Two Decades of Cyber Conflict: The Journey from Web Disruption to ICS Exploitation

Introduction: The Shifting Paradigm of Infrastructural Conflict

The virtualization of critical infrastructure has fundamentally altered the calculus of international conflict. In the modern era, adversarial nation-states and their proxies no longer require physical proximity or kinetic force to disrupt the foundational operations of a target nation. As observed in recent geopolitical assessments regarding cybersecurity, populations are increasingly facing a reality where a hostile power can disrupt the daily life of an entire society without firing a single shot¹. This paradigm shift represents a foreseeable convergence of vulnerable operational technology, internet accessibility, and asymmetric geopolitical strategies, transforming civilian infrastructure into the primary battleground of the twenty-first century.

To understand the current state of cyber threats against civilian infrastructure—particularly the recent campaigns by Iranian-affiliated actors against water and wastewater systems—it is essential to examine the historical precedent that established cyberspace as a domain of warfare. The 2007 cyberattacks on Estonia served as the definitive genesis of this era, demonstrating the widespread societal disruption achievable through coordinated digital action³. Over the subsequent decades, the threat landscape has evolved from brute-force denial-of-service attacks aimed at government web portals to highly specific, architecturally aware intrusions targeting the programmable logic controllers that regulate physical industrial processes⁵.

This research article provides an exhaustive analysis of this evolution. It begins with a detailed overview of the 2007 Estonian cyberattacks, dissecting the technical mechanisms, traffic analysis, and the subsequent establishment of international cyber law via the Tallinn Manual. The analysis then transitions to the contemporary threat landscape, detailing the specific scientific and architectural vulnerabilities exploited by state-sponsored actors in modern Industrial Control Systems (ICS). By mapping these vulnerabilities against the Purdue Enterprise Reference Architecture and the Cybersecurity and Infrastructure Security Agency's Cross-Sector Cybersecurity Performance Goals, this report synthesizes the technical, architectural, and legal dimensions of defending critical civilian infrastructure.

The Precedent of 2007: Estonia's Baptism by Fire

In the spring of 2007, the Republic of Estonia became the target of what is widely considered the first major instance of state-sponsored cyberwarfare³. The precipitating event was a political dispute over the Estonian government's decision to relocate the Bronze Soldier of Tallinn, an elaborate Soviet-era war memorial, from a central city square to a military cemetery on the outskirts of the city³. The ensuing cyber campaign lasted for approximately twenty-two days, severely degrading the availability of Estonia's public and private digital services, and setting a historical precedent for the use of information technology to achieve political coercion⁸.

Technical Anatomy of the Distributed Denial of Service

The attacks against Estonia were characterized by their unprecedented scale and coordination rather than advanced technical sophistication. The primary mechanism utilized was the Distributed Denial of Service (DDoS) attack⁸. In a DDoS operation, malicious actors overwhelm target servers with a massive volume of bogus requests, consuming the network bandwidth and computational resources required to serve legitimate users¹¹.

The technical execution of the Estonian attacks occurred in distinct, escalating waves. The initial wave, beginning on April 27, 2007, relied on relatively crude methods, including Internet Control Message Protocol (ICMP) ping floods, malformed web queries, and User Datagram Protocol (UDP) floods⁴. These low-level network layer attacks simply flooded Estonian routers and web servers with continuous streams of data packets, causing email inboxes to fill with spam and government websites to slow to a crawl⁹.

However, the subsequent waves demonstrated a highly coordinated utilization of global botnets—networks of compromised, malware-infected computers controlled remotely by the attackers¹¹. These botnets, estimated to comprise between one and two million hijacked computers distributed across 175 jurisdictions, allowed the attackers to generate debilitating amounts of traffic⁴. Traffic analysis conducted by Arbor Networks' Security Engineering and Response Team (ASERT) demonstrated that the largest attack streams generated 90 megabits of data per second, with individual attack waves lasting for up to ten hours at a time³. While 90 megabits per second is a modest figure by modern broadband standards, it was devastating for the network infrastructure of 2007, resulting in the failure of email server mainframes, the overloading of Domain Name System (DNS) servers, and the widespread obscuration of online banking portals¹³. On May 10, Hansabank, Estonia's largest bank, was forced to shut down its online services, resulting in significant economic losses¹¹.

