The Balanced Campaign Party: AI Attackers Now Have Strength in Depth
In college, I played weekend-long D&D games. When we started a campaign, we spent some time balancing the party around the mission the Dungeon Master had set for us. We always wanted a combination of tanks (fighters) and support (healers, magic users, thieves).
A party with too many fighters would often die over small things, like needing to pick a lock and having no one who could. A party with too many support character classes would be exposed when the fighter ran low on hit points, and low-level monsters would kill the entire party.
Nobody ever made it through a campaign intact with a one-class party.
Attackers have learned the same lesson.
The solo adventurer is retiring
For most of OT security’s history, we planned against a solo adventurer. One skilled person, or a small crew, did every job: scouting, scaling walls, picking locks, fighting through, and carrying the loot out. That person got tired. That person had to pick a door because they only had so much time.
The game is not played like that anymore.
In October, CrowdStrike described an actor running “a dual-agent architecture in which a ‘Supervisor’ Claude Code agent selects the next task from a state machine (i.e., a predefined workflow of attack stages) and an ‘Executor’ agent performs the task.” CrowdStrike said that actor “has compromised at least 15 Argentina-based healthcare entities.”
TrendAI went further. It found a deployment where “44 agents shared the work.”
Now, none of these were plants. TrendAI targeted legacy web systems at smaller businesses and local public-sector organizations, and deep compromise was limited to a small proportion.
Reconnaissance, vulnerability discovery and validation, exploitation, command and control, persistence, data exfiltration, and automated reporting “formed a single, repeatable workflow.”
That’s a party. A scout, a lockpick, a fighter, someone carrying the loot, and someone writing up the session notes.
The human attacker became the Dungeon Master.
The popular narrative is that AI is replacing the attacker. But the reports don’t suggest that.
Sophos looked at intrusions by the group behind Aur0ra ransomware and said, “Human operators supplied VPN credentials, SOCKS access, targets, and objectives to the agents.” Then the agents did discovery, mapped credential-based attack paths, and “moved laterally with limited human involvement.”
That’s session zero.
In the world of D&D, the Dungeon Master tells the party the mission, hands over a map, and lets them play.
CrowdStrike’s account of a China-nexus group it tracks as VAPOR PANDA describes “multiple simultaneous engagements directed by a human operator.” The group “used ARTEX against more than 200 distinct organizations worldwide” in “at least 14 countries over an 11-day window,” and CrowdStrike confirmed post-exploitation activity at nine of them. SOCRadar’s phrase for a ransomware affiliate operation it took apart is the cleanest summary I’ve read: “AI-executed, human-approved.”
Here’s the thing though… A good DM can run one campaign over a weekend but a human with a party of agents can run several campaign tables at once, and step in only when the dice come up strange. Human time at the game table used to be the scarce commodity.
Attackers don’t need to roll a six to pick a lock that isn’t locked
Overnight into November 2, attackers remotely changed refrigeration controllers in supermarkets across Europe. In the Netherlands, a Danfoss spokesperson told the Dutch broadcaster NOS that the systems hit at seventeen or more businesses “were not on a secure network and had a default password” (my translation). In October, Danfoss advised customers to take those systems off the internet. Most did. A small number didn’t.
Nobody has said yet who did it or whether AI was involved, and I’m not about to either. But clearly, you don’t need a balanced campaign party to open that door.
When finding the door is cheap and easy, and the door is secured with a default password, the question of whether the door will be found, opened, and entered becomes a question of when, not if.
You can’t target what you can’t see
It’s pretty easy to see why we all wanted an invisibility cloak while playing D&D. If you can’t see a character, you’re guessing which square it’s in, and you’re rolling at a disadvantage. Many D&D spells wouldn’t let you target an invisible player at all (Even Tiamat, a five-headed dragon queen in the world of D&D, is still stuck with that rule, which is why an area-attack flame breath is a pretty good weapon to have!).
Rolling dice for a perception check is the D&D version of a network scan.
AI agents can’t attack an asset that doesn’t answer a perception check, no matter how many sixes they roll. The asset itself stops answering scans because it has an invisibility cloak. A “single, repeatable workflow” across many targets still needs to be able to see and find a target.
Over all those long, exciting and laughter-filled weekends, our campaign party never once beat a monster it couldn’t find. We went after the ones that were right in front of us.
If we couldn’t see it, we didn’t attack it. Most of the time we didn’t even know it was there.
Invisibility is now the most useful spell in OT.
– Cam Cullen, CMO, BlastWave
Frequently Asked Questions (FAQs)
1. How are AI-powered cyberattacks changing OT security?
AI-powered cyberattacks increasingly use coordinated teams of specialized AI agents to automate reconnaissance, vulnerability discovery, exploitation, lateral movement, and data exfiltration. Human operators can direct multiple attacks simultaneously, making cyberattacks faster, more scalable, and less dependent on continuous human involvement. OT security strategies must account for this increased automation.
2. What are multi-agent AI cyberattacks?
Multi-agent AI cyberattacks use multiple AI agents that perform specialized tasks within a coordinated attack workflow. One agent might identify vulnerable systems, another validate weaknesses, and another execute attacks. Human operators establish objectives and supervise activities. Researchers have documented attacks involving dozens of coordinated agents, demonstrating how automation can expand an attacker's capabilities.
