Cybercriminals Target Building Systems for Physical Disruption and Extortion
Attackers are increasingly compromising building automation systems (BAS) to cause physical damage, disrupt operations, and extort organizations, moving beyond traditional data theft.
Cybercriminals are escalating their tactics beyond traditional data theft and ransomware encryption, now directly targeting physical building systems to cause real-world disruption and extort organizations. Recent incidents highlight a disturbing trend: attacks on Building Automation Systems (BAS) are leading to spoiled goods, fires, and the complete shutdown of essential services.
In a significant recent event, an unknown attacker compromised thousands of remote-controlled refrigeration systems across numerous French grocery stores, causing temperatures to spike, leading to widespread food spoilage and even igniting fires. This incident underscores the tangible and dangerous consequences of compromising systems that manage physical environments. Earlier in the year, a ransomware attack crippled the building management systems of a Canadian hospital, disrupting critical functions such as door access controls, central HVAC monitoring, and the issuance of staff access cards.
These attacks are not new, but their frequency and impact are growing. Three years ago, cyberattacks on Las Vegas casinos caused slot machines to go offline, prevented payment kiosks and ATMs from dispensing cash, and locked guests out of their rooms by disabling electronic key systems. These examples demonstrate that digital intrusions can have severe physical repercussions, often creating a more potent leverage for attackers demanding ransom.
A report by ServiceNow's Armis Labs reveals that 73 percent of organizations have BAS that have been used in ransomware attacks, and a similar percentage have known exploited vulnerabilities within their building automation systems. These systems, which control HVAC, lighting, energy usage, and physical security elements like badge readers and surveillance cameras, are prime targets due to their critical role and often weaker security postures compared to traditional IT systems.
BAS operate at the intersection of Information Technology (IT) and Operational Technology (OT), creating a broad attack surface. A significant 91 percent of BAS communicate over insecure protocols, leaving them vulnerable to exploitation. Furthermore, the need for continuous uptime in these systems makes them difficult to patch or scan for vulnerabilities, as any disruption could lead to immediate operational outages.
"The primary thing that we see with any attack on building management systems or physical systems: It's a great place for the threat actor to hide," stated Michael Freeman, ServiceNow’s senior director of threat research. He noted that these systems are often easier to compromise and maintain a lower profile within an organization's network. Attackers can use BAS as a staging ground to pivot into more sensitive IT environments, as seen in an attack against a large financial institution where intruders established backdoors in the BMS to ensure persistent access to both OT and IT networks.
Adding to the threat, Artificial Intelligence (AI) is now being leveraged by attackers to understand and exploit BAS, even those running on obscure or legacy operating systems like VxWorks. AI tools can help threat actors identify vulnerabilities and understand proprietary hardware and software, effectively lowering the barrier to entry for sophisticated attacks on industrial control systems and building management infrastructure. This means attackers no longer need to be deep OT experts to carry out destructive cyberattacks.
The trend of targeting physical systems is a significant escalation in cybercrime, moving beyond financial gain through data theft to direct physical disruption and the potential for widespread damage. As AI capabilities advance and BAS remain attractive targets with inherent security weaknesses, organizations must prioritize securing these critical OT environments to prevent devastating real-world consequences.