Mitigation and Second-Order Strategic Implications

Estonia's response, spearheaded by the Estonian Computer Emergency Response Team (CERT-EE) and supported by international allies, required rapid technical maneuvering⁴. Because the vast majority of the malicious traffic originated from outside the country, network administrators and internet service providers resorted to "blackholing" or blocking international IP addresses through Border Gateway Protocol (BGP) filtering⁸. This effectively isolated Estonia's digital infrastructure from the global internet to preserve internal functionality⁸.

A deeper analysis of the 2007 events reveals a critical second-order insight: the psychological and political utility of cyber operations. The attacks were synchronized with key political dates, such as May 9th, which is Victory Day in the Russian Federation⁴. The attacks featured dynamic adjustments in response to Estonian countermeasures and ceased at precise times, strongly indicating centralized orchestration rather than a spontaneous grassroots uprising⁴.

Despite this, the perpetrators maintained a state of persistent ambiguity. Because the attacks were routed through decentralized botnets primarily composed of compromised machines in the United States and other Western nations, definitive legal attribution to the Russian government remained elusive³. Estonian officials were forced to admit that they lacked the technical evidence to unequivocally tie the attacks to the Kremlin³. This blueprint—utilizing digital disruption to project power below the threshold of kinetic war while maintaining plausible deniability—would become the foundational strategy for modern advanced persistent threats.

Legal Thresholds and the Governance of Cyberspace: The Tallinn Manual

As the technical capacity for remote disruption grew in the wake of the Estonian attacks, so too did the need for international legal frameworks to govern state behavior in cyberspace. The shock of the 2007 events served as a catalyst for NATO, resulting in an internal assessment of cyber defenses and the subsequent establishment of the Cooperative Cyber Defence Centre of Excellence (CCDCOE) in Tallinn, Estonia in 2008³. The CCDCOE convened an international group of legal experts to draft the Tallinn Manual, a comprehensive academic study analyzing how existing international law applies to cyber operations³.

The Tallinn Manual 2.0 outlines a series of "black-letter rules" that serve as the foundation for state policy³. A primary concern for operators of critical infrastructure is determining when a cyberattack crosses the threshold from espionage or nuisance into a violation of international law, specifically an "armed attack" or a "use of force"¹⁵.

The Application of the Law of Armed Conflict

Rule 80 of the Tallinn Manual dictates that cyber operations executed in the context of an ongoing armed conflict are subject to the Law of Armed Conflict and International Humanitarian Law¹⁸. This requires states to adhere to the principles of humanity, necessity, proportionality, and distinction, expressly forbidding the deliberate targeting of civilians or objects indispensable to civilian survival¹⁸. The International Committee of the Red Cross (ICRC) supports this interpretation, noting that cyber operations against critical infrastructure threaten the safety and well-being of individuals and are thus constrained by international law¹⁸.

However, assessing cyber operations that occur outside of declared kinetic hostilities presents a complex legal challenge. According to Rule 82, a cyber operation can independently trigger an international armed conflict if it constitutes a resort to armed force¹⁹. The critical debate centers on the criteria for this threshold. The manual asserts that a cyber operation constitutes a use of force if its scale and effects are comparable to a traditional kinetic armed attack¹⁸.

The "Loss of Functionality" Doctrine and Due Diligence

When dealing with Industrial Control Systems, determining "effects" is complicated. If a nation-state drops a kinetic bomb on a water pumping station, it is unequivocally an armed attack. However, if a state proxy alters the ladder logic of a programmable logic controller to disable the pumps without causing physical explosions, categorizing the event becomes legally ambiguous.

The consensus among legal scholars, supported by the national positions of states like Germany, relies on the "loss of functionality" doctrine²¹. If a cyber operation results in the permanent or temporary functional impairment of a system—requiring physical repair, replacement of parts, or manual reinstallation of the network to restore the infrastructure—it is functionally equivalent to physical destruction²¹. Therefore, cyberattacks targeting critical infrastructure that result in severe societal, economic, or humanitarian consequences can legally be categorized as armed attacks, entitling the victim state to the right of self-defense under Article 51 of the United Nations Charter¹⁸.

