Talk: Operational Twilight: APTs, OT, and the geopolitics of a dying climate

15:30-16:00 PDT Saturday | Aug 9^th2025
DEF CON Creator Stage 5 (Room 229) | Las Vegas Convention Center
Adversary Village Panel
Purple Teaming

We’re trying to debug the end of the world through trial and error — mostly error. In the middle of a worsening climate crisis, outdated OT protocols like Modbus are being exploited by state-sponsored actors in ways that turn environmental infrastructure into geopolitical weapons. From hijacked dams running Windows 95-era code to smart thermostats recruited into botnets fighting over Arctic oil, the climate-tech battlefield is already here. This session dives into how APTs are quietly compromising the systems designed to save the planet. We’ll examine real-world campaigns where threat actors have targeted energy grids, carbon capture labs, and EV infrastructure — and how climate action is being derailed by 1970s-era code and modern apathy. This is Cyber Threat Intelligence meets Climate Fiction (Cli-Fi). It’s weird, terrifying, and very real.

Detailed talk outline

1. The APT Climate Kill List

   Energy grids, carbon capture labs, fusion experiments. All vulnerable to outdated industrial protocols.

2. Modbus: The Protocol That Could Doom the Planet

   Why it still runs critical systems and how APTs use it to break things quietly, globally.

3. Case Studies from the Climate Cyberwar:
   • Russia’s “Dark Winter”: How Sandworm used Modbus exploits to freeze cities and reignite fossil fuel demand.
   • China’s “Silent Grid”: APT41 attacks on solar farms and EV chargers using embarrassingly simple flaws.
   • North Korea’s ESG Ransomware: Lazarus fakes green activism to target carbon credit markets.
   • Iran’s “Sandstorm”: Hacking water sensors to worsen droughts in rival nations.
4. Weaponizing Threat Intel for the Climate Age

   Correlating geopolitical shifts with ICS/OT vulnerabilities, and why CTI teams need a climate lens.

5. The Future of Climate Cyberwar

   AI-powered hydrogen plant attacks, quantum ICS exploits, and why COP30 could become a hacker playground.

6. Cyber-Climate Resistance

   Hunting the enemies of planetary stability, defending legacy OT with minimal resources, and why a little cyber-idealism might still save the planet.

Attendee Takeaways:

• TTPs of APTs targeting OT and ICS systems: from MITM on Modbus to PLC disruption.
• How to connect threat intelligence to geopolitical and environmental events.
• Forecasting cyberwar in a warming world and building proactive defenses now.