China's Salt Typhoon Hits Water Utilities; ASD Urges 3-Month OT Isolation

For cybersecurity practitioners, the ASD's CI Fortify guide marks a pivotal moment where OT network segmentation moves from a best practice to a national-security mandate. The explicit 90-day isolation recommendation rewrites incident response playbooks and reflects the realization that nation-state adversaries are now pre-positioning inside industrial environments with the intent to cause physical disruption. The Five Eyes joint authorship signals that this is a coordinated, intelligence-driven response to an escalating threat landscape.

The Australian Signals Directorate (ASD) on July 27, 2026 released a landmark 16-page security guide — CI Fortify — co-signed by the Five Eyes intelligence alliance, explicitly designed to shield critical infrastructure from nation-state cyberattacks. The guidance arrives against a backdrop of intensifying campaigns by China-sponsored groups, most notably Volt Typhoon and Salt Typhoon, who have shifted focus from conventional IT espionage to pre-positioning inside operational technology (OT) environments of water, energy, and telecommunications providers. The document is not a routine advisory; it represents a tactical evolution in defensive architecture, advocating a radical measure: isolate OT networks for up to three months when a breach is detected. This reflects a stark acknowledgment that industrial control systems (ICS) and associated OT devices — pumps, switches, valves — are now primary targets precisely because they are easier to compromise.

“

Volt Typhoon’s documented targeting of US critical infrastructure further validates the Five Eyes warning.

The vulnerability stems from a decade-long, unplanned convergence. Utilities have wired legacy OT gear — designed for reliability, not security — into corporate IT networks for efficiency and remote management, but without cybersecurity-inherent design. ASD’s Heidi Hutchison told AAP that connectivity built over the past 10 years often lacks basic security tenets, making OT an inviting target. This architectural blind spot is what the CI Fortify guide seeks to correct by urging providers to segment OT from IT and maintain the ability to run operations in an isolated “safe mode” for an extended period. The strategic implication is profound: defenders are signaling that they no longer expect to contain a breach within days; at the national-security level, a utility’s capacity to sustain service while forensics scrub the network is now a core resilience metric.

The timing is deliberate. Just weeks earlier, Telstra’s national outage cascaded across retail, transport, and emergency services, underscoring the real-world impact of network failures. While the Telstra incident has not been publicly attributed to a specific threat actor, it demonstrated the systemic fragility the threat groups exploit. The Salt Typhoon campaign, in particular, has drawn alarm because of its ability to pre-position within water and energy firms — planting deep, latent access that can be activated for espionage or, more feared, destructive attacks on physical infrastructure. Volt Typhoon’s documented targeting of US critical infrastructure further validates the Five Eyes warning. The joint authorship by Australia, Canada, New Zealand, the UK, and the US suggests a coordinated intelligence assessment that critical infrastructure across all five nations is at a heightened, immediate risk.