Furthermore, international law grapples with the concept of "due diligence," a principle derived from the Corfu Channel case, which asserts that a state must not knowingly allow its territory to be used for acts contrary to the rights of other states¹⁵. While states differ on whether due diligence is a binding obligation in cyberspace, it remains a critical norm for holding nations accountable when their domestic networks are utilized by botnets or proxy groups¹⁵.

The second-order geopolitical consequence of these legal definitions is profound. Because states recognize that destructive cyber operations against critical infrastructure can cross the threshold of armed conflict, actors operate meticulously in the "grey zone"⁷. By utilizing proxies and relying on simplistic methods like default password exploitation rather than highly destructive zero-day malware, attackers maintain plausible deniability. They cause just enough disruption to signal capability and inflict economic pain, without provoking overwhelming military retaliation⁴.

The Modern Threat Actor: Iran's Asymmetric Cyber Doctrine

While the Estonian attacks targeted the availability of information systems, modern asymmetric cyber operations have increasingly targeted Operational Technology (OT) and physical processes. This evolution is vividly illustrated by the recent campaigns of Iranian-affiliated actors against the water, wastewater, and energy sectors of the United States and its allies⁷.

Iranian cyber doctrine historically functions as an asymmetric retaliatory instrument, leveraging critical infrastructure intrusions to signal capability and impose economic costs⁷. Iranian actors operate with near-total legal impunity within their borders, maintaining a highly favorable cost-benefit calculus for offensive operations²⁶. These operations range from deep, multi-year espionage to rapid, disruptive strikes. For example, investigative reports published in 2026 detailed a sustained six-year espionage campaign against Israel's Institute for National Security Studies, wherein Iranian actors utilized phishing and video-conferencing account takeovers to exfiltrate over one hundred thousand internal communications²⁷.

However, the threat to civilian infrastructure involves a shift from intelligence gathering to active disruption. Following the escalation of geopolitical tensions in the Middle East in late 2023, and accelerating after regional strikes in early 2026, cybersecurity researchers observed a massive activation of Iranian-aligned hacktivist and advanced persistent threat groups²⁴.

Threat Group Designation	Affiliation	Primary Targets	Typical Operational Tactics
CyberAv3ngers	Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC)	Water/Wastewater, Energy, Manufacturing, specifically targeting Israeli-manufactured equipment	Exploitation of default credentials on exposed PLCs, HMIs defacement, process disruption
MuddyWater	Ministry of Intelligence and Security (MOIS)	Government, Defense, Telecommunications, Energy	Living-off-the-land techniques (PowerShell, WMI), lateral movement, long-term persistence

Table 1: Overview of prominent Iranian state-sponsored cyber threat groups and their operational characteristics⁷.

The most prominent group targeting physical infrastructure is CyberAv3ngers, operating under the explicit mandate that any infrastructure utilizing components manufactured in adversarial nations is a legitimate military target²⁴. In late 2023, this group systematically breached municipal water utilities, including the Aliquippa Municipal Water Authority in Pennsylvania and a regional water pumping system in County Mayo, Ireland³¹. In these instances, the threat actors successfully compromised the facilities, resulting in a simultaneous loss of view and loss of control for plant operators. This forced the municipalities to immediately sever automated SCADA links, trigger physical safety cutoffs, and transition to emergency manual operations to prevent physical harm to the water supply⁷.

Scientific Anatomy of the Vulnerability: The PCOM Protocol and PLCs

To understand how critical physical infrastructure could be compromised so rapidly, one must examine the specific technical details of the hardware and software involved. The focal point of the CyberAv3ngers campaign was the Unitronics Vision series Programmable Logic Controller⁶.

A Programmable Logic Controller is an industrial computer designed to monitor and automate electromechanical processes, such as the regulation of pressure-boosting pumps in a water treatment facility³⁶. PLCs form the foundational physical control layer of an ICS network. To program, monitor, and configure these PLCs remotely, engineers utilize specialized communication protocols. Unitronics devices utilize a proprietary protocol known as PCOM (Programmable Controller Communication)³².

