The core of the Energy Assault Script was a deception engine. It intercepted telemetry data from the wind farm’s sensors. When turbines generated 40 megawatts, the script reported only 32 megawatts to the grid operators. Simultaneously, it fabricated a phantom load from a decommissioned substation, tricking the load-balancing algorithm into believing demand was 15% higher than reality.

Investigators found no malware, no ransomware note, and no encrypted files. The Energy Assault Script had been designed to self-delete from RAM after execution, leaving only corrupted log files. The only evidence was a single anomalous entry in the historian database: a voltage spike that lasted exactly 0.3 seconds longer than physically possible—the footprint of a lie.

The attackers didn’t bother with a zero-day exploit. Instead, they deployed a custom tool the cybersecurity firm Mandiant would later codename

In layman’s terms:

Here is what the script did, step by step.