OT attackers now modify PLC code and disable alarms

CISA's threat-hunting team has a new way of describing the problem, and it isn't "defacement of websites." Rina Rakipi, CISA's operations coordinator for threat hunting, told Federal News Network's Cyber Leaders Exchange that the past year brought a shift: adversaries are modifying programmable logic controller code, bypassing safety systems, tampering with sequencing routines inside plants, and disabling alarms to evade detection. "These changes are representing true operational sabotage," she said. The important word is "operational." The target is no longer the monitor you read; it's the process the plant runs.

Why now? Leo Taddeo, CEO of vendor AppGate, pointed to a higher risk appetite than five or 15 years ago, when China and Russia largely probed. Now, he said, adversaries preposition effects on critical infrastructure, and AI agents give even poorly funded actors capabilities they didn't have. Vendor framing deserves a grain of salt, but the CISA portion doesn't lean on AppGate. The PLC and alarm details come from the agency's own threat-hunting operations.

The quiet implication is that alarm-based detection is now a known point of failure. If an adversary disables alarms to hide the intrusion, the SOC's first signal may be a physical failure rather than an alert. Scott Bowman of Idaho National Laboratory added a second gap: engineering and cyber teams still talk past each other about which controllers and SCADA systems actually matter. In healthcare, HHS official Brian Mazanec put the stakes in numbers: the average hospital runs roughly 26,000 connected devices, more than half with critical unpatched risks. None of that resolves with a slide deck; it resolves with an asset inventory that starts at the PLC.