Protocol Mechanics and Formatting

The PCOM protocol allows an Engineering Workstation software suite (such as VisiLogic) to connect to the PLC over either a serial connection or an Ethernet network. When communicating over Ethernet, the protocol encapsulates the PCOM payload within a TCP/IP layer, defaulting to TCP port 20256²⁴.

The structure of the protocol is command-and-response based. The engineering software sends a request to the PLC containing a specific "opcode" (function code) that dictates the action to be taken, and the PLC executes the command and returns a response³⁵. The protocol exists in two primary formats: PCOM ASCII and PCOM Binary³⁵.

The PCOM ASCII format is utilized for exchanging homogeneous data types. Requests and responses are differentiated by their starting string sequences, commonly referred to as magic bytes. A request begins with the character sequence consisting of a single forward slash, while a response begins with a forward slash followed by the letter "a"³⁵. Conversely, the PCOM Binary format is required when the application must read or write heterogeneous data types within a single request. In this format, the data packet strictly begins with a hardcoded byte sequence represented by the characters "/_OPLC", followed by the device identifier, reserved parameters, and the command opcode³⁵.

Through forensic analysis and reverse engineering, cybersecurity researchers have documented dozens of opcodes that control the inner workings of the PLC, granting an attacker complete control over the device if they can authenticate.

Function Code (Hexadecimal)	Protocol Action Description
0x01 / 0x81	Read Memory
0x02 / 0x82	Check Password
0x0C / 0x8C	Get PLC Name
0x10 / 0x90	Find Resource
0x41 / 0xC1	Write Memory
0x42 / 0xC2	Reset Upload Password
0x4D / 0xCD	Read Operand

Table 2: Summary of critical PCOM opcodes and their corresponding actions³⁵.

The Exploitation Vector and Protocol Discovery

The underlying vulnerability that permitted the widespread compromise of these systems was not a complex zero-day exploit, but rather a fundamental flaw in default initialization and architectural hygiene (classified as CWE-1188)⁴². At the time of the attacks, the PCOM protocol lacked native cryptographic authentication for network communications, a common issue among legacy industrial protocols like Modbus/TCP³². The only barrier to entry was an optional, application-level password. By default, Unitronics PLCs shipped with the default password set to a simple four-digit string: "1111"²⁴.

Furthermore, facility operators had connected these PLCs directly to the public internet to facilitate remote maintenance, exposing TCP port 20256²⁴. Threat actors did not need to infiltrate a corporate IT network; they simply used search engines like Shodan and Censys, augmented by generative artificial intelligence platforms like ChatGPT, to rapidly generate search queries for exposed devices listening on specific industrial ports²⁴.

Associated TCP/UDP Port	Industrial Protocol	Target Device/Function
TCP 20256	Unitronics PCOM	Unitronics Vision/Samba PLCs
TCP 502	Modbus	Generic ICS process control
TCP 44818	EtherNet/IP	Rockwell Automation / Allen-Bradley PLCs
TCP 4840	OPC UA	Cross-vendor ICS communication
UDP 47808	BACnet	Building and facility automation
TCP 20000	DNP3	Electric utility SCADA protocol

Table 3: Common internet-exposed industrial ports targeted during reconnaissance phases²⁴.

Once an exposed device was identified, the attackers sent PCOM commands to the IP address, authenticated using the default password, and achieved full administrative control. This allowed them to manipulate ladder logic, alter pressure settings, and deface the Human-Machine Interface screens with political messaging⁷.

This incident illuminates a critical third-order insight regarding OT security: the lifespan of industrial equipment far exceeds the evolution of cyber threats. PLCs are designed for maximum uptime and reliability, frequently operating for decades without firmware updates²⁶. They typically run real-time operating systems that lack the computational overhead to support modern encryption or multi-factor authentication⁴³. Therefore, when devices designed for closed, trusted networks are suddenly bridged to the global internet, they become entirely indefensible against modern automated scanning and exploitation.

