Historical intelligence backfill. This assessment covers reporting originally published on 2026-08-29 and was added to the RWP archive on 2026-09-07.
Late August OT — a small UK generator went dark four days; S7 hunts do not pause for that
Week of 22–29 August 2026. UK small-operator generation: late-July cyber, four days dark, disclosed 24 August. AA26-231A is nine days old and still the U.S. hunt. No new Stage 2 ICS malware in public reporting this week.
Bottom line up front
CONFIRMED as reporting: a UK small generating station — late-July cyber, about four days offline, public write-ups 24 August. That is availability at a small operator, which is the gap (thin OT staff, shared IT, slow vendor) more than a new malware name. RWP's own 24 August Daily Top covers the incident; this weekly does not reprint it.
AA26-231A (19 August) is still the U.S. control: S7-200 through S7-1500, TCP/102, snap7-class scripts. Water PSA (30 July) is a month old and not closed. Dragos Q2 still said zero Stage 2 ICS kill-chain cases — do not use a UK generator outage to overturn that census without process-level evidence.
UNKNOWN public, primary confirmation that the UK event was unauthorized ladder-logic change versus IT/hypervisor/remote-access wipe of the plant's Windows layer. Brief it as a generation-availability incident until that evidence exists.
OT threat posture
Small operators lose days. Large-vendor S7 fleets are in a USG hunt. Those are different briefing slides.
1. Most significant development
UK small-operator outage as the week's dated availability hit; S7 advisory as the continuing U.S. action item.
2. Adversary / campaign activity
No new joint advisory this week. S7 recon/capability development remains USG. Do not attribute the UK generator to the S7 advisory without evidence.
3. Vulnerabilities and active exploitation
No new CISA ICS stack in this seven-day window that changes the ticket order. Exposed 102 and internet PLCs still beat waiting for a CVE.
4. ICS / SCADA impact
UK: CONFIRMED multi-day generation outage in public reporting; mechanism UNVERIFIED here. U.S. water: prior PSA. Winnipeg HVAC: prior week, still context for BMS.
5. IT-to-OT exposure
Small generation often means one Windows jump host and a vendor VPN. That is enough.
6. Sector impact
Electric generation (small). U.S. manufacturing/water/energy still on S7 hunt.
7. Defensive priorities
- Finish S7 internet-exposure eradication.
- Small-operator IR retainers and known-good images — four days is the cost of not having them.
- Do not skip BMS after Winnipeg.
- Keep Dragos's Stage 2 negative finding in the board deck.
8. What changed from last week
A named availability incident landed. The S7 advisory aged from “just out” to “are you hunting.”
9. What OT defenders should watch next
September CISA ICS drops (Logix CIP DoS, Ignition, IXON). Whether UK reporting names a malware family.
10. RWP assessment
Confidence: High that late August was hunt-plus-small-operator-availability. Low that a new ICS malware family dropped. Next RWP weekly OT on this site (7 September) is the first live cycle; this page is archive.
Historical intelligence backfill of the week ending 29 August 2026; added 7 September 2026.
Sources
- RWP Daily Top — UK small generator four-day outage
- CISA — AA26-231A Siemens S7
- Dragos — Q2 2026 industrial ransomware (no Stage 2 ICS cases)
- FBI/EPA — 30 July 2026 WWS internet-facing PLC PSA