Pre-Positioning Is Not Ransomware With a Different Sponsor

“Our incident plan is built for ransomware, because that is the threat that actually hits utilities.”

Stop there.

Half of that sentence is true, and the true half is doing a lot of work to carry the other half.

Pre-positioned state access is not ransomware with a different sponsor.

A ransomware crew wants money.

It announces itself, because the announcement is the invoice.

It negotiates, because negotiation is the business.

It leaves when paid, or at least its incentive to stay ends when it is paid.

A criminal actor’s incentives are satisfied by payment, and are negotiable in principle.

A state actor pre-positioned in a utility wants something else.

The access.

Not the access as a route to a payout.

The access as the product.

It does not announce itself, because announcing itself destroys the thing it came for.

It does not negotiate, because there is nothing you hold that it wants in exchange.

It does not leave when paid, because nobody asked for payment.

A nation-state actor pre-positioned for disruption has no comparable off-ramp, because payment was never the objective.

Your plan has a section called “ransom decision”.

It has a section called “engage negotiator”.

It has a section called “restore from backup and return to service”.

Every one of those sections assumes the adversary eventually wants to be found.

These are people who would never write a fire plan that only covered fires which ring the doorbell first.

Yet write the same thing about intruders and it becomes the sector standard.

1. “But Ransomware Is What Actually Shows Up in Our Sector’s Incidents.”

Of course it does.

That is what shows up.

An adversary whose objective is persistent access has a very specific measure of success.

Nothing happens.

No ransom note.

No encrypted historian.

No outage.

No incident.

An incident log counts the adversaries that wanted to be counted, and then treats the count as a census.

Volt Typhoon is the reason this is not a hypothetical.

CISA, NSA and FBI attribute it to the People’s Republic of China.

It maintained undetected access inside US critical-infrastructure networks for at least five years.

Energy.

Water.

Communications.

Transportation.

Undetected means exactly that: for five years, it was in nobody’s incident count.

So the frequency argument has a sampling problem built into it.

The frequency of reported incidents measures the adversaries whose business model requires being reported.

It says nothing about the ones whose business model requires the opposite.

Frequency sets priority among the threats you can see. It cannot set the boundary of the threats you plan for.

2. “But Our Sector Risk Management Agency Already Sets the Threat Baseline.”

Look at what a sector is.

In the United States, Presidential Policy Directive 21, from February 2013, defines 16 critical-infrastructure sectors.

CISA is the national coordinator for all 16.

It is also the Sector Risk Management Agency for 10 of them, including Communications, Dams, Information Technology and, jointly with TSA and DOT, Transportation Systems.

The rest sit elsewhere.

Energy with the Department of Energy.

Water and Wastewater Systems with the EPA.

Financial Services with Treasury.

A sector is an ownership assignment.

It groups operators by what they run, regardless of who is targeting them.

Threat-actor classification works on a different axis entirely.

It sorts adversaries by what they want and what they can do.

Cross motive with capability and six recurring categories fall out: nation-state, cybercriminal, hacktivist, insider, mercenary or private-sector offensive actor, and opportunistic.

No category is a natural kind. They are analytic conveniences, and the same intrusion set can move between them as evidence accumulates.

A sector label cannot tell you which of the six is in your network.

The agency’s maturity does not change that either.

A sector’s regulatory maturity tracks how much independent enforcement authority its lead agency already had before 2013, and EPA’s role for water has run into the limits of its statutory authority.

Nor is the regulatory layer one layer.

A pipeline operator can face TSA security directives, PHMSA safety rules and state public utility commission oversight at the same time, each with its own audit cycle, none coordinating with the others by default.

Several audit cycles do not add up to one threat model.

A sector assignment tells you who owns the risk. It does not tell you who is attacking it.

3. “But We Would See Malware if a State Actor Were Inside.”

This is the objection the whole plan quietly rests on.

It is the wrong detector for this adversary.

