The Threat Landscape for Critical Infrastructure
Critical infrastructure faces a category of cyber threat that differs fundamentally from what most organisations encounter: adversaries whose objective is not data theft or financial gain, but the disruption or destruction of physical systems. For energy networks, water treatment facilities, telecommunications operators, and transport systems, a successful cyber attack is not a business interruption event — it is a public safety event. That distinction shapes everything: the threat actors involved, the tools they use, the timelines they operate on, and the security posture required to defend against them.
The defining case study for critical infrastructure threats in Eastern Europe is Sandworm's operations against Ukrainian power infrastructure. In December 2015, Sandworm caused the first confirmed cyber-induced power outage in history, cutting electricity to approximately 230,000 customers in western Ukraine by deploying BlackEnergy malware to remotely operate distribution substation breakers. One year later, in December 2016, a more sophisticated attack targeting a single high-voltage transmission substation in Kyiv deployed Industroyer — purpose-built malware with native modules for interacting with industrial control system protocols IEC-101, IEC-104, IEC-61850, and OPC-DA. The malware issued direct commands to substation automation equipment, bypassing the engineering workstations typically used to operate them. In April 2022, Sandworm attempted to repeat the operation with Industroyer2, a rewritten version targeting IEC-104 substation automation units, designed to cause far larger distribution outages than the 2016 attack. Ukrainian defenders, alerted by intelligence sharing, detected and neutralised the deployment before the trigger fired.
These are not isolated incidents — they are data points in a continuous operational programme. Sandworm has maintained persistent access to Ukrainian energy infrastructure for periods measured in years, using initial IT-side access to position OT-targeting capability in advance, waiting for a geopolitically significant moment to activate it. The 2022 Industroyer2 deployment was discovered staged in an environment that had been penetrated months earlier. The pre-positioning approach is standard operating procedure: gain initial access via IT, establish persistence, pivot to OT boundary, deploy ICS-capable tooling, wait.
Water and wastewater infrastructure has emerged as a separate target category. Multiple documented intrusions at Ukrainian water utilities involved attempts to manipulate chemical dosing systems — chlorination controls, pH adjustment systems — with potential consequences for public health. Telecom infrastructure has been targeted both for intelligence collection and for denial-of-service effects: disrupting communications at operationally significant moments. Transport management systems, traffic control infrastructure, and port logistics systems have all been the subject of documented attacks across the conflict period.
The human-layer attack vector is particularly significant in critical infrastructure. OT environments employ large numbers of engineers and operations staff who interact with industrial systems through workstations, HMIs, and remote access tools. These users receive significantly less security training than IT staff, are accustomed to operating in environments where authentication friction is treated as a safety risk, and routinely use USB media and personally-owned devices in industrial zones. Social engineering campaigns targeting OT personnel — particularly shift engineers with access to remote operation capabilities — are a consistent entry vector in AmonSul's incident response casework.
Regulatory and Compliance Context
Critical infrastructure operators in Ukraine and those with EU operations face one of the most demanding and rapidly evolving regulatory environments in the cybersecurity domain.
The NCCC's mandatory incident reporting framework applies to all operators classified as critical infrastructure under Ukrainian law. The classification covers energy generation and distribution, water supply and treatment, telecommunications, transport logistics, financial infrastructure, and healthcare. Reportable incidents must be notified within four hours of detection, with a full technical report within 72 hours. The NCCC also mandates minimum security controls for classified critical infrastructure entities — continuous monitoring, vulnerability management, incident response planning, and regular assessment — and conducts compliance verification. Non-compliance carries operational licensing risk, not merely financial penalties.
The NIS2 Directive brings a parallel and substantially overlapping framework for operators with EU exposure. NIS2 defines essential entities across ten sectors including energy, water, transport, and digital infrastructure, and imposes requirements for risk management, supply chain security, multi-factor authentication, encryption, and incident response. The 24-hour early warning and 72-hour full notification requirements align closely with NCCC timescales, but NIS2's supply chain security provisions go further: operators must assess and manage the cybersecurity posture of their critical suppliers, which creates significant procurement and vendor-management obligations. The personal liability provision for senior management is a material change from the original NIS Directive and has concentrated board-level attention on cybersecurity compliance in a way that the previous framework did not.
IEC 62443, the international standard for industrial automation and control system security, provides the technical framework for OT security programmes. Its zone-and-conduit model — segmenting industrial networks into security zones with controlled data flows between them — is the foundation of a defensible OT architecture. Compliance with IEC 62443 is not legally mandated in most jurisdictions, but it is increasingly required in procurement contracts for industrial components and systems, and it provides a coherent technical baseline for organisations building or auditing an OT security programme. AmonSul's assessments use IEC 62443 as the primary technical reference for OT security gap analysis.
Ukraine's Law on Critical Infrastructure Protection, substantially updated in 2021, introduced formal categorisation of critical infrastructure objects, mandatory security measures calibrated to the category, and a legal framework for NCCC oversight and enforcement. The post-2022 revisions have accelerated the categorisation process and increased the mandatory minimum security requirements for the highest-criticality categories, bringing them closer to NATO standards for critical infrastructure protection.
Why AmonSul for Critical Infrastructure
AmonSul's operational heritage in critical infrastructure protection is direct and unambiguous: our analysts have defended Ukrainian power infrastructure, water utilities, and telecommunications operators against the specific threat actors — Sandworm, Kamacite, and associated units — who have been conducting live attacks on these systems for four years. We have responded to incidents involving Industroyer variants, ICS-specific living-off-the-land techniques, and OT-targeting reconnaissance campaigns. The playbooks and detection logic embedded in our MDR service are not derived from vendor research papers — they come from the incident data we generated in those engagements.
The OT-aware monitoring capability AmonSul brings to critical infrastructure clients is built on that operational experience. Most enterprise SOC providers monitor IT networks. An AmonSul deployment for a critical infrastructure client integrates passive industrial protocol inspection — Modbus, DNP3, IEC-104, S7comm, and others — with the IT monitoring stack, cross-correlating anomalies on both sides of the IT/OT boundary. When Sandworm pivoted from IT to OT in the 2022 Industroyer2 campaign, the first detectable signal was anomalous SMB traffic in the OT boundary segment — not a malware detection. A monitoring platform that can only see IT-side activity would have missed it.
VATRA's coverage of ICS-targeting threats is specifically maintained for critical infrastructure clients. The platform tracks not only Sandworm's current infrastructure and tooling but also Kamacite — the intrusion operator that handles initial access operations for Sandworm campaigns — and several additional actors with demonstrated interest in ICS environments. VATRA's monthly briefings for critical infrastructure clients include sector-specific threat landscape updates: new campaigns observed, infrastructure changes in tracked actor clusters, and emerging CVEs being actively researched by ICS-targeting groups.
The combination of OT-aware MDR, VATRA intelligence, and IR capability built specifically for environments where containment decisions have real operational consequences makes AmonSul's offering materially different from a generic MSSP adapting enterprise security services for an industrial context. Critical infrastructure security is a specialism. AmonSul has practised it in an environment where the adversaries were real, the stakes were operational continuity and public safety, and the lessons learned were written in incident reports from active engagements.