Last month, six federal agencies jointly issued Advisory AA26-097A, confirming active exploitation of internet-exposed industrial control systems (ICS) across U.S. critical infrastructure. Threat actors logged into programmable logic controllers using legitimate engineering software, tampered with configuration files, and manipulated operator displays — causing measurable operational disruption and financial loss. On its face, the advisory targets bulk power assets covered by
