OT and ICS Telemetry Deception

False data fed to industrial control systems and the AI that reads them.

Ukraine's Blackjack group claimed it disabled 87,000 Moscow sensors with Fuxnet, but Claroty estimated about 500 gateways were actually bricked. Claims and verified damage in OT attacks can differ by two orders of magnitude.

Fuxnet: claimed against verified: Sensors claimed at first 87,000; Gateways targeted, revised claim 2,659; Gateways attacked, revised claim 1,700; Gateways bricked, Claroty estimate ~500 FUXNET: CLAIMED AGAINST VERIFIED Sensors claimed at first 87,000 Gateways targeted, revised claim 2,659 Gateways attacked, revised claim 1,700 Gateways bricked, Claroty estimate ~500 DEVICES, LOG SCALE
Industrial orgs hit by ransomware, 2025
3,300
Ransomware groups targeting industry
119
Average OT dwell time
42 days
Registry incidents
0

Evidence

Malware that speaks industrial protocols cut heat in Lviv and blinded sensors in Moscow

Documented cases: OT and ICS Telemetry Deception
DateCaseCountryWhat happenedSource
Jan 2024FrostyGoopUkraineModbus malware cut heat to about 600 Lviv apartment buildings for nearly two daysSource
Apr 2024FuxnetRussiaWiped sensor gateways and flooded sensor links with junk framesSource
Oct 19, 2025National Time Service Center allegationChinaMSS claims the NSA used 42 tools against China's timing center; not independently verifiedSource
Feb 17, 2026Dragos year in reviewGlobalThree new OT groups; VOLTZITE moved deeper into control systemsSource

Registry

No registry incident turns on OT telemetry deception yet

The cases above are documented, but none yet meets the registry bar of a named developer, a failed control and a known finder.

Exposure

13 of 17 agent types rate very significant or critical on perception and sensors or connectivity surface

From the attack surface ratings, the agent types where this risk has the widest path in.

Agent types most exposed
Agent typeDimensionRating
Robotaxis and autonomous vehiclesPerception and sensorsVery significant
Humanoid robotsPerception and sensorsVery significant
Industrial robots and cobotsPerception and sensorsVery significant
Autonomous trucksPerception and sensorsVery significant
DronesPerception and sensorsVery significant
Fleets and swarmsConnectivity surfaceVery significant
Phones and tabletsPerception and sensorsVery significant
WearablesPerception and sensorsVery significant
Vehicle cabin AIPerception and sensorsVery significant
Smart home assistantsPerception and sensorsVery significant
Medical devicesPerception and sensorsVery significant
Public infrastructurePerception and sensorsVery significant
Ambient sensorsPerception and sensorsVery significant

Controls that bound it

Rules

OT security rules are mature; none addresses AI reading falsified telemetry

Rules that address OT telemetry deception
RuleJurisdictionWhat it requiresStatus
Cybersecurity Law amendment and CII regulationsChinaFines up to RMB 10 million for infrastructure function lossJan 1, 2026
NIS2 DirectiveEURisk management and 24-hour early warningDeadline Oct 17, 2024
NERC CIP-015-1North AmericaInternal network monitoring in grid systemsApproved 2025
IEC 62443InternationalSecurity levels and zones for industrial automationCurrent

Status colors: green in force, blue voluntary standard or framework, amber adopted and phasing in, gray draft or pending, red withdrawn.

Record

Page Record

Risk group
Data Risks
Datasets
ai_risk_evidence.csv (4 rows); registry incidents (0 linked); ai_attack_surface.csv
Key sources
FrostyGoop
Fuxnet
National Time Service Center allegation
Dragos year in review
Last verified
October 2026