In late August, The Telegraph reported that a cyberattack attributed to Iran-linked hackers had forced a British power plant offline for four days in July. The U.K. government confirmed the incident to The Register, describing the site only as a ‘small-scale energy generator’ and stressing that the wider energy system was never at risk. Five days earlier, the FBI, CISA, and HHS had updated their joint advisory on Medusa ransomware, putting the group’s victim count above 500 organizations. A week before that, an Israeli security firm published a forensic reconstruction of a four-day intrusion into Taiwanese government networks run almost entirely by open source AI agents.
I covered all three on this week’s episode of CyberSecureOT, and the primary sources converge on one argument. None of these adversaries needed an exotic exploit. They needed a stolen credential, an exposed interface, or an unauthenticated API, and a network flat enough to let them keep going. That is an architecture problem, and it is the one I want to work through here.
A small generator, a big demonstration
Start with what is actually known about the U.K. incident, because the on-air chatter, including some of my own, ran ahead of the evidence. According to the government’s statements and the reporting that followed, the plant was small enough that a four-day outage had no measurable effect on power generation. The facility has not been named. The incident was reported to the National Cyber Security Centre, which by policy does not comment on individual cases, and energy minister Michael Shanks said his department briefed energy company chief executives and issued written guidance afterward. Attribution to Iran-affiliated actors rests on press reporting rather than a formal government statement, and no technical details about the intrusion path have been released.
What the NCSC did say, five days after the story broke, is telling. In a warning covered by Industrial Cyber, the agency reported increased targeting of OT systems in the UK and elsewhere by a range of threat actors, resulting in ‘some limited real-world disruption,’ and told operators not to assume their OT is unreachable from the internet without verifying it. PLCs and HMIs, the agency said, should never be directly exposed. The U.S. CISA published parallel guidance on internet exposure reduction the day before.
I do not know how the attackers got in. What I do know is how Iran-linked operators have reached industrial equipment before. The CyberAv3ngers campaign against Unitronics controllers in late 2023 and this summer’s intrusions into U.S. water utilities, which exploited exposed PLCs and remote access across at least seven states, hit devices reachable from the internet with default or weak credentials. Nation states do not spend zero days on doors that are already open. So, my working assumption is that the U.K. generator’s exposure looked more like an internet-facing HMI or remote access portal than a Stuxnet-class operation. That is an assumption, not a finding.
The lesson does not depend on the entry vector. A small generator is exactly the kind of site where an OT-aware firewall sits behind a 12 to 18 month hardware lead time, where remote monitoring was installed for a vendor’s convenience, and where a four-day recovery shows how few people can bring the process back safely once the control layer is compromised. Whoever did this, got international headlines and a ministerial briefing for a few weeks of reconnaissance. That return on investment is the real signal.
Medusa industrialized the same playbook
The Medusa update makes the same case from the criminal side. The advisory, revised August 18 with FBI findings through April 2026, describes a ransomware-as-a-service operation first identified in June 2021 that moved to an affiliate model in early 2023. Its victim count rose from more than 300 in the March 2025 original to more than 500 in just over a year, across healthcare, the defense industrial base, critical manufacturing, government services, IT, and financial services. HHS joined as a co-author because of the group’s focus on hospitals. The Record reported that Medusa claimed the April attack on the University of Mississippi Medical Center, the state’s only Level I trauma center and only children’s hospital.
What the advisory does not describe is technical novelty. Medusa pays initial access brokers between $100 and $1 million for network access and exploits newly disclosed vulnerabilities within 24 hours, sometimes a week before public disclosure, though the agencies found no indication it develops its own zero days. Once inside, according to the advisory, operators dump credentials with Minidump, obfuscate PowerShell and delete their command history, hide tools in folders Windows Defender already excludes from scanning, and move laterally over legitimate remote access software including AnyDesk, ConnectWise, SimpleHelp, and Splashtop. ConnectWise contributed to the advisory, which tells you which tools show up in the telemetry. The FBI also notes that this Medusa is unrelated to MedusaLocker and the Medusa mobile malware.
