How state cyber warfare targets connected systems at runtime

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Karamba Security's blog post: State cyber warfare can turn connected systems into runtime targets when attackers can alter code and disrupt operations.

Why it matters: Security and identity teams need to treat connected devices as governed runtime assets, because detection alone does not prevent malicious modification in military, industrial or consumer environments.

Context

Connected systems fail differently from traditional IT because they cannot simply be taken offline, patched later and reintroduced without operational impact. When those systems control physical processes, the security problem shifts from perimeter defence to protecting the software and logic that runs continuously in place.

That is why runtime integrity becomes a governance issue as much as a technical one. If an attacker can modify code on a device, the blast radius extends beyond the device itself into the system it controls, which is why cloud region outage resilience is not the right mental model for this kind of threat but the resilience principle is similar.

Karamba Security frames the risk through military and infrastructure examples, but the starting position is not unusual. Any connected environment that depends on persistent availability and embedded logic faces the same exposure to tampering.

Key questions

Q: How do I detect runtime tampering in connected devices?

A: Detect runtime tampering by combining integrity monitoring, process and memory inspection, secure boot attestation, and file hash baselines on the device. Look for unexpected code sections, modified binaries, injected libraries, altered kernel modules, new privileged processes, or changes to firmware and configuration. Alert on deviations from known-good states and correlate them with signed update records and access logs.

Q: Why does network monitoring miss code injection attacks?

A: Network monitoring often misses code injection because the malicious change happens inside a running process or memory space after traffic is decrypted or already allowed. Packet inspection can show command and control or data transfer, but not injected shellcode, process hollowing, reflective loading, or tampered application logic unless endpoint telemetry, EDR, or runtime integrity checks are also present.

Q: How should teams protect critical systems that cannot go offline?

A: Protect systems that cannot go offline with layered controls that reduce change and limit blast radius: strict allowlisting, signed updates, segmentation, least privilege, immutable configuration, and high-availability failover. Use maintenance windows for patches, continuous integrity monitoring, compensating controls such as virtual patching or protocol filtering, and a tested rollback plan so availability is preserved while exposed surfaces are constrained.

Q: What happens when code tampering reaches operational technology?

A: When code tampering reaches operational technology, it can alter control logic, change sensor readings, disrupt physical processes, or hide unsafe states from operators. The impact is not just cyber compromise but loss of process integrity, safety margin, and reliable control. Defences centre on segmentation, signed logic, strict change control, engineering workstation protection, and monitoring that covers both IT and OT layers.

Technical breakdown

Why network detection misses runtime tampering

Network monitoring only sees traffic patterns and connection events. It does not reliably tell you whether the code executing on an endpoint, controller or embedded device has been altered after delivery. Runtime tampering matters because the attacker does not need to own the network path for the full duration of the compromise. A device can appear reachable, healthy and connected while its local software has already been subverted. That is why integrity checks at execution time matter more than simple perimeter inspection in environments where availability cannot be interrupted.

Practical implication: Treat runtime verification as a control requirement for continuously connected systems, not a post-incident forensic check.

How code injection changes device behaviour

Code injection in embedded or operational technology environments works by altering the instructions a device executes, not merely by stealing data. Once malicious logic is inserted, the attacker can change how the device responds to commands, telemetry or safety conditions. In cyber warfare contexts, that means an adversary may aim to interrupt, misdirect or degrade a system while keeping it online. The security challenge is not only preventing initial compromise, but ensuring that unsigned or unauthorised code cannot persist in the control path long enough to influence physical outcomes.

Practical implication: Require trusted execution and anti-tamper controls on any device whose behaviour affects safety or critical operations.

Why deterministic security matters in cyber-physical systems

Deterministic security means the protection model produces consistent, predictable outcomes under defined conditions. That matters in cyber-physical systems because small variations in software behaviour can create outsized operational effects. In these environments, defenders need controls that can resist modification, preserve known-good state and detect unauthorised change without relying on operator intervention. The article's point is that this is not optional resilience theatre. When a connected device stays in service continuously, the security model must assume active tampering attempts and still preserve trusted behaviour.

Practical implication: Design controls so the device can prove integrity and continue safe operation even under persistent attack pressure.

Threat narrative

Attacker objective: The objective is to change how a connected system behaves while keeping it operational long enough to cause real-world disruption.

