When Geopolitics Hits the Keyboard: Why Critical Infrastructure and Its Trusted Advisors Are Under Cyber Attack

Click here to view/listen to our blogcast.

Over the past several months, cybersecurity headlines have followed a clear and troubling pattern. Critical infrastructure organizations are being targeted by cyber threat groups tied to nation states, either directly sponsored, quietly condoned, or operating as proxy “hacktivist” collectives aligned with geopolitical goals.

What makes this trend especially concerning is that many of these attacks are not sophisticated zero-day exploits. Instead, they rely on exposed systems, weak credentials, and trusted relationships that were never designed to withstand sustained geopolitical pressure.

Recent reporting from Dark Reading highlights how politically motivated hacktivist groups are increasingly targeting energy, transportation, healthcare, and other essential sectors, often using simple but effective techniques against poorly secured, internet-facing systems. This reflects a broader shift in how modern cyber conflict is conducted.

The Blurring Line Between Hacktivists and Nation States

In today’s threat landscape, the distinction between independent activists and government-backed operators is often academic. Many groups exhibit characteristics of state alignment:

• They operate in coordination with geopolitical events
• They avoid targets in their home countries
• They focus on long-term access, reconnaissance, and positioning
• They use publicly available tools and known vulnerabilities to avoid attribution

From a defender’s perspective, intent matters less than impact. Once access is gained, even a low-skill actor can disrupt operations, exfiltrate sensitive data, or create downstream risk for entire sectors.

Why These Attacks Matter Beyond Traditional Critical Infrastructure

Many organizations assume that if they are not a utility, hospital system, municipality, or manufacturer, this type of threat does not apply to them. That assumption is increasingly dangerous.

Critical infrastructure does not operate in isolation. It relies on a web of professional service providers, vendors, and advisors that often have trusted access, sensitive data, or privileged communications.

This is where law firms, CPA firms, and medical practices enter the picture.

Professional Services Firms as Strategic Targets

Lawyers, accountants, and healthcare providers frequently service organizations that are regulated or safety-sensitive. As a result, they often become indirect targets in broader campaigns.

From an attacker’s perspective, these organizations offer several advantages:

• Access to confidential documents, contracts, audits, and compliance records
• Trusted email relationships that bypass suspicion
• Remote access paths into client environments
• Generally weaker security controls than their largest clients

Rather than attacking a hardened target directly, threat actors increasingly compromise a trusted advisor and pivot inward.

Common Abuse Scenarios We Are Seeing

These patterns show up repeatedly in incident investigations:

• Compromised law firm email accounts used to request sensitive documents or payment changes
• CPA firms targeted for tax records, financial disclosures, and audit materials
• Healthcare practices breached for identity data, insurance records, or workforce information tied to critical services
• Stolen credentials reused across multiple client environments
• Long-term access maintained quietly for future use, not immediate disruption

These are not smash-and-grab attacks. They are patient, opportunistic, and designed to exploit trust.

Why Regulators Are Paying Attention

Regulatory frameworks increasingly recognize that third-party risk is systemic risk. Examples include:

• NYDFS 23 NYCRR 500, which explicitly addresses vendor and service provider security
• HIPAA requirements for protecting PHI through business associate safeguards
• GLBA obligations to secure financial data throughout its lifecycle
• NIST and CISA guidance emphasizing supply-chain and trust-relationship risk

In practical terms, this means organizations are now expected to ensure that their advisors and service providers maintain reasonable cybersecurity controls.

If you service regulated or safety-sensitive clients, your security posture affects their compliance, resilience, and risk exposure.

Practical Steps Organizations Can Take Now

You do not need a nation-state budget to reduce nation-state risk. Many effective controls are well understood and achievable. Key priorities include:

• Audit and minimize internet-facing systems, especially remote access and admin interfaces
• Enforce strong, phishing-resistant MFA for email, VPNs, and cloud platforms
• Eliminate shared credentials and over-privileged access
• Segment client data and internal systems
• Patch edge devices and identity infrastructure aggressively
• Centralize logging and monitor for abnormal access patterns
• Maintain an incident response plan that includes client notification obligations

These steps directly address the techniques most commonly used in recent campaigns.

How CDML Computer Services Helps

CDML works with organizations and professional service firms that understand their role in larger ecosystems. Our focus is on reducing exposure, strengthening identity and access controls, improving visibility, and aligning security practices with real-world regulatory expectations.

We help clients move from reactive security to deliberate risk management, with clear documentation, practical controls, and response planning that stands up under scrutiny.

Final Thoughts

Geopolitical cyber activity is no longer theoretical. It is an ongoing condition that affects not only critical infrastructure operators, but also the trusted professionals who support them. Law firms, CPA practices, healthcare providers, and other advisors are now strategic nodes in broader threat landscapes. Treating cybersecurity as part of professional responsibility is no longer optional.

If your organization supports regulated or safety-sensitive sectors and would like help assessing exposure or strengthening defenses, CDML Computer Services is here to help.

Stay safe. Stay informed. Stay compliant.

📞 Contact us here: https://cdml.com/contact/
📚 Read more on our blog: https://cdml.com/blog-2
📺 Listen to our blogcasts: https://www.youtube.com/@CDMLComputerServices