FBI has been remarkably explicit about this convergence. In a 2026 discussion of edge-device exploitation, FBI Cyber Division Assistant Director Brett Leatherman described routers, modems, and Internet-of-Things devices as one of the leading ways adversaries are entering networks. Comparing Russian and Chinese state operations that compromised routers, he summarized the problem succinctly: two major adversaries, essentially the same edge-device playbook.

That is why the edge of the network has become strategic terrain.

It is also why CISA issued Binding Operational Directive 26-02 in February 2026 requiring federal civilian agencies to identify and remove end-of-support edge devices. An obsolete router is not merely an old piece of equipment. It is a device installed at one of the highest-leverage positions in an architecture, directly exposed to hostile traffic, often entrusted with authentication, routing, encrypted tunnels, remote access or policy enforcement, and incapable by definition of receiving fixes for vulnerabilities discovered after support ends.

The security industry has traditionally tended to classify threats by actor.

The infrastructure defender increasingly has to classify them by path to consequence.

A router configuration file can be intelligence

The current Russian FSB Center 16 campaign illustrates why.

In July, NSA, CISA, the FBI, the Defense Cyber Crime Center and numerous allied services issued a joint advisory warning that Russian Federal Security Service Center 16 actors continue compromising poorly configured networking devices across critical-infrastructure sectors. The sectors specifically identified include communications, the Defense Industrial Base, energy, financial services, government—particularly state and local government—and healthcare.

The interesting part is the technique.

It is not magic.

The actors scan IP ranges looking for active Simple Network Management Protocol services. SNMP is an old and extraordinarily useful mechanism through which administrators monitor and sometimes configure network equipment. Older SNMP versions can authenticate using a shared “community string”—effectively a password-like value.

Find a router accepting a common or default read-write SNMP community string and an attacker may be able to do considerably more than ask how many packets passed through an interface.

According to the joint advisory, FSB Center 16 sends SNMP Set requests containing object identifiers that instruct vulnerable network devices to copy their configuration into a file—names such as config.bkp or output.txt are observed—and then transfer that file, often by Trivial File Transfer Protocol, to infrastructure controlled by the actor. The same campaign has also used Cisco Smart Install and known vulnerabilities including CVE-2018-0171 and CVE-2008-4128.

Think about what has just happened.

Nobody needed to exploit a workstation.

Nobody necessarily phished an administrator.

No ransomware needed to execute.

The network itself described its architecture to the attacker.

A configuration file may disclose addresses, interfaces, routing relationships, access-control rules, VPN information, device names, management networks and credentials or credential hashes depending on configuration and platform. Even where the stored secrets are not immediately usable, the file reduces uncertainty. It tells an intelligence service how the environment is constructed.

And intelligence about architecture is operationally valuable because networks are not flat collections of machines. They are maps of trust.

A route says what can reach what.

A VPN says what trusts whom.

A management address says where authority lives.

An access-control list says which boundary the defender believes exists.

An exported configuration is therefore not merely “data theft.” It can be reconnaissance for whatever comes next.

This matters profoundly when we move from espionage into contingency planning.

China demonstrates the difference between stealing information and storing an option

The People's Republic of China's cyber operations provide the clearest public example of why persistent access to infrastructure cannot be understood solely through the traditional espionage lens.

U.S. agencies have described the PRC activity commonly known as Volt Typhoon as pre-positioning inside U.S. critical infrastructure for potential disruptive or destructive operations in a future crisis. The campaign has affected communications, energy, transportation, water and wastewater environments. The FBI's 2026 discussion of the threat again characterized Volt Typhoon as access placed in advance so that it could potentially be used during a kinetic contingency, including one involving the Indo-Pacific.

That is different from conventional intelligence collection.

Espionage asks: What can I learn?

Pre-positioning asks: What could I make happen later?

The distinction is crucial because the malicious action may be separated from the intrusion by months or years.

An actor preparing for a future conflict wants access before the conflict exists.

This creates a profoundly uncomfortable problem for critical-infrastructure defenders. The “next cyberwar,” if it ever occurs, may in part be fought over access that already exists when nobody believes the country is at war.