Architectural Atrophy and the Purdue Enterprise Reference Architecture

The vulnerability of the water sector PLCs cannot be viewed in isolation; it is symptomatic of a broader architectural decay across global critical infrastructure. For decades, the standard for defending industrial environments has been the Purdue Enterprise Reference Architecture (PERA), universally known as the Purdue Model³⁸.

Developed in the 1990s at Purdue University, the Purdue Model segments an industrial environment into strict hierarchical layers, enforcing defense-in-depth by establishing clear trust boundaries between corporate Information Technology and facility Operational Technology⁴³.

Purdue Model Level	Zone Designation	Description of Components and Functions
Level 5	Enterprise Network	Corporate IT functions, internet connectivity, email servers, and broad enterprise resource planning (ERP) systems.
Level 4	Business Logistics	Site-specific business systems, production scheduling, and local IT operations.
Level 3.5	Industrial DMZ	The Demilitarized Zone. A secure buffer housing firewalls, jump servers, and proxies to prevent direct communication between IT and OT.
Level 3	Site Operations	Manufacturing execution systems (MES), data historians, and site-wide OT management. The highest level of the OT network.
Level 2	Supervisory Control	Human-Machine Interfaces (HMIs) and distributed control systems monitoring specific local processes.
Level 1	Basic Control	Programmable Logic Controllers (PLCs) and Remote Terminal Units (RTUs) executing automated process logic.
Level 0	Physical Process	The physical equipment: sensors, actuators, pumps, and valves interacting with the real world.

Table 4: The Purdue Enterprise Reference Architecture levels and descriptions³⁷.

The foundational security principle of the Purdue Model is that data should cascade hierarchically. Systems at Level 4 cannot directly command devices at Level 1; all traffic must traverse the Level 3.5 Industrial DMZ, allowing for strict firewall rules and deep packet inspection³⁷.

However, the modern push for "digital transformation" and IT/OT convergence has fundamentally compromised this architecture. To optimize efficiency and enable predictive maintenance, organizations are increasingly deploying Industrial Internet of Things (IIoT) sensors at Level 0 and Level 1 that transmit data directly to cloud analytics platforms at Level 5, completely bypassing the DMZ³⁸. Furthermore, vendors frequently require direct remote access to PLCs for maintenance, prompting operators to open perimeter firewalls or utilize unapproved desktop-sharing software, circumventing the jump servers intended to secure access²⁴.

This blurring of boundaries is the single largest structural vulnerability in modern ICS⁴⁶. The exposure of Unitronics PLCs on TCP port 20256 is a direct manifestation of a collapsed Purdue Model. By failing to enforce network segmentation, operators allowed threat actors to bypass the IT network entirely and strike directly at the unprotected core of the operational environment, demonstrating how administrative convenience frequently supersedes architectural security³².

Remediation and Resilience: CISA CPGs and Defensive Paradigms

Mitigating the asymmetrical threat to civilian infrastructure requires bridging the gap between high-level policy and facility-level engineering. To standardize this effort, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has developed the Cross-Sector Cybersecurity Performance Goals (CPGs)⁴⁸.

The CPGs outline a prioritized baseline of high-impact security actions designed specifically to protect critical infrastructure networks from systemic compromise⁴⁹. When analyzing the failures that permitted the Iranian-affiliated breaches, several specific CPG remediations and ICS best practices emerge as critical countermeasures that must be adopted across the sector²⁴.

The most urgent strategic remediation is the elimination of internet-facing OT assets. CISA advisories, notably AA23-335A, explicitly mandate that no ICS management interfaces should be directly accessible from the public internet²⁴. Direct exposure bypasses the Purdue Model entirely. Organizations must implement secure Virtual Private Networks and route all external access through the Level 3.5 Industrial DMZ, forcing attackers to authenticate through modern IT security controls before ever reaching the vulnerable OT protocols²⁸.

Equally critical is the eradication of default credentials. The reliance on default factory credentials remains a pervasive failure in the OT sector, as evidenced by the exploitation of the Unitronics default password²⁴. Enforcing strict credential management and changing default passwords immediately upon deployment neutralizes the primary access vector utilized by low-sophistication hacktivists and state proxies²⁴.

