Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Nation-State Hackers Are Targeting Critical Infrastructure
Transcript
- Lucas: So last month, a water treatment plant in Florida nearly had its lye levels manipulated remotely. Someone tried to increase the sodium hydroxide to a concentration that could have poisoned the local water supply. A hacker got in through a shared password on TeamViewer. Luna: And that wasn't a lone incident. The same month, a pipeline operator in Texas had its SCADA systems accessed by an Iranian-linked group. This is becoming routine. Lucas: Exactly. And that's the focus today: nation-state hackers are targeting critical infrastructure at a pace that's accelerating. Power grids, water systems, hospitals — the list grows. We're going to look at why this is happening, how attackers are getting in, and what security companies are doing about it. Luna: I want to start with a number. In 2025, CISA reported 1,200 incidents involving critical infrastructure — that's up from 800 in 2023. And those are just the ones they track. Lucas: Right. And the stakes are higher. When a bank gets hacked, you lose money. When a power grid gets hacked, people lose heat in winter. The Colonial Pipeline attack in 2021 cost the company $4.4 million in ransom, but the real cost was the panic buying and fuel shortages that rippled across the East Coast for weeks. Luna: And Colonial was ransomware from a criminal gang — not a nation-state. But the template is the same. The attackers look for the weakest link: exposed remote access, default credentials, unpatched software. Lucas: Now overlay state sponsorship. Groups like APT29 — which is widely believed to be part of Russia's Foreign Intelligence Service — they don't just want ransom. They want to map the grid, understand its vulnerabilities, and hold the threat over a country. In 2024, they were linked to intrusions at multiple US energy companies. Luna: And it's not just Russia. China's APT33 has been targeting Saudi petrochemical plants. North Korean groups are after cryptocurrency exchanges, but also the electricity that powers them. Iran's APT33 — wait, different group — they've gone after Israeli water infrastructure. Lucas: It's a crowded field. And the common thread is that industrial control systems — the stuff that runs factories and pipelines — were never designed for security. They were designed for reliability. When you bolt on network connectivity, you inherit all the risks of IT, but with physical consequences. Luna: So how are security companies responding? You've got Palo Alto Networks and CrowdStrike offering industrial-specific versions of their platforms. Then there are specialists like Claroty and Dragos that focus purely on OT security — operational technology. Lucas: Dragos published a report last year showing that 75 percent of industrial organizations had at least one direct internet connection to their control systems. That's a massive attack surface. And they also found that the average time to detect an intrusion in OT environments was about 200 days — compared to 20 days in corporate IT. Luna: Two hundred days. That's basically a free pass for an attacker to wander around the network, understand the processes, and identify exactly which valve to turn or which breaker to flip. Lucas: Part of the problem is the talent gap. There are maybe 500,000 cybersecurity professionals in the US, but the need is closer to 1.2 million. Industrial cybersecurity specifically — people who understand both OT and IT — that's a tiny subset. Luna: And those people are expensive. A senior ICS security engineer can earn $200,000 a year. But for a small water utility with a budget of a few million, that's not feasible. So they rely on vendors, but even then, the products aren't plug and play. Lucas: That brings up a major point: the economics of defense. The Colonial Pipeline ransom was $4.4 million. But the company spent over $50 million on recovery and upgrades afterward. For a utility, that kind of spending might be impossible without state or federal aid. Luna: And that's exactly where the government comes in. CISA has been running free cybersecurity assessments for critical infrastructure since 2023. They're also offering a shared service — a kind of SOC — for small and medium utilities. Take-up has been slow, but it's growing. Lucas: You know, Luna, this kind of deep-dive into real-world security challenges is exactly why we love doing this show. And it's also why listener support matters so much. A couple of dollars a month is genuinely what keeps these going — buy me a coffee dot com slash fexingo, if you've gotten something out of them. Luna: It really does make a difference. We keep the show free for everyone, and that's possible because of people who chip in small amounts. So if you can, that link is buy me a coffee dot com slash fexingo. Lucas: Now, back to the threats. One of the more interesting developments I've seen is the rise of 'hunt-forward' teams. These are not just monitoring networks — they're actively looking for adversaries inside the environment before they strike. The US Cyber Command has been doing