Cyber Attacks That Don't Break Systems but Desynchronize Them

Question

By Muhammad Ali Khan ICS/ OT Cybersecurity Specialist - AAISM | CISSP | CISA | CISM | CEH | ISO27001 LI | CHFI | CGEIT | CDCP

When Everything Is “Up” but Nothing Is Right

In traditional cybersecurity, success is often measured by visible impact: systems go down, alarms trigger, production stops. However, in OT and ICS environments, some of the most dangerous cyberattacks do not cause outages at all.

Instead, they desynchronize systems.

Controllers keep running. HMIs stay online. Data continues to flow. Yet the system slowly drifts out of alignment, in time, state, logic, or trust, until operators are making decisions based on a reality that no longer exists.

These attacks don’t break systems. They break coordination, which in industrial environments can be far more dangerous.

What “Desynchronization” Means in OT / ICS

Desynchronization occurs when multiple components of an industrial system no longer share a common understanding of reality, even though they appear to be operational.

This can happen across:

• PLCs and safety controllers
• Sensors and control logic
• Control networks and historian systems
• OT and IT monitoring layers
• Primary and redundant systems

The result is a system that is technically running but operationally lying.

Why Desynchronization Attacks Are So Dangerous

They evade traditional detection

• No crashes
• No malware alerts
• No obvious anomalies

They exploit trust in deterministic systems

• OT assumes predictability
• Operators trust that “if it’s running, it’s correct.”

They degrade safety margins silently

• Safety logic may act on stale or false inputs
• Redundancy becomes ineffective

They create human-induced failures

• Operators respond correctly… to incorrect data

The system fails cognitively before it fails mechanically.

How Attackers Gain the Position to Desynchronize Systems

Desynchronization attacks are rarely the initial intrusion. They are post-access attacks, executed after an attacker has already gained a foothold in the OT environment.

The initial access is often unremarkable and easily dismissed as low risk:

• Compromised remote vendor access
• Shared or weak engineering workstation credentials
• Misconfigured firewalls between IT and OT
• Infected laptops used for maintenance
• Supply-chain compromises in software updates or integrator tools

What makes desynchronization dangerous is that it does not require high privileges or destructive actions.

Once inside, an attacker only needs limited, strategic influence over:

• Time synchronization sources
• Sensor data paths
• HMI data flows
• State replication between redundant systems
• Historian ingestion pipelines

From there, the attacker can remain quiet.

No ransomware. No shutdowns. No obvious commands.

Just small, intentional distortions introduced slowly enough to blend into normal process noise. This is why many desynchronization incidents are never identified as cyber events.

By the time consequences appear, the original access vector is long gone, logs are misleading, and the failure is attributed to operations, maintenance, or aging infrastructure.

Common Desynchronization Attack Patterns

1. Time Desynchronization Attacks
Many ICS environments rely heavily on accurate time:

• Event correlation
• Sequence of events (SOE)
• Safety interlocks
• Load balancing
• Fault diagnosis

An attacker subtly manipulates:

• NTP servers
• Time sync traffic
• GPS timing sources

Impact:

• Events appear out of order
• Faults are misdiagnosed
• Incident investigations fail
• Safety systems react late or early

Nothing crashes, but forensics, safety, and control logic become unreliable.

2. Sensor — Controller Desynchronization

Here, sensors are manipulated while control logic remains untouched (or vice versa).

Examples:

• The temperature sensor reports lagged values
• Flow sensors drift gradually
• Pressure readings are delayed by milliseconds

The PLC is executing correct logic on incorrect inputs.

Impact:

• Overcompensation in control loops
• Equipment stress and fatigue
• Inefficient or unsafe operations

• Eventual mechanical failure was blamed on “maintenance issues.”
  This is especially dangerous in:

• Power generation

• Chemical processing
• Water treatment
• Oil & gas refining

3. HMI–PLC Reality Drift

In this scenario:

• PLCs operate normally
• HMIs display manipulated or cached data

Operators believe they are:

Opening valves
Reducing load
Shutting down systems

In reality:

Commands are delayed
States are falsified
Feedback loops are broken

Impact:
Operators lose situational awareness
Emergency response is delayed
Manual intervention worsens the situation
This attack doesn’t target machines first; it targets human decision-making.

4. Redundancy Desynchronization

Industrial systems rely on redundancy:

• Primary/secondary PLCs
• Active-passive controllers
• Failover networks

A subtle attacker can:

• Delay sync traffic
• Modify state replication
• Introduce asymmetric network latency

Both systems are “healthy”, but no longer identical.

Impact:

• Failover causes unexpected behavior
• Safety logic diverges
• Redundancy becomes a liability instead of protection

5. Historian and Control Layer Mismatch

In this attack:

The control layer sees real-time data
Historian records altered or delayed data

Management, engineers, and auditors rely on historical data for:

• Performance analysis
• Compliance
• Predictive maintenance

Impact:

• False conclusions
• Missed early-warning signs
• Strategic decisions based on fiction

The attack succeeds long after it ends.

Why Traditional Security Tools Miss This

Most cybersecurity tools look for:

• Malware signatures
• Network intrusions
• Known attack patterns
• System crashes

Desynchronization attacks exploit:

• Protocol trust (Modbus, DNP3, PROFINET, OPC)
• Timing assumptions
• Implicit synchronization
• Lack of semantic validation

There is no exploit to patch, only assumptions being abused.

Real-World Consequences

Desynchronization can lead to:

• Near-miss safety incidents
• Equipment damage with no clear cause
• Regulatory violations without obvious breaches
• Loss of operator trust in automation
• Long-term reliability degradation

These incidents are often labeled as:

• “Human error”
• “Aging infrastructure”
• “Process instability”

When in reality, they may be cyber-induced cognitive failures.

How to Defend Against Desynchronization Attacks

1. Monitor for Consistency, Not Just Availability

• Validate cross-system state alignment
• Compare sensor, controller, and historian data=
• Look for subtle drift patterns

2. Secure Time as a Critical Asset

• Harden NTP and time sources
• Monitor clock skew actively
• Treat time anomalies as security events

3. Add Semantic Validation

Does the data make sense?
Is the control action logically consistent with process physics?

4. Segment and Authenticate OT Communications

• Reduce implicit trust between systems
• Use authentication even inside “trusted” zones

5. Train Operators to Recognize Cognitive Anomalies

Teach signs of desync:

• “This doesn’t feel right”
• Conflicting indicators
• Repeated unexplained adjustments

Human intuition remains a powerful detection tool, if trained correctly.

Conclusion: The Future of OT Attacks Is Subtle

Cyber attacks against industrial systems are evolving.

The goal is no longer to:

-Shut systems down

• Cause obvious chaos

The goal is to:

• Quietly shift reality
• Erode trust
• Let the system fail itself

In OT and ICS, desynchronization is the new disruption, and detecting it requires thinking beyond uptime, malware, and alarms. Because the most dangerous system is not the one that stops working… It’s the one that keeps working incorrectly