A well-designed industrial ransomware simulation does not seek a technically perfect response: it seeks to expose, in real time and in front of a room full of colleagues, what decision each organization makes when it does not yet have all the information. <\/p>\n\n\n\n
That was the focus of the panel \u00abHour Zero: Orchestrating Continuity and Resilience in Industry 5.0\u00bb of Industrial Cyber Summit Chile 2026<\/a>, an executive microsimulation conducted by Carolina Eyquem<\/strong>, Head of Strategy and Risk in Cybersecurity at SONDA, alongside three leaders representing different links in the same energy chain: Pablo Silva<\/strong>, CISO of GNL Quintero; C\u00e9sar Maldonado<\/strong>, CIO IT\/OT and director of a generation company; and Daniel Soto<\/strong>, Deputy Director of Cybersecurity Chile at CGE S.A.<\/p>\n\n\n\n The scenario, initially clarified as fictitious and unrelated to the actual architectures of the companies present, was an industrial ransomware evolving in three phases\u2014detection, propagation, and recovery\u2014along the fuel, generation, transmission, and distribution chains. The exercise made something clear from the very first minutes: coordination among links in the energy chain does not begin when there is a confirmed blackout. It begins much earlier, when there is still no certainty that something serious is happening.<\/p>\n\n\n\n The scenario began at 18:35 on a winter afternoon, in a LNG plant: an operator detects that an HMI interface stops responding, a ransomware note appears in an engineering station, the historian becomes unavailable, and anomalous activity is detected in an OT remote access. The controllers continue to operate and there is no physical condition of uncertainty, but much of the visualization and administration environment is no longer reliable.<\/p>\n\n\n\n Pablo Silva was categorical about the first move: activating the OT ransomware playbook and assuming that the attack is likely more widespread than is known at that time. Although there is still no certainty about actual impact on the operation, he insisted on immediately notifying the National Electrical Coordinator and the ANCI, because the indicators of compromise already available\u2014the identified malware, some IP addresses, and network behavior\u2014can be vital for the rest of the chain, even if the impact in that particular plant remains minimal.<\/p>\n\n\n\n C\u00e9sar Maldonado, on the other end of the chain, was asked whether he would expect a real impact before modifying his own generation commitment. His response was immediate: no. The proper protocols are activated at the first sign, and the concrete decision\u2014to switch to degraded operation or not\u2014depends on the technology involved: a thermal or gas power plant reacts differently than a hydroelectric one, but in both cases constant communication with the dispatch is non-negotiable. Daniel Soto, from transmission and distribution, added the final piece to the puzzle: warning the involved teams early, even if it\u2019s with a simple \u00abthere may be an impact; stay alert,\u00bb so as not to end up receiving a hundred panic calls instead of twenty well-managed ones.<\/p>\n\n\n\n Thirty-five minutes later, the scenario revealed that the compromised credentials belonged to a provider that services several companies in the energy sector, and that those same credentials could have been used against other clients. It didn\u2019t mean that the ransomware had physically traveled from one company to another, but it did mean that there was a common vector: a possible campaign across various OT environments, with intermittent telemetry in distribution and anomalous access in transmission, although the SCADA remained available in all cases.<\/p>\n\n\n\n This phase left two very concrete technical concepts on the table. Daniel Soto located the problem in the 3.5 zone of the Purdue model \u2014the point of boundary between IT and OT\u2014 and explained that in the face of anomalous access attempts, it is to be expected that a privileged access management tool (PAM) will cut off active sessions and start new ones while a war room dedicated exclusively to the incident is activated. C\u00e9sar Maldonado, for his part, explained how microsegmentation \u2014DCS, PLC and RTU isolated from the engineering stations that do communicate with the IT\/OT world\u2014 allows operations to continue with the stable unit even if the engineering station is compromised, always informing the national electrical system under the deadlines required by the regulations: three hours to report a suspected incident to the ANCI, a little less to the Electrical Coordinator.