Scale and Timing (ST)

Taxonomies › Critical Infrastructure › ST · Scale and Timing

Many sites at once, at a moment the adversary chooses, and the small strikes that test the mechanism first. Part of The Campaign deck, ranked Ace to 2 by severity in the game. This page is part of the Critical Infrastructure (Cyberwarfare) Threat Taxonomy, the reference for the Black Start card game.

Mappings at a glance

STRIDE, CAPEC 3.9, CWE 5.0, ATT&CK for ICS v20.0, the Cyber-Informed Engineering principles (main one first) and standards, entry by entry. The same mappings are in each entry below and in the Excel, SKOS and STIX downloads.

Entries

BKS-ST-A · Several sectors hit at once †

Plans assume one sector fails while the others support it. An adversary who strikes power, water, telecoms and food distribution together removes the help each relies on: generators without fuel deliveries, pumps without power, responders without phones.

Principle. Resilience plans must be tested against the simultaneous loss of the other sectors they depend on.

Design measures.

1. Exercise incident plans with power, telecoms and fuel supply lost together, not one at a time.
2. Agree priorities and contact routes with other sectors’ operators in advance, through channels that work without the public network.
3. Hold enough local stock of fuel, chemicals and spares to operate for the time a combined outage would take to clear.

Mappings: STRIDE D · ATT&CK for ICS T0826 · CIE 7, 10

BKS-ST-K · Timed for the worst moment †

Attacks can be held until conditions make loss most harmful: deep winter, a heatwave, peak demand, a holiday or the start of a military crisis. A loss that would be an inconvenience in spring becomes a risk to life, and response capacity is already stretched.

Case: FrostyGoop, Lviv, 2024; Ukraine grid attack, 2015.

Principle. Design and recovery targets must be set for the worst season and moment, not the average one.

Design measures.

1. Set recovery time objectives for the worst conditions, such as hours to restore heat in sub-zero weather.
2. Raise monitoring and staffing levels during known high-risk periods and periods of political tension.
3. Keep manual and local fallback capacity sized for peak demand, not average load.

Mappings: STRIDE D · ATT&CK for ICS T0826, T0813 · CIE 1, 10

BKS-ST-Q · One technique fits every site †

Hundreds of sites run the same controller model, firmware, configuration and default accounts. One technique that works at one site works at all of them, so the adversary can turn a single finding into a national event in a single night.

Case: Supermarket refrigeration attacks, 2026; Viasat KA-SAT modems, 2022; Danish energy sector, 2023.

Principle. No single weakness should be able to affect more sites than the operator can recover at once.

Design measures.

1. Vary credentials, keys and network paths per site so access to one site does not grant access to the rest.
2. Know which sites share each model and firmware, and size response plans for all of them failing together.
3. Introduce diversity in controllers or protection for the most critical sites, so one flaw cannot reach every site.

Mappings: STRIDE E, D · CWE-1392 · ATT&CK for ICS T1694.001, T0883 · CIE 7, 4

BKS-ST-J · A rehearsal that tests the mechanism

A limited strike, on one sector or one night, tests that access, controls and timing work at scale and measures how fast operators and governments respond. It also sends a message about what could follow. Treated as a one-off incident, it gives the adversary its rehearsal for free.

Case: Supermarket refrigeration attacks, 2026; Bremanger dam, Norway, 2025.

Principle. A limited attack must be treated as evidence of a wider capability and trigger checks across the whole estate.

Design measures.

1. After any incident affecting several sites, review every site that shares its platforms, vendors or design, not just those affected.
2. Share technical indicators quickly with sector peers and national authorities, across borders where operators span countries.
3. Assume the adversary learned the response timeline, and change procedures, contacts and fallback plans afterwards.

Mappings: STRIDE I, D · ATT&CK for ICS T0888, T0826 · CIE 6, 7, 12

BKS-ST-10 · Cyber attack paired with physical sabotage †

A cyber attack can be coordinated with cut cables, drones over sites, arson or staged threats, so responders face both at once. Plans that assume an attack is either digital or physical send people to the wrong place and leave the other side undefended.

Principle. Incident plans must cover combined cyber and physical attacks, with one picture of both.

Design measures.

1. Bring physical security alarms and OT security monitoring into the same incident picture.
2. Exercise scenarios where site access is unsafe at the moment a cyber response needs someone on site.
3. Protect the routes that a cyber recovery depends on, such as fibre ducts, radio masts and depots.

Mappings: STRIDE D · CAPEC-547 · ATT&CK for ICS T0826 · CIE 10, 7

BKS-ST-9 · Struck when nobody is on site †

Attacks can be timed for nights, weekends and holidays, when sites are unstaffed, monitoring is thin and decisions wait for someone senior. Effects that would be stopped in minutes during the day run for hours before anyone acts.

Case: Supermarket refrigeration attacks, 2026.

Principle. Protection and response must work as well at 03:00 on a Sunday as at noon on a weekday.

Design measures.

