Aftermath and Deniability (AD)

Taxonomies › Critical Infrastructure › AD · Aftermath and Deniability

The cognitive and political layer: fronts, signals, false claims, disinformation and the loss of public trust. Part of The Campaign deck, ranked Ace to 2 by severity in the game. This page is part of the Critical Infrastructure (Cyberwarfare) Threat Taxonomy, the reference for the Black Start card game.

Mappings at a glance

STRIDE, CAPEC 3.9, CWE 5.0, ATT&CK for ICS v20.0, the Cyber-Informed Engineering principles (main one first) and standards, entry by entry. The same mappings are in each entry below and in the Excel, SKOS and STIX downloads.

Entries

BKS-AD-A · False safety notices reach the public †

The service has no authenticated way to tell the public what to do in an emergency, so a forged boil-water, evacuation or gas-leak notice spreads faster than the real one. People act on it and are harmed, and later genuine notices are not believed.

Principle. Public safety instructions travel only through channels that the public has been taught to recognise and that can be verified.

Design measures.

1. Agree in advance with the authorities which channels carry safety notices, and publish that list before any incident.
2. Protect official accounts, SMS sender IDs and alerting systems with phishing-resistant MFA and named owners.
3. Prepare holding statements and a rebuttal process that can go out within minutes of a forged notice appearing.

Mappings: STRIDE S, T, D · CAPEC-148, CAPEC-151 · CIE 10, 12

BKS-AD-K · A limited strike is a warning

A small, contained attack is meant as a signal and a test of the mechanism. The organisation treats it as an isolated incident, restores service and closes the ticket, while the same path, at the same sites and their peers, stays open for a far larger strike later.

Case: Khuzestan steel plant, 2022.

Principle. Treat any effect an adversary has demonstrated once as a capability that can be repeated at full scale.

Design measures.

1. After any physical effect, ask what the same mechanism would do across every site, vendor customer and peer operator at once.
2. Close the mechanism, not only the instance: remove the exposure fleet-wide and share indicators with the sector and national CERT.
3. Record demonstrated mechanisms in the threat model and test their removal in the next exercise.

Mappings: STRIDE T, D · CIE 1, 6, 10

BKS-AD-Q · Destruction disguised as ransomware

A destructive attack is dressed up as criminal extortion. Responders follow the ransomware playbook, negotiate and wait for a decryptor that will never come, while the real aim, destruction and delay, is achieved and insurers may argue a war exclusion applies.

Case: NotPetya, 2017.

Principle. Plan recovery so that it never depends on the attacker’s cooperation or on how the attack is labelled.

Design measures.

1. Assume encrypted systems are destroyed: rebuild from offline, tested images rather than waiting for keys.
2. Escalate any attack on operational systems to national authorities early, whatever the ransom note says.
3. Check insurance cover for state-attributed and destructive attacks before an incident, not after.

Mappings: STRIDE R, T, D · ATT&CK for ICS T0809, T0828 · CIE 10, 6

BKS-AD-J · Response waits for attribution

Plans tie escalation, mutual aid and national coordination to knowing who is behind an attack. Attribution takes weeks or months, so the organisation and its peers under-react while the attack is still unfolding and the same mechanism is reused elsewhere.

Case: Supermarket refrigeration attacks, 2026.

Principle. Decide escalation by effect and scope, not by who the attacker is believed to be.

Design measures.

1. Write escalation triggers on observable effects: physical change, number of sites, sectors affected, public safety.
2. Pre-agree with peers and authorities what is shared and done when several operators are hit at once.
3. Keep attribution work separate from the response so neither waits for the other.

Mappings: STRIDE D, R · CIE 10, 7

BKS-AD-10 · The public stops trusting the product

After an attack on treatment, dosing or the cold chain, the operator cannot show that what reached people was safe, because quality records and process data could have been altered. Customers turn to riskier alternatives and confidence takes years to return.

Principle. Keep evidence of product safety that an attacker on the control system cannot alter.

Design measures.

1. Take independent quality samples and lab results through a path that does not touch the control network.
2. Write process and quality records to tamper-evident, write-once storage held off site.
3. Prepare a public explanation of how safety was verified, with figures, before it is needed.

Mappings: STRIDE T, R · CIE 2, 10

BKS-AD-9 · Panic buying multiplies a small outage

A disruption at a few sites, amplified on social media, sets off panic buying across a region. Replenishment, ordering and distribution are tuned for normal demand, so the shortage the attack only threatened becomes real.

