Attackers were likely conducting reconnaissance to learn how they could modify safety systems so they would not operate in the event that hackers intended to launch an attack that disrupted or damaged the plant. Attackers may be conducting intelligence in preparation for a new end-of-year attack against Ukraine. The potential exists that commonly used equipment in a specific region can then be targeted by an adversary against identified infrastructure. A concern exists that campaigns against energy infrastructure in Ukraine may be used as a virtual proving ground in the development of tactics, techniques, and procedures (TTPs)”]