To enforce the Purdue Model technically, administrators must apply strict bidirectional traffic rules. This involves establishing default-deny rules at every zone boundary and blocking inbound internet traffic to critical industrial ports, including TCP 20256, TCP 502, and UDP 47808²⁴. This acts as an essential compensating control for legacy devices that lack native authentication. Additionally, outbound traffic from OT environments must be heavily restricted to prevent compromised PLCs from beaconing out to adversary command-and-control servers, a common tactic used for establishing persistence⁴⁵.

To address the challenges posed by advanced threat actors like MuddyWater, who utilize "living-off-the-land" techniques by abusing legitimate administrative tools such as PowerShell and Windows Management Instrumentation, facilities must implement behavioral anomaly detection²⁴. Because signature-based detection frequently fails in OT environments, establishing behavioral baselines and hunting for deviations is critical for identifying lateral movement before it reaches the PLCs²⁴.

Finally, to satisfy the modern business requirement for OT data analytics without compromising security, facilities should utilize hardware-enforced unidirectional gateways, commonly known as data diodes. These devices physically permit data, such as historian replication, to flow from Level 3 up to Level 4, but make it physically impossible for network traffic to flow back down into the operational environment²⁶. This eliminates the risk of remote manipulation while preserving the visibility required by enterprise management.

Conclusion

The trajectory of cyber threats from the 2007 Estonian denial-of-service attacks to the contemporary manipulation of municipal water programmable logic controllers illustrates a continuous strategic evolution. The Estonian incident established cyberspace as an effective, deniable domain for state-level geopolitical coercion. Today, adversarial nation-states and their affiliated proxies have refined this approach, moving beyond the disruption of information systems to directly threaten the cyber-physical assets that sustain civilian life, successfully disrupting the daily operations of target nations without the deployment of kinetic force.

The vulnerabilities exposed in recent campaigns—such as the exploitation of the Unitronics PCOM protocol—highlight a dangerous intersection of aging industrial protocols, the erosion of strict network segmentation models like the Purdue Enterprise Reference Architecture, and the rapid proliferation of automated, AI-assisted discovery tools. Because critical infrastructure PLCs were never engineered to withstand direct exposure to the hostile internet, their compromise requires minimal sophistication, granting attackers a massive asymmetric advantage.

Defending against this reality demands a synthesized approach. At the facility level, it requires rigorous adherence to architectural principles, strict enforcement of CISA's Cybersecurity Performance Goals, and the systemic elimination of internet-facing control interfaces. At the international level, it necessitates the continuous refinement of legal frameworks, such as the Tallinn Manual, to clearly define the thresholds at which the digital manipulation of civilian infrastructure constitutes an armed attack. Only through a combination of uncompromising technical hygiene and resolute international norms can the integrity of global critical infrastructure be preserved against the inevitability of future incursions.

Works cited

1. The Bulwark - Substack, https://substack.com/@thebulwark/note/c-307931108

2. NewsNow: The Independent News Discovery Platform, https://www.newsnow.com/us/

3. 2007 cyberattacks on Estonia - Wikipedia, https://en.wikipedia.org/wiki/2007_cyberattacks_on_Estonia

4. 2007 cyber attacks on Estonia - NATO StratCom, https://stratcomcoe.org/cuploads/pfiles/cyber_attacks_estonia.pdf

5. CISA, FBI warn that Iran-linked hackers are expanding target set for, https://www.cybersecuritydive.com/news/cisa-fbi-iran-hackers-target-water-energy/826025/

6. Rigorous Evaluation of Machine Learning Intrusion Detection for, https://www.mdpi.com/2076-3417/16/14/7206

7. Multistate cyber campaign targeting US water and wastewater sector, https://shieldworkz.com/blogs/threat-intelligence-update-multistate-cyber-campaign-targeting-us-water-and-wastewater-sector-operational-technology

8. Analysis of the 2007 Cyber Attacks against Estonia from the Inf, https://ccdcoe.org/uploads/2018/10/Ottis2008_AnalysisOf2007FromTheInformationWarfarePerspective.pdf

9. (PDF) The Estonian Cyberattacks - ResearchGate, https://www.researchgate.net/publication/264418820_The_Estonian_Cyberattacks

