State-Sponsored Cyber Attacks Target U.S. Critical Infrastructure: What Houston Businesses Must Know

Nation-state actors and criminal ransomware crews want opposite things, and that changes how you defend.

A ransomware crew wants to be noticed, because noise is how it gets paid. A state-sponsored actor wants the exact opposite: to get in, go silent, and stay for as long as it takes, so the defense that stops one is not the defense that stops the other.

Ransomware is loud on purpose. It encrypts your files, drops a note, and demands money, and you know within hours that you have a problem. State-sponsored pre-positioning is the quiet cousin. The goal is not disruption today. It is a foothold that can be activated during a future conflict or crisis, which means the operator's success depends on you never finding out they are there. The CISA advisory on Volt Typhoon describes exactly this: patient access into critical-infrastructure IT networks, held for years, waiting.

The technique that makes it work is called living off the land. Instead of dropping custom malware that antivirus might catch, the attacker uses tools that already ship with Windows and are used by real administrators every day: PowerShell, wmic, remote-management utilities, and stolen valid accounts. To a basic security tool, a state actor mapping your network with built-in commands looks like an IT admin doing their job. That is why the five-year dwell time is possible, and why a checklist built only for ransomware misses this threat entirely.

• Criminal ransomware: loud, fast, financially motivated, wants you to know so you pay. Detected in hours or days.
• Nation-state pre-positioning: quiet, slow, strategically motivated, wants a hidden foothold. Detected in months or years, if at all.
• The overlap: both often start the same way, with a stolen credential or an unpatched public-facing app. That shared entry point is where a small business gets the most defensive value.

Named groups make this concrete. Volt Typhoon and Salt Typhoon are both People's Republic of China operations; Volt Typhoon pre-positions inside energy, water, and transportation networks, while Salt Typhoon, active since at least 2019, burrowed into telecommunications backbone routers. Cyber Av3ngers, an Iran-linked group, went after U.S. water utilities by exploiting default passwords on internet-exposed control systems. Different flags, same pattern: find the weakest connected business and use it.

Steps 1 and 2 close the two doors these groups walk through most: stolen credentials and unpatched public-facing systems.

You cannot out-spend a nation-state, but you do not have to. The two entry points that matter most, a valid stolen account and an unpatched edge device, are the two you can fix without an enterprise budget.

Stolen credentials are the single most common way in. If an attacker can log in as a real user, they skip past the firewall entirely and start out looking legitimate. That is why identity is step one, not an afterthought. CISA's Cross-Sector Cybersecurity Performance Goals put phishing-resistant multi-factor authentication near the top of the list for exactly this reason, and they rank the options by strength: hardware keys using FIDO or WebAuthn are strongest, app-based codes are next, and SMS text codes are the weakest and the easiest to defeat.

• Step 1 - Lock down identity. Turn on phishing-resistant MFA, preferring FIDO or WebAuthn hardware keys, for email, remote access, admin accounts, and every vendor portal. Then hunt down and disable stale accounts: former employees, unused service accounts, and default logins. A credential nobody uses is a credential nobody notices being abused.
• Step 2 - Patch the exposed edge fast. Attackers weaponize newly disclosed vulnerabilities in VPNs, firewalls, and public-facing web apps within days. Inventory everything of yours that faces the internet, subscribe to vendor security advisories, and put emergency patching for edge devices on a defined clock, measured in days, not the next quarterly maintenance window.

These two steps are cheap relative to what they stop. A refinery contractor in Pasadena or a water-district vendor in Katy does not need a security operations center to turn on hardware MFA and patch a VPN on time. Those two moves alone remove the initial access method behind most of the sophisticated intrusions the government advisories describe.

Steps 3 and 4 assume someone might get in anyway, and make that foothold worth as little as possible.

Good security assumes a breach will happen eventually and plans for it. Segmentation limits how far an intruder can move, and behavior monitoring catches the quiet living-off-the-land activity that signature-based antivirus is built to miss.