1. Put automatic limits in controllers that stop harmful conditions without waiting for a person to respond.
2. Staff or contract out-of-hours monitoring with authority to isolate sites without escalation.
3. Alarm on remote commands and configuration changes outside working hours by default.

Mappings: STRIDE D · ATT&CK for ICS T0831, T0836 · CIE 2, 6

BKS-ST-8 · Waves that exhaust responders

An adversary can strike in waves over days or weeks, each before the last is cleared. Engineers, vendor field staff, spare parts and decision makers run out, and fixes are rushed and incomplete, which leaves openings for the next wave.

Case: DDoS on US banks, 2011 to 2013.

Principle. Response capacity must be planned for a campaign lasting weeks, not one incident.

Design measures.

1. Plan staffing rotations and mutual aid for an incident lasting weeks, with named people in each shift.
2. Keep pre-agreed surge capacity with vendors and integrators, with priority set by consequence, not contract value.
3. Track remediation completeness, so rushed fixes are rechecked before the next wave.

Mappings: STRIDE D · ATT&CK for ICS T0826, T0828 · CIE 10, 12

BKS-ST-7 · Logic set to fire unattended †

Schedules, automation rules and timers can be planted in management platforms and building or site controllers, to act at a set time or condition without the adversary connected. The effect happens even if access is cut when a conflict starts, so network isolation after the fact does not stop it.

Principle. The estate must be checked for planted logic before a crisis, not after its effect.

Design measures.

1. Compare controller logic and platform schedules with approved baselines regularly, and investigate any unexplained timer or condition.
2. Review scheduled jobs and automation rules on management platforms as part of change control.
3. Prefer simple controller logic that engineers can review in full.

Mappings: STRIDE T · CAPEC-441 · CWE-511, CWE-506 · ATT&CK for ICS T0821, T0889 · CIE 4, 6

BKS-ST-6 · Operators that span borders

Multinational chains, grid interconnections and shared platforms run sites in several countries from one place. One action hits several states at once, while incident response is split between national authorities, regulators and legal regimes that do not share information quickly.

Principle. Cross-border operations need incident response arrangements that work across the borders they span.

Design measures.

1. Agree in advance which national authorities are informed of an incident affecting several countries, and how quickly.
2. Segment platforms by country so one compromise cannot act on every country at once.
3. Exercise cross-border incidents with the operating companies and authorities involved.

Mappings: STRIDE D · ATT&CK for ICS T0826 · CIE 7, 10

BKS-ST-5 · Small sites attacked in bulk †

Thousands of small water systems, pump stations, farms and shops have internet-exposed controllers, default passwords and no security staff. Each looks too small to matter, but attacked together they cause a widespread loss of service and a loss of public confidence.

Case: Unitronics PLCs at water utilities, 2023; Texas water systems, 2024; Bremanger dam, Norway, 2025.

Principle. Security for small sites must come from the design and the vendor, not from staff the site does not have.

Design measures.

1. Ship devices that refuse to run with default credentials and are not reachable from the internet by default.
2. Offer small operators a managed, monitored remote access service instead of direct exposure.
3. Give regulators and sector bodies a way to find and notify exposed small sites.

Mappings: STRIDE E, D · CWE-1393, CWE-1188 · ATT&CK for ICS T0883, T1694.001 · CIE 4, 9

BKS-ST-4 · Effect long after the cause

The harmful change can be made weeks before its effect, through slow drift or a timed change. Investigators look in the wrong window, logs have rolled over, and the cause is never found, so the same access is used again.

Principle. Records of changes must last longer than the time an adversary might wait.

Design measures.

1. Retain configuration and command history for at least a year, off the systems it describes.
2. Investigate incidents against the full change history of affected devices, not just the hours before.
3. Keep periodic configuration snapshots so the date of a change can be found.

Mappings: STRIDE R · CAPEC-268 · CWE-778 · ATT&CK for ICS T0872 · CIE 6, 11

BKS-ST-3 · Timed to a political decision

Strikes follow a vote, a sanctions package, an arms delivery or a summit, so cause and message are linked in the public mind. Operators that do not follow the political calendar meet those days at normal readiness, with remote access open and the duty team at its thinnest.

Principle. Readiness should rise with political risk, not only with technical warnings.

Design measures.

1. Link government advisories and threat intelligence to defined readiness levels with set actions.
2. Raise posture around known trigger dates: more monitoring, remote access restricted, staff on call.
3. Agree in advance with the authorities how heightened alerts reach the operator and what they ask for.

Mappings: STRIDE D · CIE 6, 12

BKS-ST-2 · A decoy draws the responders away

A loud incident on one site, one sector or the corporate IT network takes up the responders, the vendor’s support and management’s attention. Meanwhile the real effect is prepared quietly elsewhere, against a team with nobody left to look.

Principle. Incident response must keep capacity in reserve and treat a loud incident as a possible diversion.

Design measures.

1. Keep a reserve team, or a duty to hunt elsewhere, that is never assigned to the visible incident.
2. During any major incident, check OT and other sites for quiet changes at the same time.
3. Agree with vendors and retained responders how support is prioritised when several incidents run at once.