John Hultquist, speaking in the FBI's 2026 series, made precisely this point: offensive operators planning for a future contingency have to establish access ahead of time, while defenders therefore have to find and remove that access now rather than waiting for geopolitics to deteriorate.

This is one reason the phrase “cyberattack” becomes misleading.

If a foreign actor resides quietly inside an American transportation network for three years and issues disruptive commands only during a military crisis, when did the attack begin?

When the vulnerability was exploited?

When persistence was established?

When credentials were stolen?

When the actor mapped operational dependencies?

Or only when the trains stopped moving?

From the perspective of national resilience, waiting for the final step is dangerously late.

Iran shows what happens when the network boundary disappears entirely

The most technically important American critical-infrastructure warning of 2026 may be the ongoing Iranian-affiliated campaign against programmable logic controllers.

A PLC is not an ordinary server. It is a specialized industrial computer used to run physical processes. PLCs read inputs—pressure, temperature, flow, position, tank level, switch state—and execute programmed logic that determines outputs such as whether a pump runs, a valve opens, a motor stops, a conveyor advances or a process interlock activates.

This is where code becomes physics.

The April 2026 joint advisory from the FBI, CISA, NSA, EPA, DOE, U.S. Cyber Command and Treasury was updated on July 22 after continued Iranian-affiliated activity. The agencies warned that actors were exploiting internet-connected OT devices across U.S. critical infrastructure, including PLCs manufactured by Rockwell Automation/Allen-Bradley, Schneider Electric and Siemens. Government facilities, water and wastewater systems, and energy organizations were among the sectors affected.

The technical details deserve attention because they destroy the comfortable image of industrial cyberattack as something that necessarily requires exotic malware.

The actors accessed internet-facing PLCs using overseas infrastructure and legitimate vendor engineering tools. Traffic was observed against ports associated with industrial protocols and remote access, including TCP 44818 and 2222, TCP 102, TCP 502 and SSH. The targeted equipment included Rockwell CompactLogix and Micro850 controllers, Schneider Modicon M340 systems and Siemens S7-1200 PLCs.

Those port numbers represent something much more important than numbers on a firewall.

TCP 44818 is associated with EtherNet/IP and the Common Industrial Protocol.

TCP 102 is associated with Siemens industrial communications.

TCP 502 is the conventional port for Modbus/TCP.

These are languages through which machines describe and control physical processes.

More disturbingly, the agencies observed the actors using legitimate software such as Rockwell Automation Studio 5000 Logix Designer, Schneider Electric EcoStruxure Control Expert and Siemens TIA Portal to retrieve PLC project files.

This is a critical conceptual point.

A malicious actor does not always need “malware” if the legitimate engineering tool already possesses every capability required to alter the process.

If the attacker can authenticate to the controller as an engineer, the attack may consist of valid commands sent through valid software using valid industrial protocols.

The maliciousness lies in authority, not syntax.

The July update describes one U.S. victim where a malicious project file preserved enough ladder logic for downstream functionality to continue while adding logic that overrode instructions responsible for maintaining safe operating parameters. The agencies also documented modification or deletion of project-file logic and manipulation of HMI and SCADA data. Some victims experienced operational disruption and financial loss.

That deserves to be read twice.

The program did not necessarily have to destroy the entire industrial process.

It could leave the machinery apparently functioning while changing the rules that define safe operation.

That is an integrity attack on the physical process itself.

The HMI problem: if the operator's reality can be altered, control has already been contested

Industrial security discussions often focus on the PLC because it directly controls equipment.

But the human-machine interface may be equally important.

The HMI is the operator's window into the system. It displays tank levels, temperatures, pressure, motor state, alarm conditions, flow rates and control parameters. SCADA systems aggregate those views across larger distributed environments.

Compromise the control logic and the process can be manipulated.

Compromise the operator's view and the human being responsible for correcting the process may no longer know what is actually happening.

The Iranian-affiliated activity included manipulation of data displayed on HMI and SCADA systems.

This creates two related attack surfaces.

One is control integrity: is the controller executing the authorized process?

The other is observational integrity: does the operator's screen accurately represent the process?

A defender who protects one but not the other has not protected the physical system.

This becomes especially dangerous when the attacker does not need to understand the entire plant. Industrial processes often contain existing automation, presets, tags, graphical controls and engineering descriptions. Once an attacker reaches an HMI or engineering workstation, the legitimate interface may explain enough of the system to enable harmful experimentation.

