The Cyber War Nobody Declared: 50 State-Sponsored Attacks on Critical Infrastructure

When Russian military hackers compromised the Colonial Pipeline in May 2021, triggering fuel shortages across the US East Coast, it marked a watershed moment in the recognition of cyber attacks as strategic weapons. Four years later, the landscape has transformed: critical infrastructure attacks have become routine, attribution faster, and the response more coordinated — yet the fundamental vulnerability of industrial control systems (ICS) remains largely unaddressed.

The Scale of the Threat

According to the US Cybersecurity and Infrastructure Security Agency (CISA), 2024 saw a 340% increase in reported cyber intrusions targeting critical infrastructure sectors compared to 2020. The UK National Cyber Security Centre (NCSC) recorded 197 nationally significant cyber incidents in 2024, of which 43 targeted critical national infrastructure.

The Playbook

Analysis of 50 confirmed state-sponsored attacks on critical infrastructure reveals a consistent playbook with five phases:

Phase 1 — Reconnaissance: Attackers spend an average of 287 days conducting reconnaissance before executing an attack. Russian APT29 (Cozy Bear) was observed in a 14-month reconnaissance campaign targeting 14 US electricity utilities before detection in October 2024.

Phase 2 — Initial Access: The most common vectors are spear-phishing (42% of cases), exploited vulnerabilities in internet-facing systems (33%), and compromised third-party vendors (25%). The 2024 attack on German rail signaling systems, attributed to APT28 (Fancy Bear), used a zero-day vulnerability in Siemens industrial controllers (CVE-2024-27198, CVSS 9.8) that had been patched but remained unapplied across 70% of Deutsche Bahn's signaling infrastructure.

Phase 3 — Lateral Movement: Once inside, attackers pivot from IT to OT networks. In the 2022 attack on Ukrainian power grids, Sandworm (GRU Unit 74455) used the INDUSTROYER.V2 malware variant to directly manipulate IEC 60870-5-104 protocol traffic between control centers and substations, causing a 6-hour blackout affecting 350,000 households.

Phase 4 — Effect Delivery: The payload varies by objective: destructive (data wipers on 71% of industrial systems in the 2024 attack on Taiwan's semiconductor fabs), disruptive (safety system shutdowns in the 2023 breach of a US water treatment facility), or ransom (the 2021 Colonial Pipeline attack, which was actually a data theft extortion, not an operational technology compromise).

Phase 5 — Persistence: Sophisticated attackers maintain access for future operations. Mandiant identified 23 cases where attackers maintained persistence in OT environments for over 12 months after initial effect delivery.

The Attribution Problem

While technical attribution has improved — Mandiant achieved "high confidence" attribution in 87% of cases in 2024 — geopolitical attribution remains constrained. The US government formally attributed the Colonial Pipeline attack to DarkSide, a Russian-language ransomware group, but declined to attribute it to the Russian state, despite intelligence indicating GRU coordination of ransomware operations.

The Regulatory Response

The EU's Network and Information Security Directive 2 (NIS2), which member states were required to transpose into national law by October 17, 2024, introduces mandatory incident reporting for critical infrastructure sectors within 24 hours, with penalties of up to €10 million or 2% of global annual turnover.

The US Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) of 2022, which took effect in April 2025, requires covered entities to report cyber incidents within 72 hours and ransomware payments within 24 hours to CISA.

The Air-Gap Myth

One of the most significant findings of the 50-attack analysis: the concept of "air-gapped" systems (physically isolated from the internet) is no longer a reliable defense. In 14 confirmed cases, attackers breached air-gapped systems through supply chain compromise, removable media, or side-channel attacks. The 2023 breach of a European nuclear research facility's air-gapped neutron detection system was achieved through modified USB charging cables with embedded WiFi transmitters.