10. CCDCOE analysis of the 2007 cyber attacks against Estonia, https://ccdcoe.org/library/publications/analysis-of-the-2007-cyber-attacks-against-estonia-from-the-information-warfare-perspective/

11. Estonia Cyber Attack, April-May 2007 | Computer Science - EBSCO, https://www.ebsco.com/research-starters/computer-science/estonia-cyber-attack-april-may-2007

12. Cyber Attacks Explained - CSIS, https://www.csis.org/analysis/cyber-attacks-explained

13. Estonia: Cyber Window into the Future of NATO - NDU Press, https://ndupress.ndu.edu/Portals/68/Documents/jfq/jfq-63/jfq-63_58-63_Laasme.pdf?ver=Gmp2P_MaR_5WUw4ETKCnXA%3D%3D

14. Cyber attacks against Estonia (2007), https://cyberlaw.ccdcoe.org/wiki/Cyber_attacks_against_Estonia_(2007)

15. International Legal Perspectives on Cyber Operations: A Common, https://ccdcoe.org/uploads/2026/06/International_Legal_Perspectives_on_Cyber_Operations.pdf

16. TALLINN MANUAL 2.0 - International Law Moot Court, https://ilmc.univie.ac.at/fileadmin/user_upload/p_ilmc/Bilder/Bewerbung/Case_2/Michael_N._Schmitt_-_Tallinn_Manual_2.0_on_the_International_Law_Applicable_to_Cyber_Operations-Cambridge_University_Press__2017_.pdf

17. Terminological Precision and International Cyber Law - Lieber Institute, https://lieber.westpoint.edu/terminological-precision-international-cyber-law/

18. Communication Blackouts: Israeli Cyberattacks Against Civilians in, http://opiniojuris.org/2024/03/20/communication-blackouts-israeli-cyberattacks-against-civilians-in-gaza/

19. The law of armed conflict generally (Chapter 16) - Tallinn Manual, https://www.cambridge.org/core/books/tallinn-manual-20-on-the-international-law-applicable-to-cyber-operations/law-of-armed-conflict-generally/E51C33369B1E84763B3CFD4C0CB8E943

20. Tallinn Manual on the International Law applicable to Cyber Warfare, https://scispace.com/pdf/tallinn-manual-on-the-international-law-applicable-to-cyber-1ypzb2oq5n.pdf

21. Germany's Positions on International Law in Cyberspace Part II, https://www.justsecurity.org/75278/germanys-positions-on-international-law-in-cyberspace-part-ii/

22. LIMITE EN - Data, https://data.consilium.europa.eu/doc/document/WK-3320-2021-INIT/en/pdf

23. The Sony and OPM Double Whammy: International Law and Cyber, https://scholar.smu.edu/cgi/viewcontent.cgi?article=1025&context=scitech

24. A Threat Actor Landscape Assessment of ICS/OT Targeting in the, https://www.cloudsek.com/blog/a-threat-actor-landscape-assessment-of-ics-ot-targeting-in-the-2026-iran-us-conflict-and-the-scale-of-the-risk

25. Welcome to the New Cyber Battleground | CISO Collective - Fortinet, https://www.fortinet.com/blog/ciso-collective/welcome-to-the-new-cyber-battleground

26. The Evolving Threat: Iranian and Nation-State APT Cyber Operations, https://www.uscybersecurity.net/csmag/the-evolving-threat-iranian-and-nation-state-apt-cyber-operations-present-and-future/

27. Haaretz Discloses Six-Year Iranian Penetration of Israel's INSS, https://zerodawn.tech/

28. AI, the Iran-US Conflict, and the Threat to US Critical Infrastructure, https://www.cloudsek.com/blog/ai-the-iran-us-conflict-and-the-threat-to-us-critical-infrastructure

29. Improving Resilience in Chemical Plant under Cyberattack by, https://bura.brunel.ac.uk/bitstream/2438/31895/1/FulltextThesis.pdf

30. 18th International Conference on Cyber Conflict: Securing, https://ccdcoe.org/uploads/2026/05/CyCon_2026_Securing_Tomorrow_Proceedings.pdf