Volt Typhoon kept its access by using the compromised environment’s own administrative tools rather than deploying malware.

The technique is called living off the land.

Nothing new is installed.

Nothing new is signed, or unsigned.

The tools are the ones your administrators use on Tuesday.

The accounts are valid.

An endpoint agent looking for malicious binaries is answering a question this adversary has already declined to be asked.

And this is not only a state habit.

Scattered Spider, a financially motivated group, barely uses malware at all either; its initial access runs through impersonating help-desk staff.

So “no malware found” is a finding about malware.

It is not a finding about access.

The property you need is visibility of legitimate tools used illegitimately.

Who ran which administrative tool, from where, against what, at what hour, under which account, and whether any of that matches a change record.

That is a behaviour question.

A signature feed cannot answer it, however current it is.

It also changes what “contained” means.

In the ransomware branch, containment is visible: the encryption stops, the note stops appearing, the affected hosts are isolated and rebuilt.

In the pre-positioning branch, there may be no host that looks different from any other.

The access lives in accounts, trust relationships and administrative habits.

Rebuilding a server does not revoke a credential that was never on it.

So the question the second branch starts with is not “which machines are infected?”

It is “which accounts and administrative paths would we be unable to tell apart from an intruder using them?”

That list is usually longer than anyone wants it to be.

Absence of malware is not absence of an adversary. Against living off the land, it is the adversary working as intended.

4. “But the Aliquippa Defacement Was a Nuisance, Not an Attack.”

Good.

Look at it closely, because it proves the opposite of what that sentence wants.

On 25 November 2023, CyberAv3ngers, linked to Iran’s IRGC, defaced a Unitronics programmable logic controller at a remote booster station of the water utility in Aliquippa, Pennsylvania.

The message read “You have been hacked, down with Israel.”

Loud.

Political.

Opportunistic, aimed at an Israeli-made product rather than at a multi-year objective.

That is a state-linked actor behaving nothing like Volt Typhoon.

Same sector.

Same broad category of sponsor.

Opposite posture.

One wanted to be seen by everybody.

The other spent at least five years making sure nobody saw it.

A plan that files both under “nation-state” has learned nothing it can act on.

A plan that files Aliquippa under “nuisance” and moves on has learned something worse.

It has learned that a state-linked actor reached a controller at a water utility, and decided the lesson is about tone.

The same sector faces both postures, from different state actors, at the same time.

Your plan needs to recognise each of them.

The loud one will recognise itself for you.

The quiet one will not.

5. “But We Are a Small Operator, and Nation-States Go After the Big Ones.”

The Aliquippa system served a combined population of roughly 3,000 across two townships.

Small municipal water authorities like it often have no dedicated cybersecurity staff at all.

Volt Typhoon’s reported access spanned water, alongside energy, communications and transportation.

Size did not keep either actor out.

It does not work as a filter, for a plain reason.

A small operator can still sit on a path.

A booster station feeds a system.

A regional operator connects to a larger one.

A communications provider carries traffic for a utility.

An adversary pre-positioning for future leverage is interested in where the access leads, not in your revenue line.

The opportunistic category makes the point from the other direction.

It is defined by the absence of a targeting decision: actors scanning for whatever is exposed and monetising what they find, including commodity ransomware deployed without regard to sector.

“They only go after the big ones” is a claim about targeting.

Half the taxonomy does not target.

Being small changes your resources. It does not change your threat model.

It does make the next objection more dangerous, because the small operator is the one most dependent on somebody else’s detection.

6. “But the ISAC Will Warn Us if Something Is Going On.”

Maybe.

Look at what the ISAC is, first.

Information Sharing and Analysis Centers are sector-specific, operator-funded nonprofits, not government bodies.

They emerged from Presidential Decision Directive 63 in May 1998.

Roughly 30 now operate under the National Council of ISACs, each with a 24/7 watch center.

The Electricity ISAC is run by NERC.