<\/p>\n\n\n\n Source: Panel \u00abHour Zero: Orchestrating Continuity and Resilience in Industry 5.0\u00bb, Industrial Cyber Summit Chile 2026.<\/em><\/p>\n\n\n\n A criterion that the three panelists repeated in different ways during this phase was that it is preferable to \u00aboverreact\u00bb in the response and to communicate it to the regulator in a timely manner rather than underestimating the incident. Daniel Soto added a useful warning for any organization that believes that forensic analysis is a matter of minutes: a real investigation can take three to four hours, not the seconds shown in television series, and the role of the leader of cybersecurity at that moment is to translate that into strategic decisions for the business, without constantly interrupting the technical teams that are resolving the incident.<\/p>\n\n\n\n Two hours after the start of the scenario, the campaign was partially contained and the recovery of HMI, engineering stations, and telemetry began. But the existence of backups did not guarantee anything in itself: the question, as Eyquem summarized, was no longer how to contain but when to trust again.<\/p>\n\n\n\n Pablo Silva was emphatic about a detail that often goes overlooked: ransomware first targets the \u00abhot\u00bb backups \u2014those that are connected to the network\u2014 to encrypt them as well, which is why the only real guarantee is having a \u00abcold\u00bb backup, disconnected, and having tested it before needing it. C\u00e9sar Maldonado took the standard one step further: restoration must be done in an isolated \u00abclean room\u00bb environment, with firmware validation and PLC alongside the vendor, and requiring at least three proofs before reconnecting any asset \u2014an anomalous traffic in zero, a signed checklist with the vendor, and a match between the data shown by the remote operation room and what is actually observed on the ground. Daniel Soto summarized the same principle from risk management: without a completed reconnection checklist, simply no connection is made, no matter how much commercial pressure there is to get back up and running quickly.<\/p>\n\n\n\n The panel's final reflections coincided on something that goes beyond any tool: a critical infrastructure ransomware rarely seeks to destroy the plant as an ultimate goal, but rather to generate loss of trust in the data or an economic gain, and the only real defense against that is having practiced the scenario before it actually happens. Pablo Silva proposed taking the publicly documented attack chains and testing them in tabletop exercises aligned with the own business. C\u00e9sar Maldonado went further: in the more mature exercises, the board should be involved, not just the technical teams, and also simulating the recovery of backups, because a plan that has never tested its own recovery is, strictly speaking, not a plan. Daniel Soto concluded with the point that connects this exercise with the rest of the Cybersecurity in critical infrastructures<\/a> From the country: include the providers in those tests, because many of the actual attack vectors \u2014 like the one in this very scenario \u2014 enter through there.<\/p>\n\n\n\n Eyquem closed the panel with the phrase that gives it its name: you don\u2019t have to wait for the next ransomware to discover whether an organization is prepared. The invitation is to try today, in a controlled exercise, how it will respond when the real zero hour arrives. <\/p>","protected":false},"excerpt":{"rendered":" Un simulacro de ransomware industrial bien dise\u00f1ado no busca una respuesta t\u00e9cnicamente perfecta: busca exponer, en tiempo real y frente a una sala llena de colegas, qu\u00e9 decisi\u00f3n toma cada…<\/p>","protected":false},"author":6,"featured_media":22813,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-22812","post","type-post","status-publish","format-standard","has-post-thumbnail","category-ciberseguridad-industrial-y-ot"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\tPhase 1: an HMI that stops responding<\/h2>\n\n\n\n
Phase 2: when the problem stops being local<\/h2>\n\n\n\n
Phase<\/th> Time elapsed<\/th> Key decision<\/th><\/tr><\/thead> Detection<\/td> 18:35 h, minute 0<\/td> Activating the playbook and notifying ANCI and the Electrical Coordinator of an early warning<\/td><\/tr> Propagation<\/td> +35 minutes<\/td> Isolate and contain without stopping the operation; activate the war room<\/td><\/tr> Recovery<\/td> +2 hours<\/td> Restoring in an isolated environment and requiring evidence before reconnecting<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n Phase 3: Restored is not the same as reliable<\/h2>\n\n\n\n
The lesson that no technology replaces<\/h2>\n\n\n\n