Critical Infrastructure Targets - Reyhford Threat Intelligence

Critical infrastructure is defined differently by each country, but adversary interest clusters around sectors where cyber effects become physical or geopolitical.

Priority sectors we see reflected in probing

Sector	Typical protocols	Why it is targeted
Electric power	IEC 104, S7, Modbus	National resilience; wartime precedence
Fuel / midstream	Guardian AST, Modbus	Inventory intel; pipeline/IT coupling (Colonial)
Water / wastewater	Modbus, proprietary	Public health; often under-resourced OT
Manufacturing	EtherNet/IP, S7, Modbus	IP theft + ransomware leverage
Buildings / campuses	BACnet	Physical access, HVAC, bridging to IT

Why honeypot geography matters

Attackers scan globally, but regional concentration of certain protocols (e.g. Guardian AST intensity near SEA) reveals collection priorities. Owned capacity today is SEA (edge-sgp-001); the network grows with customer-enrolled sensors — compare “internet background radiation” vs region-specific campaigns as coverage expands.

Defensive takeaway

Map your asset inventory to these protocol classes, then subscribe to Reyhford indicators filtered by protocol/confidence. Pair with Southeast Asia landscape and actor profiles.