The Shift Toward Physical Extortion
The landscape of cybercrime is undergoing a dangerous evolution. While traditional ransomware operations have long focused on encrypting sensitive files or exfiltrating data for extortion, recent incidents highlight a growing preference for sabotaging the physical world. By compromising Building Automation Systems (BAS)—the invisible digital backbone that controls HVAC, lighting, electronic locks, and industrial temperature regulation—malicious actors are forcing organizations to pay up by turning physical facilities into liability-heavy burdens.
This trend has manifested in alarming ways recently. From remote-controlled refrigeration systems in French grocery stores being pushed to temperatures that spoil food and spark fires, to hospitals losing control of door access and ventilation, the message is clear: if you won't pay for your data, you might be forced to pay to regain access to your own building. In some cases, these incidents have escalated to a point where physical intervention, such as emergency responders literally breaking through windows, becomes the only way for employees to regain access to their workspace.
The Vulnerability of Building Automation Systems
Building automation systems, often referred to as Operational Technology (OT), occupy a fragile intersection between traditional IT infrastructure and physical reality. These systems were historically designed for long-term reliability and constant uptime rather than high-level security. Consequently, they are frequently unpatched, lack the granular monitoring of modern IT networks, and rely on insecure protocols that date back decades. Security researchers have found that approximately 91 percent of these systems operate on insecure communication protocols, leaving them exposed to intruders looking for an easy, persistent foothold within a corporate network.
The threat is exacerbated by the lack of visibility most organizations have into their own OT environments. Industry data suggests that fewer than 10 percent of global OT networks are adequately monitored, meaning that unauthorized access often goes unnoticed until a physical disruption, such as a localized fire or a malfunctioning climate control system, alerts the staff. Attackers are increasingly using these systems to hide; by creating backdoors within the BMS, they can maintain a persistent presence even after being ejected from the main IT corporate network.
The AI Catalyst
Perhaps the most significant force accelerating these physical-world attacks is the integration of generative AI into the attacker's toolkit. Historically, navigating the complex, obscure, and proprietary operating systems found in industrial hardware—such as VxWorks or legacy Unix environments—required high-level domain expertise that limited the number of capable threat actors. Today, AI models are being used to lower the barrier to entry, allowing less sophisticated criminals to understand, analyze, and exploit proprietary code and specialized industrial protocols.
This AI-assisted approach changes the risk calculus for critical infrastructure. Where attackers once avoided manipulating high-consequence hardware for fear of causing unintended, irreversible damage, AI now allows them to simulate and predict the outcomes of their interventions. This shift transforms devices that were previously considered "low-value"—such as internet-connected refrigerators installed for regulatory compliance—into strategic vectors for widespread, scalable disruption.
Why It Matters
- Beyond Data: Cyberattacks now produce real-world, kinetic outcomes, increasing the urgency for business continuity and physical safety.
- Compliance Paradox: Internet connectivity required for regulatory compliance often introduces new, unpatched entry points into secure facilities.
- The AI Threat: AI is democratizing access to industrial exploitation, meaning threat actors no longer need to be specialized engineers to cause systemic failure.
- Persistence: BMS backdoors are becoming a primary method for maintaining long-term, undetected presence on enterprise networks.