If you run any operational technology, the pumps, controllers, sensors, or machine controls that keep physical work happening, keep it on a separate network from your office IT. Nation-state groups target the seam where business IT meets OT, because that boundary is where a foothold in email can become a hand on a physical process. A flat network where the front-desk PC can reach a production controller is a gift to an attacker. Segmentation turns one compromised laptop into a contained problem instead of a plant-wide one.

• Step 3 - Segment IT from OT and shrink the blast radius. Put operational technology, guest Wi-Fi, and sensitive business systems on separate network segments with strict rules about what can talk to what. If a controller only ever needs to talk to two systems, block it from reaching everything else. Containment is the difference between an incident and a shutdown.
• Step 4 - Hunt for living-off-the-land behavior. Because these actors use built-in tools, you cannot rely on antivirus alone. Watch behavior: an admin tool run from a workstation that never uses it, logins at 3 a.m. from a service account, PowerShell reaching out to the internet. This is where continuous monitoring or a managed detection service earns its keep for a business without a night shift.

In 35 years around this work, the businesses that recover fast from any intrusion are the ones that walled off their most important systems before anything went wrong. Segmentation is unglamorous and it is the control that most often turns a headline into a footnote. For a Gulf-Coast operation where a stalled controller can mean a stalled production line, that containment is not theoretical, it is the difference between a bad afternoon and a bad quarter.

Step 5 is the one small businesses miss: you are targeted for who you connect to, not for who you are.

A nation-state actor rarely attacks the hardened target head-on. It finds a smaller, softer vendor that already has trusted access, and rides that connection in, which is why supply-chain hygiene is a critical-infrastructure defense even for a ten-person shop.

The uncomfortable truth for a Houston SMB is that your value to a nation-state attacker is your connection to a bigger fish. A single compromised vendor can hand an attacker access to every client that vendor touches. If you have a VPN into a refinery's systems, remote access to a water district's controllers, or a login to an energy company's procurement portal, you are a path, and paths get targeted. CISA has increasingly warned that operational-technology attacks now enter through business IT and third-party vendor products rather than the front door.

• Step 5 - Vet vendors and demand least privilege. Work in both directions. Ask your own vendors how they secure their access to you, and give every vendor connecting into your systems the narrowest access that lets them do the job, nothing more. Time-box remote access, log it, and turn it off when the work is done. If a client audits your security before signing, treat that as the new normal, not an insult.

This is also becoming a sales advantage. Larger energy, manufacturing, and utility clients increasingly require their suppliers to prove baseline security before they will sign, and the small firms that can show phishing-resistant MFA, segmentation, and monitoring are winning work that less-prepared competitors cannot. Hardening against state-sponsored cyber attacks is starting to look less like a cost and more like a qualification to bid.

CinchOps is a managed IT services provider based in Katy, Texas, serving small and mid-sized businesses across the Houston metro area, turning a five-step hardening playbook into controls that actually run day after day.

CinchOps specializes in cybersecurity, network security, managed IT support, VoIP, and SD-WAN for businesses with 10-200 employees. Defending against patient, quiet attackers takes the same qualities, steady attention and real visibility, which is exactly what a managed partner provides:

• Identity-first security. Phishing-resistant MFA, least-privilege access, and cleanup of the stale and default accounts these groups exploit.
• Continuous behavior monitoring. Watching for the living-off-the-land activity that antivirus misses, so a quiet foothold does not become a five-year residency.
• Network segmentation. Walling off operational technology and sensitive systems so one compromised device cannot reach your production floor.
• Supply-chain and edge hardening. Vendor access controls plus fast patching of the VPNs and public-facing apps that attackers weaponize first.

You do not need a nation-state-sized budget to defend against a nation-state-sized threat. You need the handful of controls that close the doors these groups actually use, run consistently by someone who watches them. If your business in Houston or Katy sits anywhere in an energy, water, or manufacturing supply chain, talk to CinchOps and we will build the hardening that keeps you from being someone else's way in.