31. Physical Security Engineering | Risk Management | Security, https://soybean-deer-akrk.squarespace.com/operational-analysis/blog-post-title-four-kb8br-z8sk7-sw4za-8nyce

32. The County Mayo Water Hack: How a Default Password Took 180, https://netsecgroup.io/guides/county-mayo-water-hack-unitronics

33. 2024 State of The Threat – A Year in Review, https://newsletter.radensa.ru/wp-content/uploads/2024/10/secureworks-state-of-the-threat-report-2024.pdf

34. Volume 12 | Issue 1 July 2024, https://hcss.nl/wp-content/uploads/2024/07/Georgetown-Security-Studies-Review-Vol-12-1-Davis-Ellison-2024.pdf

35. From Exploits to Forensics: Unraveling the Unitronics Attack | Claroty, https://claroty.com/team82/research/from-exploits-to-forensics-unraveling-the-unitronics-attack

36. SASE for Water Utilities: NIS2 SCADA Security 2026 | Jimber, https://jimber.io/blog/sase-for-water-utilities-nis2-scada-security/

37. What Is the Purdue Model for ICS Security? | A Guide to PERA, https://www.paloaltonetworks.com/cyberpedia/what-is-the-purdue-model-for-ics-security

38. What Is the Purdue Model for ICS Security? - Zscaler, Inc., https://www.zscaler.com/resources/security-terms-glossary/what-is-purdue-model-ics-security

39. Following Unitronics research, Claroty's Team82 debut tools to, https://industrialcyber.co/industrial-cyber-attacks/following-unitronics-research-clarotys-team82-debut-tools-to-combat-cyber-threats-in-critical-infrastructure/

40. A Comprehensive Security Analysis of a SCADA Protocol, https://www.researchgate.net/publication/331974234_A_Comprehensive_Security_Analysis_of_a_SCADA_Protocol_from_OSINT_to_Mitigation

41. Communication with the Vision™ PLC - Unitronics, https://www.unitronicsplc.com/Download/SoftwareUtilities/Unitronics%20PCOM%20Protocol.pdf

42. CVE-2023-6448 — Unitronics Vision PLC and HMI Insecure Default, https://kev.5sn.com/2023/CVE-2023-6448.html

43. What Is the Purdue Model? Definition, Level & Best Practices, https://www.sentinelone.com/cybersecurity-101/cybersecurity/what-is-the-purdue-model/

44. The Purdue Model - Introduction to ICS Security Part 2 - SANS Institute, https://www.sans.org/blog/introduction-to-ics-security-part-2

45. What Is the Purdue Model for ICS Security? | Fortinet, https://www.fortinet.com/resources/cyberglossary/purdue-model

46. IT/OT/ICS Cybersecurity — Guide for Industry 2026 - EITT, https://eitt.academy/knowledge-base/it-ot-ics-cybersecurity-comprehensive-guide-for-industry/

47. OT ICS Cybersecurity Threats: Tactics, Paths, Defenses - Group-IB, https://www.group-ib.com/resources/knowledge-hub/ot-ics-cybersecurity/

48. Cross-Sector Cybersecurity Performance Goals - CISA, https://www.cisa.gov/cross-sector-cybersecurity-performance-goals/cross-sector-cybersecurity-performance-goals

49. CISA rolls out cross-sector cybersecurity performance goals for, https://industrialcyber.co/critical-infrastructure/cisa-rolls-out-cross-sector-cybersecurity-performance-goals-for-critical-infrastructure-sets-benchmark-standards/

50. CPG - CISA, https://www.cisa.gov/sites/default/files/2023-03/CISA_CPG_REPORT_v1.0.1_FINAL.pdf

51. (TLP:CLEAR) CISA Releases Cybersecurity Performance Goals 2.0, https://www.waterisac.org/tlpclear-cisa-releases-cybersecurity-performance-goals-2-0-for-critical-infrastructure

52. Cross-Sector Cybersecurity Performance Goals, Version 2.0 - CISA, https://www.cisa.gov/sites/default/files/2025-12/CPG_Report_2.0_508c.pdf