German Steel Mill Attack (2015)

Victim:

German Steel Mill

Attacker/Malware:

Unknown

Industry:

Manufacturing

Estimated Cost:

$100-330M cost, destroyed blast furnace, several days to weeks of factory downtime (undisclosed, estimated)

Primary Attack Vector:

Spear Phishing

Prevention Failure:

Weak Credentials, Lack of Segmentation

BlastWave Solution:

Network Cloaking, Passwordless Secure Access, and Segmentation

Kill Chain Analysis:

Sophisticated Social Engineering and Physical Destruction

In 2015, an unnamed German steel mill was targeted by a sophisticated statesponsored campaign that employed social engineering to gain initial access tothe corporate network.

Once internal, the actors moved laterally into the OT environment, specificallytargeting control systems. The goal was physical sabotage: the operationdisrupted the facility’s control systems, preventing the blast furnace fromshutting down properly and causing significant damage to the equipment

BlastWave Prevention Analysis:

Command Verification and Access Confinement

The physical destruction was enabled by unrestricted lateral movement and theability to send unauthorized control commands.

BlastWave ensures that the engineering workstation used to control the blastfurnace is segmented and cloaked from the rest of the network. Furthermore, theuser’s identity is verified before any session to the control system is established.

Even if a social engineering campaign succeeded in getting an employee toinstall malware, the malware attempting to send unauthorized or malicious commands would lack the specific application-level authorization to interact with theblast furnace controller, thereby confining it and preventing physical sabotage.

This incident highlighted the devastating consequences of cyber capabilities leading to physical destruction. Lateral movement prevents the escalation of privileges, protecting against physical actions.

Download Hackopedia Volume 1 Now – It's Free

Our Privacy Policy applies.

Take the Next Step

Reading about past failures is only useful if it changes future outcomes. If attackers can see your OT network, they can target it. If they can target it, compliance, safety, and uptime are already at risk.

BlastWave eliminates reconnaissance, initial access, and lateral movement — without agents, without downtime, and without changing IPs, protocols, or PLCs.

Secure Your OT Network