Simulation: “Operation Fault Line” — A Coordinated Assault on Malaysia’s Critical Infrastructure

Security & Geopolitics Calculating...

🇲🇾 Malay

🇨🇳 Mandarin

🇮🇳 Tamil

↩️ Show Original

JoeGetz
28 Oct 2026
34
SubCategory | Regional Security

Simulation: “Operation Fault Line” — A Coordinated Assault on Malaysia’s Critical Infrastructure

by JoeGetz, 28 October 2026

Simulation Premise and Attack Vector

This simulation posits a coordinated, multi-domain attack by a sophisticated state or state-sponsored actor. The objective is not mass casualties but strategic paralysis—eroding public confidence, testing the seams between agencies, and exposing interdependencies that cannot be defended in silos. The attack unfolds in phases over 72 hours.

Phase 1 — Pre-positioning (Days -30 to 0): Adversaries exploit supply-chain compromises in operational technology (OT) equipment and spear-phish engineers at grid and water operators, establishing persistent access without triggering alerts. They map the IT-to-OT bridges that connect corporate networks to SCADA supervisory stations.

Phase 2 — Simultaneous Disruption (Hour 0):

Power: A false-data-injection attack on TNB’s grid management system manipulates load readings, prompting automated protective relays to trip across three interconnected regions. The SCADA system reports normal conditions while physical breakers are open—creating a blind spot that delays human diagnosis.
Water: Attackers alter pressure-setpoints and change default credentials in internet-exposed water-treatment OT systems, causing pressure loss and contamination alerts across multiple states. Manual switchover is possible but slow, and the public announcement is delayed by the need to verify whether the readings are genuine.
Communications and Internet: A physical disruption at a subsea landing station—combined with a targeted DDoS on a major internet exchange—degrades international bandwidth. Malaysia’s reliance on foreign transit hubs like Singapore and Hong Kong means that when those routes are stressed, domestic traffic localisation is poor, and the “digital highway” narrows to a crawl.
Broadcasting: Primary broadcast transmission sites lose grid power. Backup diesel generators activate, but fuel resupply is delayed because road networks and logistics are themselves disrupted. The public turns to radio, but not all community radio infrastructure has hardened redundancy.

Phase 3 — Exploitation of Confusion (Hours 6–48): As agencies scramble, the adversary launches a ransomware attack on a regional airport operator’s corporate IT, freezing check-in and baggage systems. This is not the primary attack but a shaping operation—designed to stretch incident-response capacity across transportation, communications, and security agencies simultaneously. Disinformation spreads on social media claiming the water is poisoned and the grid collapse is permanent, deepening public panic.

Preparedness Assessment: The Architecture That Exists

Malaysia is not without a framework. The National Disaster Management Mechanism has been updated: MKN Directive No. 20, the long-standing guidance, was replaced in 2024 by Arahan NADMA No. 1, which places greater emphasis on disaster risk reduction, prevention, and preparedness rather than reactive relief. For the communications sector, MCMC has issued a Disaster Management and Recovery Framework aligned with the national directive, specifying pre-disaster, during-disaster, and post-disaster roles for the regulator, service providers, and industry players.

On the cyber side, NACSA is the national lead agency, and the Malaysia Cyber Security Strategy 2025–2030 (MCSS) sets out ten strategic goals across four focus areas, explicitly targeting the protection of National Critical Information Infrastructure (NCII). The Cyber Security Act 2024 (Act 854) imposes statutory duties on NCII sector leads, including mandatory cyber-defence validation through red-teaming. TNB has contingency measures for generation fleet stability and grid redundancy (N-1 criteria), and has conducted flood-risk assessments for its assets. MCMC has developed PRIME, a vehicle-based mobile communications system combining satellite, cellular, radio, Wi-Fi, and drone technologies for deployment when terrestrial networks fail.

These are real capabilities. But the simulation exposes where they are insufficient.