That is a real channel, and for a small operator with no security staff it may be the main one.

Now look at what it runs on.

In the United States, the Cybersecurity Information Sharing Act of 2015 gave companies sharing cyber threat indicators, including through ISACs, three things.

Liability protection.

An antitrust safe harbor for coordinating with competitors on threat data.

Exemption from Freedom of Information Act disclosure of what they shared.

It expired on 30 September 2025.

Congress reauthorized it retroactively in a spending bill signed on 3 February 2026.

Through 30 September 2026 only.

From 30 September 2025 to 3 February 2026 is 126 days: 31 in October, 30 in November, 31 in December, 31 in January and 3 in February.

For those 126 days, law firms were warning companies that monitoring their systems or sharing indicators might carry legal exposure.

The retroactive fix does not change what a cautious legal department did during them.

And the new window is shorter than eight months.

Here is the inference, and it is an inference.

Living-off-the-land access produces no malware sample to pass around.

What a peer can share is behaviour: which accounts, which tools, which patterns, seen where.

That is exactly the kind of indicator a member hesitates over when its legal protection is uncertain.

So the adversary hardest to see alone is the one whose detection leans most on the channel whose legal footing keeps hitting a deadline.

An ISAC is a channel, not a detector. Check the channel’s legal status before your plan assumes it is open.

7. No, This Does Not Mean Ransomware Planning Is Wasted.

It isn’t.

Payment-motivated crime remains a real threat to the same operators.

Criminal capability varies enormously, up to ransomware-as-a-service operations grossing tens of millions of dollars a year.

DarkSide, after Colonial Pipeline, publicly called itself “apolitical” and said it did not intend to create problems for society.

That statement is the business model talking, and your ransomware branch should be built for exactly that business model.

Nor does this mean every utility hosts a state actor.

Attribution is dated evidence.

Volt Typhoon’s five-year figure is an attribution by three US agencies, not a finding about your network.

The correction is narrower.

The plan needs a second branch.

A branch for an adversary whose objective is the access itself.

Whose success looks like nothing happening.

For whom no ransom note, no negotiation and no payment will ever mark the end of the incident.

8. What You Should Actually Do

Keep separate response branches for payment-motivated and pre-positioning adversaries. The ransomware branch ends in negotiation, restoration and return to service. The pre-positioning branch has no negotiation step, and its end condition is evidence that the access is gone, not that operations resumed.

Hunt for living-off-the-land use of built-in administrative tools and valid accounts, not only for malware. Tie administrative activity to change records. An administrative tool run with no matching change is a finding even when nothing malicious was installed.

Record each actor in your threat model by motive and capability, not by sector label. “Water-sector threats” is a population, not an adversary. Name the category, what it wants, and what it can do, and expect the category to move as evidence accumulates.

Name an owner for assets that span sectors. CISA treats data centers as falling within both Communications and Information Technology, with no single owner of the risk, and as of mid-2026 Congress was discussing standalone sector status. Until someone draws that line, draw your own.

Check the current status of the US Cybersecurity Information Sharing Act of 2015 before relying on it for ISAC sharing. It lapsed once. Its current extension ends on 30 September 2026. Your legal team should know which state it is in before your analysts decide what to share.

9. The Actual Model Is Not Complicated.

Sector designation answers: who owns this infrastructure, and which agency leads on it?

Threat-actor classification answers: what does this adversary want, and what can it do?

A ransomware plan answers a third question: how do we end an incident that the adversary also wants to end, on its terms?

Pre-positioned state access breaks that third question.

The adversary does not want the incident to end.

It does not want the incident to begin.

Built for extortion, your plan covers the adversary who sends an invoice.

Build the branch for the one that never will.

Sector assignments, statutory deadlines and actor attributions are dated evidence.

The durable point is not.

An adversary whose objective is persistent access has no payment off-ramp, and a plan built for extortion does not cover it.