1. Entry occurs through a connected system that remains exposed and cannot be removed from service without operational disruption.
2. Credential or code access is not the only goal. The attacker seeks a path to alter runtime instructions or trusted device behaviour.
3. Escalation comes from persistence inside the device or controller, where malicious logic can survive normal monitoring.
4. Impact is achieved when the modified system disrupts operations, safety conditions or physical processes at scale.

Breaches seen in the wild

• Poland ArcGIS password leak 2023: An ArcGIS login emailed in 2020 was published from stolen mail in 2023 and still worked, exposing Polish military and infrastructure maps.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Runtime integrity is the real control boundary for connected systems. Once a device cannot be safely disconnected, network visibility becomes insufficient as the primary defensive assumption. The decisive question is whether the system can resist unauthorized modification while it remains live. That makes integrity enforcement and trusted execution the governance problem, not just incident response.

State cyber warfare exposes a deterministic security gap, not just a geopolitical one. The article's core warning is that sophisticated actors can exploit product technology weaknesses in ordinary connected devices as easily as in military systems. That means defenders should stop treating advanced adversaries as an exceptional case and start treating tamper resistance as a baseline requirement across critical connected estates.

Cyber-physical risk is amplified when software change and operational change are inseparable. In these environments, a malicious code alteration is also a process alteration. That collapses the usual separation between cyber control and operational safety, so governance has to cover device integrity, update trust and runtime enforcement together.

Continuous availability changes the threat model for identity and access governance at the device layer. Connected systems often rely on persistent trust relationships, embedded credentials and remote management paths that are difficult to constrain once deployed. When those trust anchors are abused, the issue is no longer just access control but unauthorized behaviour inside the device lifecycle.

What this signals

Runtime integrity will become a baseline requirement for connected estates. As more operational systems remain continuously exposed, defenders will need controls that prove what is running on the device, not only what crossed the network. That shifts programme priorities from observation to enforcement.

Tamper resistance is the named capability gap. The practical issue is not whether an asset is connected, but whether it can resist unauthorized modification without breaking service. That will matter most where physical operations, safety and uptime are tightly coupled.

Identity teams should also watch the device management plane more closely. Persistent trust relationships, embedded credentials and software update paths can become the route through which an attacker alters runtime behaviour.

For practitioners

• Implement runtime integrity enforcement Use controls that verify code and configuration at execution time, not only at deployment time, for devices that cannot be taken offline safely.
• Restrict modification paths on connected devices Limit who and what can alter firmware, logic or runtime parameters, and treat every write path as a high-risk change channel.
• Assume network detection is not enough Pair monitoring with anti-tamper and known-good state validation, because traffic inspection alone will miss subverted local execution.
• Map critical device trust relationships Inventory the management channels, embedded credentials and software update paths that could let an attacker persist inside a connected system.

Key takeaways

• Connected systems are exposed to a class of cyber warfare that targets runtime behaviour, not just perimeter access.
• The strongest evidence in the source is the claim that attackers can modify code and disrupt military and infrastructure systems without relying on network detection alone.
• Defence has to move toward runtime integrity, anti-tamper controls and trusted execution for devices that must remain online.

Related NHI Mgmt Group resources: Cloud Region Outage Resilience · Group Managed Service Accounts (gMSA) Guide · Poland ArcGIS password leak 2023 · Sisense breach 2024

Key terms

• Runtime Integrity: Runtime integrity is the assurance that what a system executes matches what defenders expect at the moment of execution. It matters because malware or exploit code can change memory, cache, or process behaviour without changing the on-disk file, which makes artifact-based checks incomplete on their own.
• Code Injection: Code injection is a vulnerability where attacker-controlled input is interpreted as executable instructions. Instead of being treated as data, the input changes program behaviour, allowing actions such as database reads, shell commands, script execution, or unsafe object reconstruction.
• Cyber-Physical System: A cyber-physical system combines software, networking, and physical processes that influence real-world operations. In security terms, compromise can affect availability, safety, and production continuity, which is why containment and resilience controls matter as much as detection.
• Operational Technology: Operational Technology is the hardware and software that monitors or controls physical processes such as manufacturing lines, utilities, and transportation systems. Unlike standard IT, OT prioritises uptime and safety, so identity controls must be precise enough to reduce risk without interrupting essential operations.

Deepen your knowledge

The NHI Foundation Level course covers NHI governance, machine identity security and secrets management in a way that supports broader identity programmes. It is designed for practitioners who need to govern credentials, access and lifecycle risk across modern environments.