Which brings us to perhaps the most unsettling actor in the entire threat landscape.

The amateur.

Hacktivism is becoming stochastic sabotage

The multinational advisory on pro-Russian hacktivists is extraordinary not because these actors are unusually sophisticated, but because the governments issuing it repeatedly emphasize that they are not.

Groups including Cyber Army of Russia Reborn, Z-Pentest, NoName057(16), Sector16 and affiliated actors have targeted operational technology using relatively elementary techniques. Some have varying relationships to Russian state interests; the advisory assesses, for example, probable GRU support in the creation and earlier operation of CARR while distinguishing later groups and relationships carefully.

Their method can be brutally simple.

Scan for internet-facing Virtual Network Computing services.

Look around port 5900 and neighboring ports.

Spin up inexpensive virtual infrastructure.

Run password guessing or brute-force software.

Try known default credentials.

Connect to the exposed HMI.

Use the graphical interface already installed for the legitimate operator.

Then start clicking.

The advisory documents attempts to change usernames and passwords, modify process parameters and instrument settings, disable alarms, restart equipment, create loss of operator view and manipulate control.

This is not Stuxnet.

It may not require custom PLC malware, a stolen code-signing certificate, detailed knowledge of centrifuge physics or an intelligence service's development budget.

Sometimes it requires VNC.

That makes the threat qualitatively different.

The advisory says these groups often misunderstand the industrial processes they are attempting to disrupt. Their technical knowledge can be poor. Their claims are frequently exaggerated or false. They often seek notoriety and post screenshots or recordings of compromised interfaces to prove what they have done.

Yet the same advisory says they have caused actual harm and, in some instances, physical damage. No injury had been attributed to the documented attacks, but authorities explicitly warned that attacks against occupied factories and community facilities demonstrate disregard for human safety.

This produces something resembling stochastic cyber-physical sabotage.

The actor may not know exactly what will happen.

That does not make the action safe.

In some respects it makes it less predictable.

A sophisticated state operator studying a plant for months may understand that a particular valve must not be moved under a certain operating condition.

A poorly trained hacktivist staring at an unfamiliar HMI might move it precisely because the button exists and doing so will make a dramatic video.

Low sophistication does not equal low consequence.

That equation is now obsolete.

Minnesota should end the argument that “small systems don't matter”

On July 26 and 27, 2026, a coordinated cyberattack targeted operational technology at more than 30 Minnesota community water systems.

That fact comes directly from Minnesota IT Services.

The state activated a coordinated incident response involving state agencies, CISA, the EPA, the FBI and local utilities. Minnesota subsequently clarified that most confirmed cases involved technology used to remotely monitor and control water equipment, including PLCs and HMIs.

The state has not attributed the activity.

That needs to remain explicit.

The Minnesota attacks should not be casually folded into the Iranian campaign merely because Iran-linked operators are also targeting American PLCs. Nor should they automatically be assigned to pro-Russian hacktivists because those groups target water systems.

Similar technology does not prove common authorship.

Minnesota also made an important distinction about impact: confirmation of malicious activity affecting a system's technology does not mean every affected community suffered an interruption of drinking-water service. As of July 30, officials said there were no active statewide requests for residents to alter water usage.

That restraint makes the incident more useful analytically, not less.

More than 30 community systems were caught inside one coordinated episode because they shared a class of technology and exposure that an adversary could apparently reach.

That is infrastructure-scale targeting without requiring a giant infrastructure operator.

Thirty small systems can collectively be a large national-security problem.

This is the multiplication effect created by common industrial technology, remote administration and repeatable attack paths.

The attacker writes—or learns—one method.

The Internet provides the target list.

Suisun City demonstrates the other route to physical consequence

Minnesota illustrates direct targeting of operational technology.

Suisun City illustrates something equally important: an attacker does not necessarily need to reach operational technology to disrupt an operational service.

Municipal government is full of digital dependencies that are difficult to see until they disappear.

Public-safety communications depend on networks.

Dispatch depends on communications and information systems.

Personnel depend on identity.

Departments depend on records.

Administrators depend on email and telephony.

