This is a series of links to background information on specific OT/ICS Cyber Incidents. Up to date as of August 2026.
UK Power Plant Incident (2026)
US Water and Wastewater Systems Sector Incident (2026)
- SecurityWeek | CISA: Over 100 Internet-Exposed Water Systems Targeted in July Cyberattacks | 26 Aug 26
- CISA | CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs | 30 Jul 26
Polish Energy Sector Incident (2025)
- ESET Research | Sandworm behind cyberattack on Poland’s power grid in late 2025
- Dragos | ELECTRUM: Cyber Attack on Poland’s Electric System | 2025
- CERT Polska | Energy Sector Incident Report – 29 December 2025
- CERT Polska | Follow-Up Report of the December 2025 Energy Sector Incident | 08 August 2026
Norwegian Dam Incident (2025)
- The Guardian | Russian hackers seized control of Norwegian dam, spy chief says | 14 Aug 25
- Cybernews | Russia hacked Norwegian dam, PST says | 13 Aug 25
- Security Daily Review | Norway Attributes Dam Cyberattack to Russian Hackers | 22 Aug 25
- CCDCOE | Cyber incident against the Bremanger dam in Norway (2025) – International cyber law: interactive toolkit
FrostyGoop (2024)
- Unit42 | FrostyGoop’s Zoom-In: A Closer Look into the Malware Artifacts, Behaviors and Network Communications | 19 Nov 24
- SANS Institute | What’s the Scoop on FrostyGoop: The Latest ICS Malware and ICS Controls Considerations | 09 Aug 24
- Nozomi Networks Labs | Protecting OT Systems Against FrostyGoop/BUSTLEBERM Malware | 24 Jul 24
- Dragos | Protect Against the FrostyGoop ICS Malware Threat with OT Cybersecurity Basics | 23 Jul 24
- Dragos | Impact of FrostyGoop ICS Malware on Connected OT Systems | Jul 24
Fuxnet (2024)
- Dragos | Strategic Overview of the Fuxnet Malware | May 24
- Claroty | Unpacking the Blackjack Group’s Fuxnet Malware | 12 Apr 24
Unitronics Attack / CyberAv3ngers (2023)
- CISA | IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including US Water and Wastewater Systems Facilities | 18 Dec 24
- Claroty | From Exploits to Forensics: Unraveling the Unitronics Attack | 07 Aug 24
- Dragos | Crossing the Rubicon: Hacktivist Intrusions Against Israeli-Made OT | 14 Dec 23
Danish Critical Infrastructure Attack (2023)
Ukraine Electric Power Attack (2022)
- Dragos | ELECTRUM Targeted Ukrainian Electric Entity Using Custom Tools and CaddyWiper Malware, October 2022 | 11 Dec 23
- Mandiant | Sandworm Disrupts Power in Ukraine Using a Novel Attack Against Operational Technology | 09 Nov 23
Iranian Steel Mill / Predatory Sparrow (2022)
Industroyer2 (2022)
- Mandiant | INDUSTROYER.V2: Old Malware Learns New Tricks | Mandiant | 25 Apr 25
- ESET | Industroyer2: Industroyer reloaded | 12 Apr 22
INCONTROLLER / PIPEDREAM (2022)
- S4 | INCONTROLLER – YouTube | 06 Sep 22
- CISA | APT Cyber Tools Targeting ICS/SCADA Devices | 25 May 22
- SANS ICS Security | PIPEDREAM and Countering ICS Malware Webcast – YouTube | 18 May 22
- S4 | PIPEDREAM – Most Flexible & Capable ICS Malware To Date – YouTube | 02 May 22)
- Dragos | CHERNOVITE’s PIPEDREAM Targeting Industrial Control Systems | 13 Apr 22
- Mandiant | INCONTROLLER: New State-Sponsored Cyber Attack Tools Target Multiple ICS | 13 Apr 22
COSMICENERGY (2021)
- Mandiant | COSMICENERGY: New OT Malware Possibly Related To Russian Emergency Response Exercises | 25 May 2023
