The Evidence Pack: How Defenders Are Neutralizing Nation-State Malware in US Energy and Water Systems

For decades, the primary objective of nation-state cyber operations was espionage: the quiet extraction of intellectual property, diplomatic cables, and defense secrets. But the paradigm has shifted. Today, the most acute cyber threats facing the United States and its allies do not seek to steal data; they seek to manipulate the physical world. The targets are the operational technology (OT) networks that control municipal water purification, regional power grids, and maritime ports.[5][7]

This shift from digital theft to physical disruption has prompted an unprecedented response from federal defenders and private threat intelligence firms. By declassifying forensic evidence and publishing detailed behavioral signatures, agencies like the Cybersecurity and Infrastructure Security Agency (CISA) are mathematically flipping the advantage back to defenders. This Evidence Pack examines the primary sources documenting how two distinct threat actors—China’s Volt Typhoon and Russia’s Sandworm—operate, and how their pre-positioned malware is being actively hunted and neutralized.[1][7]

The first major claim established by the intelligence community is that China’s Volt Typhoon campaign is designed for strategic pre-positioning rather than immediate sabotage. According to a joint advisory from CISA, the NSA, and the FBI, Volt Typhoon has successfully infiltrated the IT networks of multiple critical infrastructure organizations, primarily in the communications, energy, and water sectors. The evidence indicates that the group's objective is to establish dormant access that could be activated to disrupt U.S. military mobilization during a future geopolitical crisis, such as a conflict over Taiwan.[1][5]

The evidence supporting this assessment comes from the specific tactics Volt Typhoon employs. Forensic analysis reveals that the group relies heavily on "Living off the Land" (LOTL) techniques. Instead of deploying custom, easily identifiable malware, the attackers use built-in Windows administrative tools—like PowerShell and Windows Management Instrumentation (WMI)—to move laterally across networks. Because these tools are used daily by legitimate system administrators, the malicious activity blends seamlessly into normal network traffic, making detection via traditional signature-based antivirus software nearly impossible.[1][7]

While Volt Typhoon plays a long game of stealth, the evidence surrounding Russia’s premier cyber sabotage unit, Sandworm (recently redesignated as APT44 by Mandiant), points to a fundamentally different intent: active, physical disruption. Sandworm, attributed to the GRU’s Unit 74455, has a documented ten-year history of deploying destructive wiper malware and OT-native payloads against civilian infrastructure, most notably causing power blackouts in Ukraine in 2015 and 2016.[2][3]

Recent threat intelligence reports confirm that Sandworm’s operations have expanded beyond Eastern Europe. Security firm Nozomi Networks documented instances where Sandworm leveraged unresolved IT compromises to pivot directly into OT environments. In one campaign, the group targeted hundreds of engineering workstations and Human-Machine Interfaces (HMIs). Unlike financially motivated ransomware gangs, Sandworm utilizes industrial protocols like Modbus and IEC 104 to directly manipulate physical equipment, demonstrating a clear willingness to cause real-world harm.[3]

The mechanism of these attacks almost universally relies on bridging the "air gap" between a facility's enterprise IT network (used for email and billing) and its OT network (used for controlling valves, pumps, and breakers). Threat actors typically exploit a vulnerability in an internet-facing edge device, such as a VPN or firewall, to gain an initial foothold in the IT environment. From there, they harvest credentials and search for misconfigured firewalls or shared active directories that allow them to cross into the OT network.[4][7]

The evidence also highlights a critical vulnerability in the water and wastewater sector. A comprehensive threat report by DomainTools tracked multiple incidents between 2024 and 2026 where nation-state actors and aligned hacktivists exploited internet-exposed Programmable Logic Controllers (PLCs). In one notable case in Texas, attackers accessed a remote industrial interface and caused a municipal water tank to overflow. These incidents underscore that even unsophisticated attacks can achieve physical consequences if OT devices are left exposed to the public internet.[4]

Despite the severity of these threats, the evidence shows that the defensive posture of U.S. critical infrastructure is rapidly maturing. The strategy has shifted from an outdated reliance on perimeter defense to an "assumed breach" mentality. CISA’s recent "CI Fortify" initiative explicitly directs infrastructure operators to practice maintaining essential services in a degraded state. The core directive is resilience: ensuring that when an IT network is compromised, the physical processes can be isolated and operated manually.[6]

To counter the stealth of LOTL techniques, defenders are increasingly deploying behavior-based anomaly detection. By establishing a mathematical baseline of normal network activity, AI-driven security platforms can flag when a legitimate administrative tool is being used in an anomalous way—such as a PowerShell script executing at 3:00 AM to query a domain controller. This approach turns the attackers' reliance on native tools into a detectable behavioral signature.[7]

Furthermore, the U.S. government has adopted a strategy of aggressive, public attribution. By publishing detailed Indicators of Compromise (IOCs) and the specific vulnerabilities being exploited, federal agencies are effectively burning the adversaries' infrastructure faster than it can be rebuilt. The EPA has also stepped up its regulatory and support role, distributing alerts to over 60,000 water systems and coordinating cybersecurity assistance for facilities that support defense-critical operations.[1][4]

The evidence pack ultimately reveals a landscape defined by persistent friction rather than imminent catastrophe. While the pre-positioning of malware by highly capable nation-states is a severe strategic threat, it is not an insurmountable one. By enforcing strict network segmentation, patching edge devices, and maintaining the capability for manual operational overrides, infrastructure defenders are systematically dismantling the leverage these adversaries seek to build.[5][7]