Emergency operations depend on contact information, maps, procedures, databases and coordination tools.

Backup systems depend on storage and authentication.

Even when police radios, fire engines and ambulances themselves remain functional, the administrative and communications systems that tell responders where they are needed can become the constraining resource.

Suisun City did not announce that an attacker “hacked a 911 controller.” It announced that a cybersecurity incident affected public-safety departments and that dispatchers were taking calls through Solano County while police and firefighters continued responding.

That is enough.

The infrastructure consequence emerged through dependency, not necessarily direct cyber-physical control.

This exposes the weakness of the conventional IT/OT dichotomy.

We often imagine that IT contains email, databases and business systems while OT contains pumps, motors and machines.

Operational reality is messier.

If losing an IT system prevents an operator from dispatching personnel, ordering chemicals, obtaining a configuration file, authenticating to an engineering workstation, communicating with a field crew or restoring an OT system, that IT system participates in the critical function whether or not anyone calls it OT.

Criticality is therefore not purely an attribute of a device.

It is an attribute of a dependency graph.

The attackers do not have to compromise the fire engine if they can compromise the system that tells the fire engine where to go.

They do not have to manipulate the pump if they can remove the operator's ability to see it.

They do not have to attack the generator if they can disable the identity, communications or management plane required to operate it remotely.

That is how cyber incidents become infrastructure incidents.

Espionage belongs in this discussion because intelligence creates options

Not every hostile intrusion is designed to break something.

That does not make espionage irrelevant to infrastructure security.

On July 23, a large coalition of Western security agencies exposed a Russian state-supported campaign attributed to the actor commonly called LAUNDRY BEAR. The group has compromised organizations using Zimbra Collaboration Suite, including targets in defense, government, education, energy, law enforcement, technology and other sectors.

Its current technique is notable.

CVE-2025-66376 allowed a view-based exploit against vulnerable Zimbra webmail. The victim did not need to download an attachment in the conventional sense or follow a malicious link; viewing the crafted message in a vulnerable client could trigger exploitation.

The custom capability, called Ulej or “beehive,” was used to steal email information and establish persistent access. Western agencies describe the operation as espionage, not sabotage.

We should keep it there.

There is no public evidence that LAUNDRY BEAR is using Zimbra access to shut down American infrastructure.

But espionage against infrastructure operators, defense organizations, technology providers and government agencies can reveal relationships, personnel, procedures and operational context that have obvious intelligence value.

The distinction is between what access has done and what access makes possible.

That is why good analysis has to resist both extremes.

It is wrong to call every espionage compromise preparation for sabotage.

It is equally wrong to assume that persistent access to a strategically important environment can never acquire a different purpose if geopolitical circumstances change.

Access is an option.

States collect options.

Criminals are standing on the same ground

Four days before this article, the FBI, CISA, NSA, Secret Service, Defense Cyber Crime Center and South Korea's National Police Agency issued a joint advisory on Gunra ransomware.

Gunra is a ransomware-as-a-service operation. Its affiliates target government organizations, utilities, healthcare, transportation, manufacturing and other critical sectors. The operation uses double extortion and has developed the familiar commercialized structure of modern cybercrime: affiliate tooling, ransomware builders, cross-platform payloads, management infrastructure and a negotiation mechanism.

Its intrusion techniques demonstrate the convergence perfectly.

Gunra affiliates exploit known weaknesses in internet-facing infrastructure such as firewalls and VPN devices.

That is the same architectural territory the state actors want.

The Russian intelligence operator sees the edge appliance.

The Chinese strategic-access operator sees the edge appliance.

The ransomware affiliate sees the edge appliance.

The difference is frequently not the initial vulnerability.

The difference is what happens on Tuesday after access is achieved.

The ransomware affiliate steals data and encrypts systems.

The intelligence officer quietly maps the network.

The pre-positioning actor establishes durable access and waits.

The hacktivist searches for something dramatic to change.

This does not mean these actors are all cooperating.

That distinction is essential.

Convergence is not coordination.

The danger does not require Russia, China, Iran and ransomware gangs to sit in the same room.

It arises because all of them can independently exploit the same structural weaknesses.

Multiple unrelated predators can hunt at the same watering hole without forming an alliance.