3. How do AI agents perform network reconnaissance?
AI agents can automate network scanning, identify exposed devices and services, discover vulnerabilities, and map potential attack paths. These capabilities allow attackers to evaluate numerous targets with less manual effort. However, reconnaissance depends on what the attacker can discover and access. OT systems that do not respond to unauthorized scans are significantly harder for AI agents to identify and target.
4. Can network cloaking protect OT systems against AI-powered attacks?
Yes. Network cloaking reduces exposure to AI-powered reconnaissance by making protected operational technology (OT) assets invisible to unauthorized network scans and connection attempts. Rather than responding to probes, cloaked systems remain undiscoverable to unauthorized users. This disrupts reconnaissance-dependent attack workflows and reduces opportunities to exploit vulnerable industrial control systems.
5. What is the difference between network cloaking and traditional firewalls?
Traditional firewalls filter network traffic according to configured security rules, but their exposed interfaces may still be discoverable. Network cloaking goes further by preventing unauthorized users from discovering or directly communicating with protected assets. This reduces the attack surface before attackers can identify vulnerable systems, making cloaking particularly valuable for legacy OT infrastructure.
6. Why are legacy OT systems vulnerable to AI-driven cyberattacks?
Legacy OT equipment, including programmable logic controllers (PLCs), human-machine interfaces (HMIs), and refrigeration controllers, may have outdated software, weak authentication, default passwords, or limited patching options. AI-driven reconnaissance can help attackers discover exposed systems at scale. Network cloaking reduces this risk by restricting unauthorized access without requiring changes to the protected equipment.
7. Does network cloaking eliminate the need for other OT cybersecurity controls?
No. Network cloaking is an important preventive security layer, but it should complement Zero Trust access controls, network segmentation, strong authentication, and continuous monitoring. Cloaking limits unauthorized discovery and access, while additional controls help prevent lateral movement and contain threats if attackers compromise another part of the environment.
8. How can organizations defend against coordinated AI agent attacks?
Organizations can reduce exposure to coordinated AI attacks by preventing unauthorized network reconnaissance, removing unnecessary internet-facing connections, eliminating default passwords, enforcing Zero Trust access, and segmenting critical systems. Network cloaking adds a preventive layer by making protected OT assets undiscoverable to unauthorized AI agents, interrupting attack workflows before exploitation can begin.
How To: Protect OT Networks Against Multi-Agent AI Cyberattacks Using Network Cloaking
AI-powered attackers can coordinate specialized agents to discover vulnerabilities and execute cyberattacks at scale. Organizations can reduce their exposure by making critical OT infrastructure invisible to unauthorized reconnaissance and enforcing Zero Trust access controls.
Step 1: Identify critical and exposed OT assets
Inventory operational technology devices, including PLCs, HMIs, RTUs, industrial controllers, and legacy systems. Identify equipment accessible from the internet, corporate IT networks, or remote connections. Prioritize devices with known vulnerabilities, unsupported firmware, and default credentials.
Step 2: Evaluate network reconnaissance exposure
Determine which OT assets respond to unauthorized network scans, port probes, or connection requests. Identify unnecessary open ports, exposed services, and insecure remote access paths. These potential entry points provide the information that AI-powered reconnaissance agents need to discover and evaluate targets.
Step 3: Deploy network cloaking to hide critical OT systems
Implement a network cloaking solution such as BlastWave's BlastShield to prevent unauthorized users and AI agents from discovering protected OT assets. Position the security gateway to protect critical network segments and configure it to deny unauthorized connections. Protected systems should remain accessible to approved users while becoming unresponsive to unauthorized scans.
Step 4: Enforce Zero Trust authentication and access controls
Require users and devices to authenticate and receive authorization before accessing protected OT systems. Implement phishing-resistant, passwordless multifactor authentication and least-privilege policies. Restrict access to the specific equipment and services necessary for each authorized role.
Step 5: Segment OT networks to restrict lateral movement
Divide critical OT systems into logical security segments based on operational requirements and device functions. Apply granular communication policies that prevent unauthorized connections between segments. This helps contain threats if an attacker compromises an IT workstation, remote access account, or another network component.
Step 6: Validate cloaking effectiveness without disrupting operations
Test network visibility from unauthorized network locations to confirm protected devices do not respond to scans or connection attempts. Verify that authenticated operators retain access to required applications and controllers. Conduct testing through approved procedures that avoid disrupting production or sensitive industrial processes.
Step 7: Monitor and continuously improve OT protection
Review access logs, authentication events, network configurations, and attempted unauthorized connections. Identify newly exposed devices and validate that network cloaking and segmentation policies remain effective as infrastructure changes. Maintain a layered security strategy that addresses both automated AI threats and traditional attack methods.
Expected result
By combining network cloaking, Zero Trust authentication, and network segmentation, organizations can significantly reduce the discoverable OT attack surface, disrupt reconnaissance-dependent AI attack workflows, and strengthen protection for critical infrastructure.
The key takeaway: AI-powered attackers may have entire teams of specialized agents, but those agents still need a reachable attack path. Network cloaking helps prevent unauthorized discovery and access before exploitation begins.
American Water’s cyber incident shows why water utilities need stronger OT isolation to stop IT breaches from threatening critical infrastructure operations and availability.
Explore the complete analysis of 23 OT attacks that defeated firewalls, VPNs, and air gaps.
.svg)
.svg)