- Dragos | COSMICENERGY – Not an Immediate Threat | Jun 23
TRITON/TRISIS/HatMan (2017)
- CISA | HatMan – Safety System Targeted Malware (Update B) | 27 Feb 19
- Nozomi Networks | TRITON: The First ICS Cyberattack on Safety Instrument Systems | 08 Aug 18
- WIRED | Triton Malware Targets Industrial Safety Systems In the Middle East | 14 Dec 17
- Mandiant | TRITON Malware | Attackers Deploy New ICS Attack Framework | 14 Dec 17
- CCDCOE | Triton (2017) – International cyber law: interactive toolkit
CRASHOVERRIDE / Industroyer (2016)
- CISA | CrashOverride Malware | 20 Jul 21
- Book | Sandworm: A New Era of Cyberwar and the Hunt for the Kremlin’s Most Dangerous Hackers | 20 Oct 20
- CISA | CRASHOVERRIDE Malware | 25 Jul 17
- Dragos | CRASHOVERRIDE: Analyzing the Malware that Attacks Power Grids | 12 Jun 17
- WIRED | Crash Override Malware Took Down Ukraine’s Power Grid Last December | 12 Jun 17
- ESET | Industroyer: Biggest threat to industrial control systems since Stuxnet | 12 Jun 17
- CCDCOE | Industroyer – Crash Override (2016) – International cyber law: interactive toolkit
BlackEnergy (2015)
- CISA | Cyber-Attack Against Ukrainian Critical Infrastructure | 20 Jul 21
- Book | Sandworm: A New Era of Cyberwar and the Hunt for the Kremlin’s Most Dangerous Hackers | 20 Oct 20
- ISA | Ukrainian power grids cyberattack – A forensic analysis based on ISA/IEC 62443 | Apr 17
- WIRED | Everything We Know About Ukraine’s Power Plant Hack | 28 Jan 16
- Booz Allen Hamilton | When the Lights Went Out | Sep 16
- SANS Industrial | Confirmation of a Coordinated Attack on the Ukrainian Power Grid | 06 Jan 16
- CCDCOE | Power grid cyberattack in Ukraine (2015) – International cyber law: interactive toolkit
German Steel Mill Incident (2014)
- SecurityWeek | Cyberattack on German Steel Plant Caused Significant Damage: | 18 Dec 14
- WIRED | A Cyberattack Has Caused Confirmed Physical Damage for the Second Time Ever | 08 Jan 15
- CCDCOE | Steel mill in Germany (2014) – International cyber law: interactive toolkit
Havex (2013)
- CISA | ICS Focused Malware (Update A) | 22 Aug 18
- GIAC | The Impact of Dragonfly Malware on Industrial Control Systems | 18 Jan 16
- Palo Alto Networks | Threat Mitigation for Havex, DragonFly and Variants | 10 Jul 14
- F-Secure Labs | Havex Hunts for ICS/SCADA Systems | 23 Jun 14
Stuxnet (2010)
- Gov | Fully Operational: Stuxnet 15 Years Later and the Evolution of Cyber Threats to Critical Infrastructure | 22 Jul 25
- Gov | Fully Operational Stuxnet 15 Years Later & the Evolution of Cyber Threats to Critical Infrastructure – YouTube | 22 Jul 25
- S4 | Langner’s Stuxnet Deep Dive – YouTube | 18 Jun 16
- Book | Countdown to Zero Day: Stuxnet and the Launch of the World’s First Digital Weapon | 01 Sep 15
- CCDCOE | Stuxnet (2010) – International cyber law: interactive toolkit
Fast16 (2005)
- SentinelOne | fast16 Mystery Shadow Brokers Reference Reveals High-Precision Software Sabotage 5 Years Before Stuxnet | 23 Apr 26
- WIRED | Newly Deciphered Sabotage Malware May Have Targeted Iran’s Nuclear Program—and Predates Stuxnet | 23 Apr 26
- The Hacker News | Researchers Uncover Pre-Stuxnet ‘fast16’ Malware Targeting Engineering Software | 25 Apr 26
- Dark Reading | 20-Year-Old Malware Rewrites History of Cyber Sabotage | 27 Apr 26