The most dangerous vulnerability may be legitimate authority

Traditional cybersecurity focuses heavily on whether an attacker can execute unauthorized code.

Critical-infrastructure security has to ask a more difficult question:

What if the attacker can issue an authorized command?

Suppose the PLC receives a syntactically valid instruction.

Suppose the HMI accepts a legitimate parameter change.

Suppose the VPN establishes a valid session.

Suppose the cloud API receives a correctly signed token.

Suppose the administrator account authenticates successfully.

Suppose the hypervisor receives a command from somebody who appears to be root.

From the machine's perspective, nothing necessarily looks malformed.

The problem is that the authority behind the command has been stolen.

This is why authentication alone cannot carry the entire burden of infrastructure defense.

Privilege has to be constrained by context.

An engineering account that ordinarily changes a pressure setpoint between 40 and 60 should not necessarily be permitted to set it to 900 simply because the password and second factor were correct.

A PLC engineering session originating from an overseas VPS at three in the morning should not necessarily be accepted because the actor knows the credential.

A human-machine interface should not allow an unauthenticated VNC connection to disable alarms because somebody once found remote access convenient.

A management server should not be able to overwrite every downstream system merely because it occupies the management tier.

Safety constraints, authorization boundaries, command validation, network segmentation, independent interlocks and physical operating modes are what prevent stolen digital authority from automatically becoming physical authority.

This is where cybersecurity and engineering finally become the same discipline.

Three thresholds convert a cyber intrusion into an infrastructure attack

The boundary becomes easier to understand if we stop treating “cyberattack” and “infrastructure attack” as categories and instead think about thresholds.

The first is the dependency threshold.

A digital system crosses it when loss of that system meaningfully impairs delivery of the physical or civic service. Suisun City's dispatch disruption crossed this threshold even without public evidence of direct OT compromise.

The second is the authority threshold.

An attacker crosses it when access permits commands, configuration changes or logic modifications capable of changing the behavior of the physical process. The Iranian-affiliated PLC activity and the pro-Russian HMI attacks provide direct examples.

The third is the recovery threshold.

This is crossed when returning service requires more than reinstalling a patch or rebooting a machine because the defender can no longer trust the system's state.

Was the PLC logic altered?

Were safety limits changed?

Did the attacker create another administrator?

Was a router configuration modified?

Were certificates stolen?

Did somebody install persistent access?

Was the backup environment touched?

Can the restored HMI be trusted to display the real process?

If those questions cannot be answered, “service restored” is not the same thing as “incident resolved.”

That distinction is particularly important for control planes.

Control planes are becoming the real Tier Zero

Modern critical infrastructure contains systems whose importance is not obvious from the physical process they perform.

Active Directory may not open a valve.

A VMware management server may not generate electricity.

A remote-monitoring-and-management platform does not manufacture anything.

A firewall manager is not a pump.

A backup server does not dispatch an ambulance.

Yet these systems administer, authenticate, configure, restore or connect large numbers of systems that do.

Compromise one of them and the attacker may inherit authority over everything beneath it.

That makes management infrastructure effectively Tier-Zero-adjacent.

The same principle applies inside OT.

The engineering workstation that holds PLC project files may be more strategically important than an individual controller.

The remote-access jump host may control who can reach an entire plant.

The historian may reveal process behavior.

The HMI may expose operating limits.

The firmware repository may determine what code operators consider legitimate.

The identity provider may decide who is an engineer.

The backup platform may determine whether recovery is possible.

Defenders have to identify these assets by authority and dependency rather than by whether their hostname looks important.

Isolation is no longer a disaster-recovery option; it is an operating mode

On July 28, the FBI and international partners published new guidance under the “CI Fortify” initiative dealing specifically with isolating vital systems.

The guidance begins from the service, not the network diagram: identify the minimum systems required to deliver the critical function, identify dependent critical customers, map every connection into those systems, create isolation points, and build the capability to continue operating when those connections are severed.

That approach is exactly right for the threat environment described here.

A utility should know in advance what happens if vendor remote access disappears.

A water plant should know whether operators can run locally if the corporate identity provider is unavailable.

An energy operator should know what happens if external communications have to be cut.

A municipality should know where emergency calls go if its dispatch environment is isolated.