Case: Colonial Pipeline, 2021.

Principle. Design supply and communications to absorb a demand surge triggered by fear, not only by real shortage.

Design measures.

1. Hold surge stock and allocation rules for essentials, agreed with retailers and authorities in advance.
2. Publish factual stock and service updates early and often during an incident.
3. Model the demand spike that a visible outage at a few sites would cause, and plan for it.

Mappings: STRIDE D · CAPEC-420 · ATT&CK for ICS T0828 · CIE 7, 10

BKS-AD-8 · A hacktivist persona hides a state

Attacks are claimed by a self-styled volunteer group. Because the threat model rates hacktivists as low capability and opportunistic, the operator scopes the response narrowly and misses the resources, patience and intent behind it.

Case: Unitronics PLCs at water utilities, 2023; Texas water systems, 2024.

Principle. Judge a threat by what it did and could do, not by the name it chooses for itself.

Design measures.

1. Assess every attack that changes a physical process as a capable adversary until evidence shows otherwise.
2. Track self-styled groups and their claims with the sector CERT, including links reported by government agencies.
3. Harden the exposure a persona used across the whole estate, not only the device it defaced.

Mappings: STRIDE R, S · CIE 12, 6

BKS-AD-7 · False claims force costly action

An adversary claims, without proof, to have tampered with water, food or fuel. The operator has no reliable way to show that nothing changed, so it shuts down, recalls or issues warnings it did not need to, and the claim works as well as an attack.

Principle. Be able to show quickly and credibly that a process and its product were not changed.

Design measures.

1. Keep a trusted baseline of logic, setpoints and firmware, and compare against it on demand.
2. Log every change to control logic and setpoints centrally, with who made it and when.
3. Agree with regulators in advance what evidence lets a claimed tampering be ruled out.

Mappings: STRIDE R, D · CAPEC-417 · CWE-778 · CIE 2, 8

BKS-AD-6 · Stolen engineering data is published

Drawings, network diagrams, setpoints and passwords taken from the operator or its contractors are published to show reach and to help others attack. The operator cannot withdraw the information and must treat every design it described as known to everyone.

Principle. Assume engineering information will leak, and design so that knowing it is not enough to cause harm.

Design measures.

1. Classify engineering documents and limit who holds them, including contractors and bidders.
2. Rotate credentials and review exposures named in any leaked material immediately.
3. Rely on engineered limits and authentication rather than on the secrecy of drawings and settings.

Mappings: STRIDE I · CWE-656 · ATT&CK for ICS T0882 · CIE 11, 2

BKS-AD-5 · Staff are named and targeted

Operators, engineers and incident responders are identified online, doxxed, intimidated or approached to help. People under pressure make mistakes, leave, or are coerced, at the moment the organisation most needs them.

Principle. Protect the people who run essential services as part of the system’s security.

Design measures.

1. Limit public exposure of names, roles and rotas of operational staff, including on professional networks.
2. Give staff a clear, confidential route to report approaches, threats or coercion.
3. Design critical actions so no single person can be pressured into causing harm alone.

Mappings: STRIDE I, S · CAPEC-416 · CIE 12, 11

BKS-AD-4 · Planted evidence points elsewhere

The attacker plants code, language and infrastructure traces that point to another actor. Investigators and decision makers who rely on a single source of evidence draw the wrong conclusion, and the response is aimed at the wrong party.

Principle. Base conclusions on several independent lines of evidence that an attacker in one system cannot forge together.

Design measures.

1. Keep network monitoring that is independent of the hosts it watches, with its own storage.
2. Preserve forensic images and logs with integrity protection before analysis starts.
3. Share raw evidence with the national CERT rather than conclusions alone.

Mappings: STRIDE R, T · CAPEC-268, CAPEC-93 · CIE 6, 8

BKS-AD-3 · Disclosure teaches the adversary

Detailed public statements and incident reports reveal which effects worked, how long recovery took and which controls failed. The adversary uses them to tune the next attack and to choose the next targets that share the same weaknesses.

Principle. Share technical detail where it helps defenders, and keep what helps the attacker out of public reports.

Design measures.

1. Share full technical detail through trusted sector channels and the national CERT.
2. Review public statements for detail that measures the attack’s success, such as recovery times per site.
3. Fix shared weaknesses across peers before publishing them.