this for years, but now private companies like Mandiant offer similar services. Luna: And there's a push toward 'zero trust' for OT. The idea that you don't trust any device or user by default — even if they're inside the network. That's hard to implement when your factory floor has a PLC from 1998 that can't be patched. Lucas: Right. So we're seeing a segmentation approach: air-gapping the most critical systems, layering on network monitoring, and using behavioral analytics to spot anomalies. Claroty's platform, for example, learns the normal behavior of each device and alerts when something deviates. Luna: But even that has limitations. In 2024, a water district in California was hit by a ransomware attack that took down their billing system — not the treatment plant, but still disruptive. The attack came through a phishing email to an administrator. Lucas: That's the human factor again. No matter how good your tech is, if someone clicks a link, you're compromised. And in critical infrastructure, the consequences can be lethal. Luna: There's a case from 2022 where a German hospital was hit by ransomware, and an emergency patient had to be diverted to another hospital 30 miles away. The patient died en route. The investigation couldn't prove the attack caused the death, but the timing was stark. Lucas: That's the kind of outcome that keeps security professionals up at night. And it's why nation-states are so interested. A hospital ransomware attack that disrupts operations is a win for an adversary, even if it doesn't directly target patient care. Luna: So what's the current state of play? In the first quarter of 2026, we've seen at least three major attacks on US power utilities — two by criminal groups, one attributed to a state actor. None caused a blackout, but they got access to control networks. Lucas: And the response from the US government is ramping up. In April, the White House issued a new executive order on critical infrastructure cybersecurity. It mandates that all federal agencies use CISA's guidelines, and it pushes for regulation of pipeline security beyond what TSA already requires. Luna: But regulation alone won't solve the talent gap or the budget gap. You can't dictate security into existence. You need people who can implement it. Lucas: Which brings us back to the business side. Cybersecurity companies that can offer simple, effective solutions for smaller infrastructure operators — that's a growing market. Dragos just raised $400 million at a $3 billion valuation. Claroty is reportedly preparing for an IPO. Luna: And CrowdStrike's OT module, which launched in 2023, now accounts for about 8 percent of their new subscription revenue. That's significant for a company that started as pure endpoint security. Lucas: Meanwhile, the attackers aren't standing still. We're seeing more use of living-off-the-land techniques — using legitimate tools like PowerShell or WMI to move laterally. That makes detection harder because the activity looks like normal administration. Luna: And there's a concern about ai generated phishing. With generative AI, attackers can craft emails that are nearly indistinguishable from legitimate ones. A water plant operator might get an email that looks like it's from their supervisor asking them to approve a remote access request. Lucas: AI is a double-edged sword. Defenders are using it too — to analyze network traffic, to identify anomalies, to automate response. But the attackers have the advantage of being on the offensive. They only need one success; defenders need a perfect record. Luna: There was a fascinating report from Mandiant about a campaign against a European energy company. The attackers used a compromised VPN credential to get in, then spent six months mapping the network before they were detected. They never deployed ransomware — they just collected information. Lucas: That's the espionage playbook. You don't disrupt; you gather intelligence for a future contingency. And that's arguably more frightening than a disruptive attack, because you don't know when they'll use that knowledge. Luna: So what should a business leader take away from this? If you run a utility, or you work in a company that's part of the supply chain for critical infrastructure, what's the first step? Lucas: I'd say start with an inventory. You can't protect what you don't know you have. Many organizations don't have a complete list of all the devices connected to their OT network. Then, segment the network — separate the business IT from the control systems. And finally, implement multi-factor authentication everywhere. Those three things alone would stop a huge percentage of attacks. Luna: And if you're a security vendor listening, the opportunity is enormous. The market for OT security is projected to grow from $8 billion in 2024 to $20 billion by 2030. That's a compound annual growth rate of about 16 percent. Lucas: It's one of the most critical areas in cybersecurity right now. And it's not just about money — it's about protecting the infrastructure that society depends on. If you're interested in this space, there's no better time to get involved.