Mappings: STRIDE D · CIE 6, 12

Public cases cited in this suit

• FrostyGoop, Lviv, 2024. In January 2024 malware sent Modbus commands to heating controllers of a district heating company in Lviv, Ukraine; more than 600 apartment buildings were without heating for nearly two days in sub-zero temperatures. Attribution: Unattributed (Dragos did not attribute it). Sources: Dragos intelligence brief: FrostyGoop; Axios: a malware strain threatening critical services
• Ukraine grid attack, 2015. On 23 December 2015 attackers used three Ukrainian distribution companies’ own control systems to open breakers, cutting power to about 225,000 customers. They also overwrote firmware on serial-to-Ethernet converters, wiped systems with KillDisk, tampered with backup power and flooded call centres with calls. Attribution: Attributed by the US Department of Justice (2020 indictment) to Russia’s GRU Unit 74455 (Sandworm). Sources: CISA ICS alert IR-ALERT-H-16-056-01; MITRE ATT&CK campaign C0028
• Supermarket refrigeration attacks, 2026. Overnight on 11 to 12 October 2026 attackers forced the remote-managed refrigeration controllers of hundreds of French supermarkets into defrost, heating cabinets to as much as 50C; stock was destroyed and some equipment caught fire. CERT-FR told operators to disconnect the controllers or tightly filter access to them. A second wave on 2 November hit supermarkets and food businesses in Sweden, Belgium, Ireland, Luxembourg, Estonia and Italy, and five Danish companies, where the attacks were stopped quickly. Danfoss confirmed its products were involved, and France’s cyber agency judged the campaign probably still under way. Attribution: Unattributed at time of writing; Paris prosecutor’s investigation open. Sources: The Hacker News: attackers heat French supermarket fridges; BleepingComputer: cyberattack shuts down refrigerators at French supermarkets; DR: what we know about the attacks on European supermarkets; Today.it: attacks on refrigeration in Italy, ACN alert
• Viasat KA-SAT modems, 2022. As Russia invaded Ukraine on 24 February 2022, the AcidRain wiper bricked tens of thousands of KA-SAT satellite modems across Europe; about 5,800 Enercon wind turbines in Germany lost remote monitoring and control, and many modems had to be replaced. Attribution: Attributed by the EU, UK and US governments (May 2022) to Russia. Sources: DatacenterDynamics: satellite outage impacts more than 5,000 wind turbines; energate: Enercon, thousands of wind turbines need new hardware
• Danish energy sector, 2023. In May 2023 attackers compromised 22 Danish energy companies in coordinated waves through flaws in the firewalls that protected them, the largest such attack Denmark had seen. Attribution: Unattributed; SektorCERT saw indicators linked to Sandworm in at least one attack, which other researchers later questioned. Sources: SecurityWeek: 22 energy firms hacked in Denmark; SecurityWeek: Russian hackers likely not involved
• Bremanger dam, Norway, 2025. In April 2025 an attacker reached the control system of a dam at Bremanger, Norway, and set the outflow valve to open; it ran for about four hours before staff noticed and reversed it. Attribution: Attributed by Norway’s security service (PST) to pro-Russian hackers. Sources: BleepingComputer: pro-Russian hackers blamed for dam sabotage in Norway
• DDoS on US banks, 2011 to 2013. Between late 2011 and mid-2013 a campaign of denial-of-service attacks, coming in waves most weeks, hit 46 US financial institutions over 176 days, leaving hundreds of thousands of customers unable to reach their accounts online. Attribution: Attributed by the US Department of Justice (2016 indictment) to seven Iranians working for companies acting for the Iranian government, including the IRGC. Sources: US Attorney General remarks on the indictment (24 March 2016); BankInfoSecurity: 7 Iranians indicted for DDoS attacks against US banks
• Unitronics PLCs at water utilities, 2023. From November 2023 attackers defaced internet-exposed Unitronics PLCs at the Municipal Water Authority of Aliquippa and other US sites, getting in with the default password; the Aliquippa booster station was run by hand. Attribution: Attributed by CISA, FBI and partners to CyberAv3ngers, affiliated with Iran’s IRGC. Sources: Industrial Cyber: US, Israeli agencies warn of IRGC activity using OT devices; The Register: Iran-linked attacks on US water
• Texas water systems, 2024. In January 2024 a group calling itself the Cyber Army of Russia Reborn claimed interference with water systems in small Texas towns; a tank in Muleshoe overflowed before staff took the system offline. Attribution: Mandiant assessed links to Sandworm (APT44); the US Treasury sanctioned two of the group’s members in July 2024. Sources: CyberScoop: Sandworm linked to Texas water facility; Treasury sanctions leader and primary member of the Cyber Army of Russia Reborn (19 July 2024)

© 2026 Jonathan Brett Crawley. Licensed under CC BY-NC-ND 4.0 with additional permissions: see the licence on the overview. † marks a physical-safety consequence.