A hospital should know which clinical functions remain available when the enterprise network is untrusted.

A transportation operator should know whether signaling or scheduling can continue when remote management is removed.

The CI Fortify guidance goes further. It emphasizes building physical or strong logical separation where appropriate, documenting dependencies on corporate services, cloud services, third parties and communications carriers, and securing the network-management plane so an attacker cannot simply disable the isolation controls themselves. It explicitly calls for the ability to operate vital services in a state of isolation.

That is a profound shift in architecture.

The old question was:

“How do we keep the attacker out?”

The more realistic question is:

“How do we continue operating after we decide that everything outside this boundary may be hostile?”

A mature response assumes that patching may come too late

There is another doctrinal consequence.

Patching is prevention.

Patching is not necessarily incident response.

If an exposed system was vulnerable during a period of known exploitation, installing the fix closes the door.

It does not tell you whether somebody already walked through it.

This is especially important when attackers are pre-positioning, stealing credentials, modifying industrial project files or installing persistence.

A proper compromise assessment may require preservation of logs and disk images; review of authentication and administrative activity; validation of device configurations; comparison of PLC projects against known-good engineering baselines; checks of scheduled tasks, services and startup mechanisms; credential and certificate rotation; rebuilding systems whose integrity cannot be established; and verification that backups themselves remain trustworthy.

For OT, logic validation can be as important as malware scanning.

A controller containing no malicious executable may still be compromised if its ladder logic has been altered.

An HMI containing no malware may still be dangerous if alarm thresholds were changed.

A firewall running the latest version may still be hostile if the attacker's account survived the update.

Recovery therefore has to restore trust, not merely functionality.

The physical world gives attackers enormous leverage

There is a fundamental asymmetry underneath all of this.

Digital actions are cheap.

Physical services are expensive.

A threat actor can rent a VPS for very little money.

A municipality maintains police officers, firefighters, dispatchers, networks, radio systems, vehicles, databases, facilities and mutual-aid relationships.

An attacker can scan millions of IP addresses automatically.

A water system may have only a handful of people capable of rebuilding an industrial controller safely.

A hacktivist can try a default password in seconds.

A plant may need an engineer onsite for hours to reconstruct what changed.

An attacker can disable visibility with a mouse click.

An operator may have to drive fifty miles to inspect equipment physically.

The attacker does not need to destroy the infrastructure to impose cost.

Loss of view is cost.

Manual operation is cost.

Uncertainty is cost.

Closing City Hall is cost.

Diverting dispatch is cost.

Revalidating every controller is cost.

Bringing in incident responders is cost.

Replacing certificates is cost.

Rebuilding a management domain is cost.

Stopping production because the operator cannot trust what the HMI says is cost.

That is the extraordinary return available from relatively modest cyber capability.

The strategic variable is not simply attacker sophistication.

It is attacker leverage over a highly dependent physical system.

So is anti-American hacker sentiment reaching a critical level?

If by that we mean that there is a measurable global emotional quantity called “anti-American hacker sentiment,” the evidence cannot support the claim.

There is no meter for that.

And using Suisun City as evidence for it would be analytically irresponsible while attribution remains unknown.

But if we redefine the question more precisely—

Has the density of hostile cyber activity around American infrastructure reached a level at which multiple categories of adversary can independently threaten socially important functions through increasingly accessible digital dependencies?

—then the concern is well founded.

The Intelligence Community itself describes China, Russia, Iran, North Korea and ransomware groups as critical threats to U.S. networks and infrastructure, with state adversaries retaining the ability to pre-position or execute disruptive operations and non-state actors becoming increasingly bold.

Russian intelligence services are compromising routers.

Russian state-supported operators are stealing Western government and defense-related email.

PRC operators have established access intended to create options during future contingencies.

Iranian-affiliated actors are interacting directly with American PLC logic.

Pro-Russian hacktivists are wandering into exposed HMIs through VNC and trying to manipulate physical processes.

Ransomware affiliates are exploiting the same class of exposed VPN and firewall infrastructure.

More than 30 Minnesota community water systems were caught in one coordinated OT attack whose perpetrator remains publicly unattributed.

And one compromised California city found itself rerouting emergency dispatch through a neighboring jurisdiction.

None of those facts requires the others to be connected.