Contingency and Disaster Recovery: The Gaps the Simulation Reveals

Interdependency Is Acknowledged but Not Operationally Managed. The Sabah power outage—triggered by a single 275kV tower failure—demonstrated how “utilities don’t fail alone”. The water sector depends on electricity for pumping and treatment; communications depend on power; broadcasting depends on fuel logistics; and data centres depend on water for cooling. Yet there is no publicly available evidence of a national-level, cross-sector interdependency risk assessment that maps these cascading failure pathways and assigns joint recovery priorities. Sectoral frameworks exist in parallel, not in synthesis.
OT Security Remains the Weakest Link. Malaysia’s NCII sectors are increasingly connected to corporate IT, but OT environments in water, energy, and manufacturing often run on ageing infrastructure, default credentials, and insufficient maintenance. The Cyber Security Act has firm duties, but one year in, the law is “showing some strain”—staffing shortages, incident-reporting hurdles, and uneven readiness across sectors, particularly for NCII operators outside well-resourced industries. The most significant gap is people: there are not enough trained OT-security professionals to cover every critical site.
Digital Sovereignty Is a Structural Vulnerability. Malaysia’s internet resilience score is 71/100, but its traffic localisation score is only 44/100—meaning a substantial portion of domestic traffic routes through foreign exchanges, exposing NCII sectors such as banking and healthcare to single points of failure outside national jurisdiction. The proposed Malaysia-US undersea cable is a strategic response, but it will not be ready for service until late 2028 at the earliest. In the interim, the nation remains a “spoke” in a regional wheel centred elsewhere.
Public Communication and Trust Are Under-Exercised. The simulation’s disinformation phase exploits a real gap: there is no evidence of a standing, multi-agency public-communication protocol for simultaneous infrastructure failures. MCMC’s framework includes media management provisions, but these are procedural, not strategic. When the grid, water, and internet fail at once, the public needs a single, credible voice explaining what is happening, what to do, and when normalcy will return. That voice cannot be improvised.
Red Teaming Is Framed as Compliance, Not Continuous Readiness. The availability of red-teaming guidance for CNII is a positive step, but the framing is largely regulatory—meeting the requirements of Act 854. The simulation’s attack succeeds because adversaries spent thirty days pre-positioning. One-off annual exercises cannot detect persistent, low-and-slow intrusions. Continuous adversary emulation—with safety controls—must become standard for the most critical nodes, not a procurement checkbox.

Additional Areas a Sovereign Nation Must Fortify

The simulation points to domains that Malaysia’s current framework under-addresses:

A National Interdependency Command. Beyond sectoral regulators, Malaysia needs a standing Critical Infrastructure Interdependency Cell under the National Security Council, with authority to prioritise recovery across power, water, telecoms, and transport when failures cascade. This cell must conduct regular joint exercises that simulate simultaneous, multi-sector attacks—not single-sector disasters.
Sovereign Compute and Data Residency for NCII. The Sovereign AI Cloud initiative is a necessary step, but it must be extended beyond government data to the operational data of NCII operators—grid telemetry, water-quality readings, port logistics. If that data sits on foreign-controlled infrastructure, the nation cannot guarantee its integrity during a crisis.
A Civilian Cyber Reserve. Malaysia’s OT-security talent shortage cannot be solved by hiring alone. A civilian cyber reserve—comprising retired engineers, academics, and certified professionals—could be activated during a national incident to reinforce understaffed NCII operators. This is not a substitute for full-time capacity, but a surge capability that recognises the “people gap” as the most acute vulnerability.
Hardened, Decentralised Broadcasting Resilience. The reliance on diesel generators and primary transmission sites is a single point of failure. A national network of hardened, solar-powered community broadcast nodes—capable of operating independently of the grid for extended periods—would ensure that the “last man standing” radio function is genuinely resilient, not merely redundant on paper.
A Public-Trust Communication Doctrine. The government must pre-script and pre-test public messaging for infrastructure emergencies, with a designated single spokesperson and pre-agreed thresholds for disclosure. The doctrine should acknowledge uncertainty explicitly—“we do not yet know the cause; here is what we are doing; here is what you should do”—rather than waiting for full verification, which adversaries will exploit.

Verdict: Frameworks Without Synthesis

Malaysia has components of preparedness: NADMA’s revised directive, NACSA’s strategy, MCMC’s recovery framework, TNB’s grid contingencies, and the Cyber Security Act’s statutory duties. But the simulation reveals a synthesis deficit. The frameworks operate in sectoral silos; the interdependencies are acknowledged in documents but not exercised in practice; the talent gap in OT security is severe; and the nation’s digital sovereignty is compromised by reliance on foreign transit routes that it cannot control.

The “Operation Fault Line” scenario is not a prediction. It is a stress test of a system that has built many of the right pieces but has not yet proven that they fit together under the conditions of a simultaneous, sophisticated, and patient attack. The next step is not more frameworks. It is joint exercises that fail honestly, followed by the political will to fund the gaps those failures expose.

Disclaimer

The views and opinions expressed in this article are solely those of the author and do not necessarily reflect the official stance of Kritik.com.my. As an open platform, we welcome diverse perspectives, but the accuracy and integrity of contributed content remain the responsibility of the individual writer. Readers are encouraged to critically evaluate the information presented.