In Booz Allen’s isolated OT lab, AI models hit every objective across eight scenarios and reached an industrial control network from a perimeter compromise in just over 16 minutes. That clock is faster than most change boards can convene, and it is faster than a lot of threat detection still takes to page a human. If your cybersecurity program still files plants under “slow, air-gapped, call the integrator,” this week’s reporting should retire that assumption. Cisco Talos and Recorded Future documented Kazakhstan-nexus activity tracked as UAT-6275 against government organizations across the Commonwealth of Independent States. Recovered artifacts show extra interest in water resources and energy. You do not get a leisurely investigation window when the collection already points at the plant.

UAT-6275 Artifacts Show Water and Energy Targeting

Talos did not write a tourism brochure. The UAT-6275 cluster, assessed as Kazakhstan-nexus and overlapping Recorded Future’s reporting, went after CIS government organizations. That targeting set is already a problem if you run identity, mail, or remote-access for a ministry. The recovered artifacts make it your problem if you run a utility. Water and energy showed up in the collection picture, which is how operators should read it: government inboxes as a path, process networks as a destination.

You already know the pattern. Credential theft and quiet access against the civilian IT estate, then a walk toward historians, jump boxes, and vendor VPNs that still flatten “corporate” and “plant” into one routing domain. Defense in depth on paper does not survive a shared jump host with cached plant credentials. If your cyber security model still draws a hard line between ministry IT and the SCADA closet, UAT-6275 is collecting on both sides of that line.

This is a bad look for programs that only page when a firewall rule fires on the historian VLAN. Collection against water and energy rarely starts on the PLC. It starts on the laptop that can RDP to the laptop that can talk to the engineering workstation. Hunt the path, not the brand of the controller.

Lab Result: Control Network Reached in 16 Minutes

Booz Allen put AI agents into unfamiliar OT and watched them work. Eight scenarios. Every objective met. From a perimeter compromise to the industrial control network in a little more than 16 minutes, including enough understanding of the environment to move equipment. Read that last part twice. The models were not guessing at ping sweeps for a CTF score. They were navigating live-style process systems well enough to change physical state.

Your playbooks still assume a human operator who types, gets lost in a proprietary HMI, and needs a week of tribal knowledge. That assumption is now a liability. An agent that can read docs, follow tags, and retry failed commands compresses reconnaissance into the same window you currently spend arguing about who owns the ticket. Threat-protection stacks that only alert on known malware hashes will watch this happen as “anomalous admin on the jump host” if they see it at all.

The lab was isolated. That does not make the timing fictional. It makes the timing a best case for the defender, because the agents were not also drowning in your messy AD trusts, leftover vendor accounts, and screenshots of panel passwords taped to engineering workstations. Give those models your real estate and the 16-minute mark moves left. Pair that speed with a group already collecting on water and energy, and the argument for “we’ll segment next fiscal year” collapses.

CVE-2026-104935 Left ICS Auth Bypass After Partial Patch

While you debate AI risk committees, the edge you actually expose is still shipping half-fixes. Dark Reading’s reporting on Ivanti ICS walks through CVE-2026-104935, a high-severity authentication bypass bundled with remote code execution. The painful part is the calendar. A July cycle only partially discovered and patched the issue, and operators were left with a hole threat actors could still use. That is not a communications miss. That is a broken contract between vendor advisory and plant reality.

ICS management planes sit on the same mental shelf as email gateways and VPN concentrators: “security products,” therefore trusted, therefore late to isolate. You know how this ends. The box that was supposed to be threat-protection becomes the foothold. A 16-minute agent does not need to brute-force a PLC protocol if the vendor portal still accepts an unauthenticated request. Partial patches train your change process to mark the ticket closed while the second bug class stays live.

The real problem here is verification. If your evidence of “patched” is a vendor PDF and a version string, you are not measuring the auth bypass or the RCE. You are measuring paperwork. For internet-facing ICS, VPN, and jump-host software, closed means you proved both primitives are gone, from an untrusted network, with the same tests an attacker will run.

Cybersecurity Hardening Before the Next 16-Minute Window

Stop writing OT strategy decks. Run a drill against the actual path a foothold would take, and time it. Immediate work is ugly and local. Ongoing work is the same checks on a calendar that does not care about your integrator’s availability.

Do this now, on the networks you actually own:

• Inventory every path from corporate IT to plant: VPN, jump hosts, vendor remote-access, shared AD, and “temporary” RDP. If a perimeter box can route there, treat it as OT-adjacent and pull it into incident response from minute zero.
• Put those jump hosts behind allowlists. Drop inbound management from the internet. Fail closed on unused services. If you already run host-level bans, including tools such as IPBan Pro, feed them the same scanner and brute-force ranges your border firewall drops so repeat hits die on the box, not in a SIEM queue.
• Re-test Ivanti ICS and every other plant-facing appliance against the claimed CVE, not the release notes. Unauthenticated request. Privileged function. File write. If any of those still work, roll back exposure and open a vendor case with packet captures attached.
• Pre-stage an OT isolation runbook that cuts vendor VPN, disables jump-host trusts, and snapshots engineering workstations in under 16 minutes. Practice it on a maintenance window so the first live use is not also the first rehearsal.

Keep going after the fire drill. Security hardening on OT is boring on purpose: unique jump-host identities with no plant-wide local admin reuse, protocol-aware allowlists east-west, and logging that records setpoint changes and interactive logons on the same timeline. Hunt weekly for new remote-access software, unexpected translations through the firewall, and service accounts that suddenly talk to historians. Defense in depth here means the agent that pops a perimeter mail box still dies on a jump host that cannot see the PLC network.

If UAT-6275’s water and energy interest maps to anything you operate, or to a supplier who can touch your process network, put those orgs in your threat-intel intake this week. Indicators matter. The access graph matters more. You are racing a 16-minute clock against collectors who already decided the plant is in scope. Shrink the path, prove the patch, and time the isolation. The lab already told you how little slack you have.

Sources

• Break the silence: Kazakhstan-nexus UAT-6275 targets CIS government organizations
• AI Agents Navigate Unfamiliar OT Systems and Move Equipment in Minutes, Booz Allen Finds
• Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdles