Dr. Stuxlove, my presentation at BSidesSF on February 15, 2011, placed Stuxnet within a documented lineage of control-system compromises. Was Stuxnet the “First”? followed in 2015 with an incident list back to 1992 and a study of how the press likes to manufacture firsts and seconds.
Today I was asked about a threat-intelligence vision for physical and hybrid attacks together. Good question! While we record anecdotes and press coverage easily as qualitative points, the structured qualitative incident data still remains scarce. MITRE ATT&CK offers us only the high level T1200, Hardware Additions for physical entry, with T1195, Supply Chain Compromise next door and a separate ATT&CK for ICS matrix covering cyber operations that produce physical effect, while kinetic acts stay outside every matrix. That reveals an old structure we need to update.
How many sides to an elephant?
The phrase “physical and hybrid” is like answering trunk and tail when asked what’s filling up the room we are in.
One end is all about what’s getting inside hardware: implants, additions, supply-chain access. ATT&CK treats these as an entry vector because ATT&CK models adversary behavior inside networks that ride on, but especially terminate somewhere in, the physical. Kinetic acts thus get framed outside its scope, which explains the single technique for entry by hardware. The ICS matrix is on the extreme end, as it only records what a compromise does to a physical process and kinetic tools aren’t mentioned.
The other end is the kinetic field: severed cables, damaged pipelines, attacked substations, drone incursions, arson. Conflict-event and hybrid-threat researchers talk about this as its own discipline. Remember the pipeline blast threads? I once met with a White House official who brushed me aside when I suggested the PG&E San Bruno deadly blast is a natsec concern that cyber crosses with. Shortest meeting ever.
Each field sits at the end of a much more interesting whole picture that we should be putting back together. A cross-domain incident falls naturally between them.
Provenance isn’t always in Provence
Honestly, we benefit most by fleshing out the middle so that we have one to talk about comfortably. Reporting on verified infrastructure attacks carries the kind of accuracy that helps deflate political fear mongering thriving in a middle void.
Vulkangruppe attacks showing Russian indicators across fifteen years without a single conviction? Who does that void serve? Kommando Angry Birds fitting the Russian paid-recruitment template the BKA, BND, BfV, and BAMAD jointly warned about? The evidence helps a lot, but apparently the void helps someone even more.
The Tehama-Colusa canal case ended in dismissal. The 2008 BTC Turkey pipeline explosion rests on single sourcing. The 1982 Trans-Siberian pipeline story rests on one memoir. Maroochy Shire in 2000 predates Stuxnet by a decade and was prosecuted. The verified record is smaller and older than the vastly increasing reported one. But the hard facts live in blog posts like this one and engineering reports rather than proper threat research tables. Vendors and the press prefer the loose record because they hunt firsts and seconds as “news”.
Today a thing happened again, which we have seen before and could have prevented, doesn’t get the attention it deserves.
Ingredients
Existing databases each hold a piece of the whole picture. Assembling them is the practical path to a working dataset.
EuRepoC is a free European academic database of cyber incidents. It starts at 2000, codes each incident across roughly sixty fields, and runs separate trackers for critical infrastructure and for attribution. Use it for the cyber side and for the overlap where cyber operations touch physical infrastructure.
The Soufan Center report on Russian hybrid tactics carries an incident list covering 2022 through 2025. Each entry names the incident, the country, the target type, and a confidence level for the attribution. Use it for the recent kinetic and hybrid record in Europe.
OE-417 is the disturbance report US utilities must file with the Department of Energy. The filings go back to 2000 and include a category for physical attack. Use it for structured data on attacks against the US grid, the one infrastructure sector with mandatory public reporting.
That leaves the giant void.
Triad of Encoding
Incident analysis should record three separate facts: who was there, who did the damage, and who gave the order. Call them presence, attribution, and tasking. Each rests on different evidence, and each deserves its own confidence rating.
Presence is who was at the scene. The Baltic record shows us Chinese-flagged or Chinese-owned vessels over repeated cable breaks: Newnew Polar Bear crossed the Balticconnector and two cables in 2023, Yi Peng 3 dragged across C-Lion1 and the Sweden-Lithuania link in 2024, and comparable incidents followed off Taiwan in early 2025. Ship tracks prove the presence. They prove only presence, but that’s the point.
Attribution is who caused the damage. Western investigators treat the hulls as flags of convenience and pursue Russian indicators, while Beijing declined to cooperate with the Balticconnector inquiry and every Baltic case remains open, leaving the void.
Tasking is who ordered the operation. No Baltic case seems to be getting close. I’ve argued a few times we have some clear Chinese indicators yet seen almost zero interest in public pursuit. Talk about void.
Merging the three into a single actor field turns a database into a story lacking the support it deserves. A ship at the scene becomes “China cut the cable” begging what evidence lands. The merged field also overstates the cases where only presence exists, and it understates the cases where tasking evidence exists but the execution was outsourced, a leased hull, a paid recruit, a contractor. Downstream this gets worse when a policy maker cites the weak field as a finding, a vendor report cites the policy maker, and the original evidence base, one AIS track, goes unverified. The Soufan and EuRepoC designs avoid the triad risk because they record confidence per variable, a leg of a table instead of the whole thing. Keeping them separate while connected means something like high confidence on presence, moderate on attribution, and none on tasking.
The physical table needs the same separation. Bloomberg’s 2018 Supermicro report is still unverified, denied by everyone involved, and instructive for exactly this reason: it merged a hardware claim, an actor claim, and a tasking claim into one. Then the hardware claim was weak and it made a decade of serious supply-chain concern look unsteady. The documented Chinese activity is different in kind: supply-chain access and pre-positioning inside operational technology. My old friends over at Dragos tracked it as VOLTZITE, overlapping the group others call Volt Typhoon, living inside critical-infrastructure OT. Planning and execution get their own columns. A group pre sabotage is NOT post sabotage, and the database has to know what time it is.
I’m old enough to remember hacking critical infrastructure in the 1990s by compromising Cisco routers at mass scale. The pre-2000 layer of ICS and infrastructure incidents, across sectors and across borders, still remains old timer lore instead of a proper ledger. Meanwhile, we have these resources:
| Resource |
Access |
Coverage |
| Hybrid CoE |
Open |
Research publications and the Hybrid CoE and EU-JRC conceptual model, the closest existing document to a shared hybrid-threat vocabulary |
| The Soufan Center, Russian Hybrid Tactics in Europe 2022-2025 |
Open |
Incident-level dataset, 2022-2025, attribution-confidence coded |
| EuRepoC |
Open |
Cyber incidents from 2000, roughly sixty variables, critical-infrastructure and attribution trackers |
| DOE OE-417 annual summaries |
Open |
US grid disturbances including physical attacks, archived to 2000 |
| PNNL event-correlated outage dataset |
Open |
OE-417 joined to EAGLE-I county-level outage data on OEDI |
| Michael Mabee’s OE-417 consolidation |
Open |
The DOE summaries cleaned into a single CSV |
| ACLED |
Open |
Political-violence and sabotage event data, codeable for kinetic incidents |
| GDELT |
Open |
Global event database, broad and noisy, minable for physical incidents |
| Global Terrorism Database (START) |
Open |
Over 200,000 terrorist attacks worldwide from 1970, more than 100 coded variables including infrastructure target types, coverage through 2020, access by request |
| ICPC |
Open |
Submarine cable protection, infrastructure and international-law reference |
| TeleGeography Submarine Cable Map |
Open |
The geography under the cable-cut attribution work |
| NATO StratCom COE |
Open |
The influence and information side of the hybrid picture |
| NERC E-ISAC |
Member |
Grid physical-security reporting |
| Janes |
Paid |
The strongest structured coverage of the kinetic and military-hybrid side |
| Recorded Future, Geopolitical Intelligence |
Paid |
Facility and physical-threat monitoring in real time |
| Dragos (Accenture majority stake, June 2026) |
Paid |
OT and ICS, where cyber produces physical effect |
| Nozomi Networks |
Paid |
OT and ICS, where cyber produces physical effect |
| Claroty |
Paid |
OT and ICS, where cyber produces physical effect |
| Control Risks |
Paid |
Geopolitical and physical risk with incident feeds |
| Crisis24 |
Paid |
Geopolitical and physical risk with incident feeds |
| S-RM |
Paid |
Geopolitical and physical risk with incident feeds |
| Sibylline |
Paid |
Geopolitical and physical risk with incident feeds |
| Eclypsium |
Paid |
Firmware and hardware integrity, the T1200 corner directly |
| Interos |
Paid |
Supply-chain exposure mapping |
| Fortress Information Security |
Paid |
Supply-chain exposure mapping |
Now ask yourself where is the middle dataset. A hybrid operation is distinct in how it works both ends of the attribution threshold, begging a path between them.
You can run it like this: pick a hull that implicates a third country, a flag that hands jurisdiction to an uncooperative state, damage that reads as plausible accident, a crew that can be abandoned. Each variable of the triad gets degraded on purpose. Presence is arranged to point sideways, attribution is split across jurisdictions that struggle to share a case file, and tasking stays offshore behind a broker and a payment. The operation succeeds when the incident, inverse to any good history book, leaves the reader confused about “both sides”.
That inverts the usual data problem. An incident we label cleanly, with an actor confirmed and tasking established, failed as an operation, means our more sparse database is the one to measure adversary success. The empty cells become the evidence, our findings. A record that says presence high, attribution open, tasking unknown documents the adversary’s investment in staying unresolved, and a column counting years-unresolved per incident would measure the campaign better than any actor label.
Waiting for resolution before recording anything means waiting for the adversary to justify being recorded, which becomes ennoblement of those “unseen”. The middle path records the incident at the confidence the evidence supports and lets the confidence describe what’s outside the middle.
Classification does the same work domestically in Germany, for example, let alone Italy. It drops politically accelerant violence into a bucket of simple crime to look away from when the victims are migrants. German state interior ministries registered 2,558 politically motivated attacks on asylum shelters between 2015 and 2018, producing 206 convictions. In other words, the German infrastructure treats a burning federal housing center that displaces people as a routine police crime report. Burning critical infrastructure that displaces people, however, gets a false-flag report of domestic terror, bemoaning another year of dead-ends.
The cables are exposed, easily damaged, and the ambiguity haunts investigators: a disposable hull switching flags, a disputed captain, and a Swedish prosecutor refused permission to board the Yi Peng 3. The Chinese team ran the inspection instead with Europeans only as observers. Meanwhile the evidence has changed character.
Cyber threat intelligence is coders scripting quantitative telemetry, machine-generated and repeatable with integrity checks. Physical and hybrid evidence instead is qualitative testimony from interested sources, with forgery assumed on every record. The discipline required to handle the latter is called a historical method. The security field is simply, predictably lacking in that database because it is short of trained historians.