Mappings: STRIDE I · CIE 11, 12

BKS-AD-2 · Taunts on public screens

Fuel pumps, till screens, signs and HMIs that the public or staff can see are made to show the attacker’s message. The defacement causes little damage but proves access, spreads fear and invites copycats.

Case: Iran fuel stations, 2021 and 2023; Unitronics PLCs at water utilities, 2023.

Principle. Treat any public-facing display linked to operational systems as part of the attack surface.

Design measures.

1. Separate public displays from the systems that run the process, and restrict what can write to them.
2. Treat a defacement as proof of access and investigate what else the attacker could reach.
3. Prepare staff to switch displays off and explain the situation calmly.

Mappings: STRIDE T · CIE 3, 12

Public cases cited in this suit

• Khuzestan steel plant, 2022. In June 2022 a group claimed a cyberattack that caused a fire at an Iranian steel plant and published video of molten metal spilling; the company halted production. Attribution: Claimed by Predatory Sparrow. Sources: CCDCOE Cyber Law Toolkit: Predatory Sparrow operation against Iranian steel maker
• NotPetya, 2017. In June 2017 NotPetya, destructive malware disguised as ransomware, spread from a Ukrainian accounting software update. Maersk rebuilt its network and recovered its directory from a domain controller in Ghana that had been offline during a power cut; Mondelez’s insurer cited a war exclusion, a dispute settled in 2022. Attribution: Attributed by the UK and US governments (2018) to the Russian military. Sources: Redmond: the domain controller nightmare; The Record: Mondelez and Zurich reach settlement
• Supermarket refrigeration attacks, 2026. Overnight on 11 to 12 October 2026 attackers forced the remote-managed refrigeration controllers of hundreds of French supermarkets into defrost, heating cabinets to as much as 50C; stock was destroyed and some equipment caught fire. CERT-FR told operators to disconnect the controllers or tightly filter access to them. A second wave on 2 November hit supermarkets and food businesses in Sweden, Belgium, Ireland, Luxembourg, Estonia and Italy, and five Danish companies, where the attacks were stopped quickly. Danfoss confirmed its products were involved, and France’s cyber agency judged the campaign probably still under way. Attribution: Unattributed at time of writing; Paris prosecutor’s investigation open. Sources: The Hacker News: attackers heat French supermarket fridges; BleepingComputer: cyberattack shuts down refrigerators at French supermarkets; DR: what we know about the attacks on European supermarkets; Today.it: attacks on refrigeration in Italy, ACN alert
• Colonial Pipeline, 2021. In May 2021 ransomware on Colonial Pipeline’s business IT led the company to shut down the pipeline, which carries about 45 per cent of the US East Coast’s fuel, for five days; shortages and panic buying followed. Attribution: Attributed by the FBI to the DarkSide ransomware group. Sources: CBS News: Colonial Pipeline paid ransom; The Chemical Engineer: Major US pipeline restarts
• Unitronics PLCs at water utilities, 2023. From November 2023 attackers defaced internet-exposed Unitronics PLCs at the Municipal Water Authority of Aliquippa and other US sites, getting in with the default password; the Aliquippa booster station was run by hand. Attribution: Attributed by CISA, FBI and partners to CyberAv3ngers, affiliated with Iran’s IRGC. Sources: Industrial Cyber: US, Israeli agencies warn of IRGC activity using OT devices; The Register: Iran-linked attacks on US water
• Texas water systems, 2024. In January 2024 a group calling itself the Cyber Army of Russia Reborn claimed interference with water systems in small Texas towns; a tank in Muleshoe overflowed before staff took the system offline. Attribution: Mandiant assessed links to Sandworm (APT44); the US Treasury sanctioned two of the group’s members in July 2024. Sources: CyberScoop: Sandworm linked to Texas water facility; Treasury sanctions leader and primary member of the Cyber Army of Russia Reborn (19 July 2024)
• Iran fuel stations, 2021 and 2023. In October 2021 attackers disabled the fuel card system at about 4,300 Iranian fuel stations; in December 2023 a similar attack disrupted around 70 per cent of them. Attribution: Claimed by Predatory Sparrow; Iran blamed Israel. Sources: Al Jazeera: Iran says cyberattack disrupts petrol stations; Security Affairs: Predatory Sparrow disrupted 70% of Iran’s fuel stations

© 2026 Jonathan Brett Crawley. Licensed under CC BY-NC-ND 4.0 with additional permissions: see the licence on the overview. † marks a physical-safety consequence.