Who Comes for Infrastructure, and Why

Sort the threat landscape by motive and you can predict behavior. Three broad classes come at a facility, and only one of them should shape your worst-case plan.

Criminal actors want money. Ransomware crews encrypt what they can reach and extort payment; they are loud, fast, and opportunistic. They are dangerous, but their tempo and goals make them comparatively predictable, and their business model depends on being noticed. Hacktivists want attention and will deface, leak, or disrupt to make a point. Then there are state-sponsored actors — intelligence services and military cyber units — and their motives are strategic, not commercial. Those are the ones who reframe an AI data center from a business asset into a piece of contested terrain.

Why would a state care about your plant? Two reasons, and they compound. The first is espionage. Frontier AI models, the data used to train them, and the hardware supply that makes them possible are objects of intense national interest. A facility training such models is a concentration of exactly what a rival intelligence service wants to steal or understand. The second is disruption held in reserve. Modern doctrine among several major powers treats an adversary's critical infrastructure as something to be quietly compromised in peacetime so it can be degraded at the moment of maximum advantage — during a geopolitical crisis, a conflict, or a coercive standoff. A data center that underpins economic or military AI capability is precisely the kind of asset a state would want the option to switch off.

This is not theoretical. Public reporting from national cyber authorities over recent years has repeatedly described state-linked intrusions into power, water, transportation, and communications infrastructure where the intruders took no immediate destructive action. They established access, mapped the environment, and left themselves the means to return. The professionals gave this pattern a plain name: pre-positioning. The intent is not to act now but to be able to act later, on command, faster than the defender can respond.

Understand what that intent does to the adversary's behavior. A criminal wants to monetize access quickly, so speed beats stealth. A state pre-positioning for future effect wants the opposite: the access must survive undiscovered for months or years, so stealth beats speed. That inverts your detection problem. You are not primarily hunting a smash-and-grab. You are hunting a tenant who has moved in quietly, pays the metaphorical rent by staying invisible, and intends to be there when it matters.

The operational signatures follow from that goal. Patient actors favor techniques that blend into normal operations. They prefer stolen-but-valid credentials over malware, because valid logins look like work. They prefer the tools already present on the systems — the built-in administrative utilities, the remote-management features, the scripting engines — because using them raises no new-software alarms. The tradecraft term is living off the land. They move slowly, touch little, and clean up after themselves. In an OT context they will spend that patience learning the process: which controller governs which loop, what the normal setpoints are, how the failover sequence works, and therefore how to break it convincingly when the order comes.

There is a specific reason the plant, not just the IT estate, draws this attention. Stealing model weights is an IT-side objective, but the option to physically disrupt lives in the OT plant. If a state wants the ability to take a strategic AI facility offline at a chosen moment, the surest lever is not the corporate email server — it is the cooling and power controls that can strand the compute regardless of how healthy the servers are. That is why a serious infrastructure adversary will try to reach the plant, and why treating OT as out-of-scope for state-level threat modeling is a planning failure.

The defensive consequence is a change of mindset before any change of tooling. Quiet is not safe. A long stretch with no incidents may mean you are secure, or it may mean you are hosting a professional who is very good at being quiet. You cannot tell the difference by waiting. You can only tell by actively hunting for the signatures of stealthy persistence — anomalous valid-credential use, unexpected administrative activity, small unexplained changes in OT traffic — and by assuming, as a planning baseline, that a capable adversary is already interested in the exact machinery that keeps your GPUs cold.