That is precisely the problem.

The convergence itself is the threat

We tend to look for campaigns.

Campaigns have names.

Groups have names.

Malware has names.

Vulnerabilities have CVE numbers.

Governments have flags.

Those classifications are useful for intelligence work, but infrastructure resilience demands another level of analysis.

What if the systemic problem exists between the campaigns?

The same remote-access culture.

The same exposed management interfaces.

The same unsupported routers.

The same reused credentials.

The same flat networks.

The same engineering workstations that can reach controllers and the Internet.

The same VNC installations somebody enabled five years ago and forgot.

The same PLCs installed on the assumption that no hostile person would ever be able to speak their protocol.

The same identity infrastructure controlling both corporate and operational access.

The same backups joined to the same administrative domain they are supposed to recover.

The same small municipal IT team trying to defend a public-safety environment against an Internet containing intelligence agencies, organized criminals and bored ideologues simultaneously.

The campaigns are different.

The structural weaknesses are shared.

That creates an aggregate risk larger than any individual threat group.

Cybersecurity has become continuity engineering

The most important consequence is philosophical.

Critical-infrastructure cybersecurity cannot ultimately be about protecting computers.

It has to be about ensuring that society continues functioning when computers are attacked.

That means the design objective changes.

The goal is not perfect prevention. Perfect prevention is unavailable.

The goal is to make compromise difficult, make propagation difficult, make dangerous commands difficult, make unauthorized changes visible, make critical processes independently constrained, make isolation possible, make recovery trustworthy, and make essential services survivable while all of that is happening.

For municipalities, that means alternate dispatch and communications.

For water systems, it means local control, authenticated remote engineering, verified PLC logic, safe process limits and tested manual procedures.

For energy, it means segmented control networks, independent protection systems, hardened management paths and the ability to operate through communications loss.

For healthcare, it means clinical continuity when enterprise IT disappears.

For cloud and managed-service providers, it means treating the management plane as something whose compromise could propagate into hundreds or thousands of downstream environments.

For every critical operator, it means knowing which digital dependencies can quietly become physical single points of failure.

This is no longer merely “cyber hygiene.”

It is engineering for hostile conditions.

The line has already become too thin

We should resist the temptation to call every intrusion cyberwar.

Words matter.

The United States is not necessarily in a continuous state of cyberwar simply because hostile governments conduct espionage, criminals deploy ransomware and hacktivists break into exposed industrial systems.

But the opposite formulation is becoming equally indefensible: that these are merely computer crimes occurring in a separate digital domain.

There is no separate digital domain when the packet opens the valve.

There is no separate digital domain when the PLC changes the safe operating logic.

There is no separate digital domain when the HMI lies to the operator.

There is no separate digital domain when a ransomware incident shuts down the administrative systems required to run a hospital.

There is no separate digital domain when a compromised router provides strategic access to an energy company.

And there is no separate digital domain when a city cybersecurity incident alters how 911 calls reach police and firefighters.

At that point, the network has become infrastructure.

The code has become operations.

The credential has become authority.

The configuration has become intelligence.

The backup has become resilience.

And the cyberattack has become an infrastructure attack.

That is the threshold we should be watching.

Not because every attacker hates America.

Not because every outage is a foreign operation.

Not because every vulnerability is an act of war.

But because an enormous and diverse population of hostile actors increasingly regards American digital infrastructure as accessible terrain—for espionage, profit, coercion, disruption, prestige, preparation, experimentation or ideology—and because the technical distance between gaining access to that terrain and interfering with the physical functions of society has become dangerously small.

Suisun City may eventually turn out to have been victimized by a financially motivated criminal.

It may turn out to be something else.

We should wait for evidence.

But the larger lesson does not depend on the attribution.

Somebody compromised computers in a comparatively small American city.

And 911 dispatch moved.

That is the story.

Because once society depends upon the machine, compromising the machine is no longer simply an attack on data.

It is an attack on what the machine allows society to do.

And increasingly, that distinction may be the most important one in cybersecurity.

Jonathan Brown is a cybersecurity researcher and investigative journalist at bordercybergroup.com.

If you would like to support our work — useful, well-researched, ad-free cybersecurity intelligence — subscribe, comment, or buy us a coffee! Thanks.