Loading story…
US intelligence agencies have warned that civilian infrastructure, particularly airports, represents a significant vulnerability for US military mobilization in the event of conflict with China. Civilian airport operational technology (OT) systems—including baggage carousels, security scanners, reservation systems, and runway lighting—are often poorly secured and could be targeted by foreign adversaries to disrupt troop movements and logistics. The potential impact of such attacks was highlighted by a ransomware incident at Seattle-Tacoma International Airport, which affected baggage handling and related services, demonstrating the cascading effects a cyberattack on airport OT can have on national aviation operations.
Military planners are increasingly concerned that, during a crisis, adversaries could exploit these weaknesses to launch cyberattacks on interconnected IT and OT systems at transportation hubs, thereby hindering the rapid deployment of US forces. The reliance on civilian infrastructure for military logistics underscores the urgent need for improved security and resilience in airport OT environments to mitigate the risk of disruption from state-sponsored cyber threats, particularly those attributed to China.
See the actors and campaigns active against you right now.
1 event from the most recent confirmed update back to the earliest known activity.
BankInfoSecurity and GovInfoSecurity published a report examining civilian airport operational technology as a potential soft underbelly for the U.S. military. No additional incident details, dates, or discrete underlying events are provided in the reference content.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Claroty researchers have warned that global conflicts, civil unrest, and tariff wars are significantly increasing the risks facing cyber-physical systems, particularly those underpinning critical infrastructure and operational technology (OT). According to the Global State of CPS Security 2025 report, attackers are expected to exploit vulnerabilities introduced by disrupted supply chains, with predictions that at least one major cyber-physical breach will occur within the next year. The instability in sourcing, manufacturing, and delivery of hardware and software components—driven by geopolitical tensions—has forced organizations to rely on new or less-vetted vendors, heightening the risk of unknown vulnerabilities in OT, building management, and healthcare systems. Experts emphasize that changes in supply chain geography and sourcing, often resulting from trade restrictions and sanctions, can undermine the integrity and security of critical systems. The report, based on a global survey of 1,100 cybersecurity professionals, highlights the urgent need for organizations to reassess their risk management strategies and strengthen supply chain security to mitigate the evolving threat landscape. The convergence of geopolitical instability and fragile supply chains is creating new opportunities for cyber adversaries to target essential infrastructure worldwide.
Jun 29, 2026
CISA officials warned that a military confrontation with a peer adversary such as **Russia or China** would likely bring successful cyberattacks against U.S. critical infrastructure, causing severe disruptions across **water, power, healthcare, law enforcement, and parts of banking**. Agency leaders said operators should expect to lose reliable internet access, third-party and vendor connections, and some **SCADA** functionality, and should plan to continue delivering essential services in a degraded state rather than relying solely on traditional cyber hygiene measures. To support that shift, CISA is prioritizing operational resilience through its **CI Fortify** initiative, redirecting OT resources to conduct **75 to 100 assessments** over the next year and expand emergency planning guidance across sectors. Officials called for "ruthless prioritization" during crises, including decisions on which facilities receive limited water or power, while the EPA is preparing a national cybersecurity exercise for the water sector to test operations without supervisory control and data acquisition technology; CISA also warned that prolonged cyber-induced outages could erode public trust more sharply than natural disaster recovery delays.
Jun 29, 2026
Hackers associated with China have gained unauthorized access to the IT networks of hundreds of small and medium-sized water utilities and other critical infrastructure providers across the United States. These intrusions are believed to be part of a broader strategy to position Chinese actors to sabotage American water and power supplies in the event of a geopolitical conflict, particularly if tensions escalate over Taiwan. U.S. officials have been aware of this threat for over two years, and recent reporting has brought renewed attention to the scale and persistence of these cyber operations. The targeted utilities are often located in rural areas and small towns, which typically lack the cybersecurity resources and expertise of larger metropolitan systems. The operational technology (OT) systems that control water treatment and distribution are especially vulnerable due to their increasing automation and remote accessibility. The risk is compounded by a significant resource gap, as many of these utilities struggle to defend against sophisticated nation-state threats. Efforts to bolster defenses have included the launch of two non-profit initiatives aimed at supporting critical infrastructure operators, but these programs face their own limitations. One of the non-profits has paused its activities to recalibrate its approach, while the other is only able to provide assistance in a limited number of states due to resource constraints. The threat underscores the broader challenge of protecting critical infrastructure in the United States, where many essential services are managed by small organizations with limited budgets. The potential for cyber sabotage of water and power systems raises concerns about the resilience of civilian infrastructure in the face of international conflict. U.S. government agencies have issued warnings and guidance to utilities, but implementation of robust security measures remains inconsistent. The situation highlights the need for increased investment in cybersecurity for critical infrastructure, particularly in rural and underserved areas. The ongoing threat from Chinese-linked hackers demonstrates the strategic importance of water and power utilities as potential targets in modern cyber warfare. The exposure of these vulnerabilities has prompted calls for greater public-private collaboration and federal support. The risk is not limited to water utilities, as other sectors of critical infrastructure may face similar threats from state-sponsored actors. The revelations serve as a wake-up call for the urgent need to address cybersecurity gaps in essential services. The possibility of coordinated attacks on infrastructure during a geopolitical crisis could have far-reaching consequences for national security and public safety. The current state of preparedness among small utilities is insufficient to counter the scale and sophistication of the threat. The situation remains dynamic, with ongoing efforts to assess and mitigate the risks posed by foreign cyber actors.
Jul 12, 2026