NSA: Nation state actors aren't after your data — they want your OT

At RSA Conference, current and former NSA cybersecurity directors warned that nation-state APTs and hacktivists are shifting from pure espionage to long-term persistence and potential disruption of critical infrastructure and OT systems. They described quiet, infrequent check-ins using legitimate credentials, exploitation of end-of-life SOHO routers to build botnets (e.g., Volt Typhoon activity), and unsophisticated but dangerous attacks against water, energy and other sectors; advised defenders to retain and analyze logs for subtle indicators, strengthen identity/authentication, and prepare for AI-enhanced phishing.