On the episode, I dramatized a Medusa-style intrusion at a fictional operator: an affiliate buys VPN credentials, dumps LSASS memory through a native Windows DLL, pivots over the company’s own remote management platform toward the OT DMZ, and stages an exfiltration tool in a folder the antivirus was told to ignore. The scenario was invented for effect, but every technique is drawn from the living-off-the-land pattern the advisory documents. It makes a blind spot visible: most asset owners apply controls to OT systems without asking how their own IT administration tooling becomes the attacker’s weapon. If a receptionist’s workstation and a historian server share a path to the domain controller, an initial access broker has already sold the OT network without knowing it.
Taiwan shows what automation does to the timeline
The third development changes the speed of everything above. On August 12, Dream Security published its analysis of a 160-megabyte workspace archive of 1,395 files that an attacker had left exposed online. It documented a framework built on two open-source agent projects, Hermes and OpenClaw, running up to eight sub-agents in parallel across 12 attack waves between July 1 and July 4. The Financial Times identified the target as Taiwan, and Taiwan’s Ministry of Digital Affairs confirmed it had detected an AI agent-assisted attack on government agencies during that period. Dream’s researchers said the operational documentation pointed to a Chinese-language operator but stopped short of formal attribution.
The reported results are concrete. The agents mapped 21 government systems from a single portal, found unauthenticated API endpoints, solved CAPTCHAs, cracked 85 accounts by password spraying, exfiltrated more than 2,500 personnel records, and installed persistent backdoors. When a route was blocked, the framework tasked another agent to research an alternative rather than waiting for a human. It then expanded to IT supply chain vendors, a nuclear safety agency, a government email system, and at least seven energy companies, scanning them in parallel for misconfigurations and exposed administrative interfaces.
Two details deserve emphasis for OT readers, and one caveat. The operators did not jailbreak anything; Dream reported they bypassed the frameworks’ guardrails simply by describing the campaign as authorized penetration testing. No zero-day appears anywhere in the report. The agents won with reconnaissance, weak passwords, and unauthenticated endpoints, the same basics Medusa and the Iran-linked actors rely on, at machine speed. The caveat is that the public record describes scanning of energy companies and a regulator, not confirmed manipulation of control systems.
The reach into that sector is still what worries me, and the US government has already documented the next step. On August 19, CISA, NSA, FBI, DOE, and EPA warned that threat actors are using AI-generated exploitation scripts, disguised as monitoring tools, against internet-exposed Siemens S7 PLCs found through scanning services and accessed with default or weak credentials. The agencies assessed the activity as reconnaissance aimed at building attack capability against critical infrastructure. Put the two reports side by side, and the picture is clear: an agent that can run learning cycles against vulnerability databases does not need a human to teach it Modbus, and on a flat network the step from an exposed admin interface to an engineering workstation is short.
Segmentation is the control that survives all three
Every one of these campaigns was decided after initial access, which is why I keep coming back to OT network segmentation as the unglamorous control that changes outcomes. The Medusa advisory pairs edge hardening with internal segmentation because a purchased foothold should not become a paved road to the domain controller and the OT environment.
The NCSC’s guidance calls for segmenting management networks, control systems, and business IT by function and criticality. The Taiwan reconstruction shows an adversary that finds unauthenticated paths faster than a three-person security team can inventory them. The UK generator shows what a four-day recovery costs when the control layer goes down.
I hear the objection every time I raise this with a client: segmentation breaks the legacy application from 1998. That is a real cost, and it is smaller than the alternative. As my AI co-host put it on the show, ‘the problem isn’t just the nation state. The problem is the architecture.’
So here is what I would watch. Whether the U.K. government or the NCSC releases enough technical detail to confirm the generator’s entry vector. Whether the gap between ‘exploited within 24 hours’ and the patch windows OT operators can realistically hit gets narrower. And whether the open source agent community treats consent-based guardrails as the design flaw Dream’s report shows them to be. In the meantime, assume the credential is already sold, assume the agent is already scanning, and make sure the path from the IT edge to the PLC has a door on it.
I get into all of this in more depth on this week’s episode of CyberSecureOT.
