⚡ Critical Infrastructure theater

Tracks nation-state and criminal threats to industrial control systems (ICS/SCADA/OT) across energy, water, pipeline, manufacturing and transport sectors. Compromise here risks physical destruction, loss of life and cascading service outages, making it the highest-consequence cyber domain.

🏹 Threat Actors

🦠 Malware & Tools

🛡 Exploited Vulnerabilities

🧭 Intelligence disciplines

📚 Priority sources & datasets

📜 Critical Infrastructure Playbook

1. Collect exposed OT assets by fingerprinting Modbus/DNP3/S7 and HMI banners on Shodan/Censys and internet-facing VPN edges.
2. Normalize and enrich ICS-specific IOCs against CISA ICS advisories and MITRE ATT&CK for ICS technique mappings.
3. Analyze anomalous engineering-workstation-to-PLC traffic and firmware/logic changes for pre-positioning consistent with living-off-the-land tradecraft.
4. Attribute activity to ICS threat groups (Volt Typhoon, Sandworm, XENOTIME) via malware toolmarks, C2 infrastructure reuse and targeting patterns.
5. Disseminate sector-specific warnings to affected utilities and ISACs (E-ISAC, WaterISAC) with prioritized CVE and IOC blocklists.
6. Trigger OT network segmentation, credential rotation and safety-instrumented-system integrity checks, then hunt for persistence across the estate.

⚡ AI Skills & Automation

Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).

🎯 Add to case

🗃 Data Management

🧩 Advanced Capabilities

🔗 Cross-domain pivots