It’s Monday, 10 a.m. The weekend fog has finally lifted. Blue- and white-collar workers are settling into the rhythm of the day, their keyboard click-clacks blending with the low rumble of trams carrying hundreds of people beneath the office windows. The city is awake, moving, functioning.
Then everything stops.
Screens go dark. Keyboards fall silent. Trams screech to a halt.
Phones come out. Emergency alerts follow: The local electricity distributor has suffered a major cyberattack, knocking out a third of the county’s grid. Estimated time to recovery? Not even the operator’s cybersecurity team knows. Their controls are crippled, and the backups are gone, too. With stronger isolation (air-gapping included), the outcome might have looked very different.
Key points of this article:
- Air gaps can keep critical systems out of attackers’ reach, but only when isolation is designed with the real world in mind.
- Physical air gaps reduce exposure, but do not make a system untouchable.
- Stuxnet, TRITON, and GoldenJackal show how adversaries use compromised people, malicious USBs, and weak processes to bridge air gaps.
- For critical infrastructure, the real value of air gapping comes from layering isolation with secure transfers, offline protection, and tested recovery.
What is an air gap in cybersecurity?
Let’s introduce the terminus technicus of the day: air gap. What is it, and how does it help actors in critical sectors?
Simply put, an air-gapped environment is a closed-loop collection of devices (e.g., PCs, servers, operational tech, etc.) that is physically isolated from external networks to reduce opportunities for unauthorized access and cyberattacks.
For example, imagine that you’re a hospital administrator in the U.S., where HIPAA dictates strict controls over medical data. To ensure impermeability of such records, the best control is to place them “off network” or, in other words, to add a layer of separation between them and connected IT.
Taking medical records off network should ensure that malicious access via internet-open and ready-for-a-compromise IT devices is negated outright, and that attacks won’t cause a disruption that results in unintended disclosure.
In many ways, air gapping is much akin to erecting an “enclosure” to make sure data doesn’t escape. One can achieve this in several ways, but the primary method is to fully cut off the system to be air gapped from the internet. The other option is to segment off only that system’s part of the network, but doing so does not provide all the security that’s needed.
What is network segmentation?Segmentation relies on dividing networks into zones (typically enforced through controls like firewalls and demilitarized zones), to regulate and monitor traffic. Air gapping, by contrast, removes that interaction entirely, physically disconnecting systems from one another.
Full isolation, however, is not always practical. Critical systems often still need controlled access to data, updates, or central oversight. Medical records, for instance, must be available to authorized staff when needed, while a wind farm cannot easily report back to a central control center if every site is completely cut off.
Running a large organization across multiple fully disconnected locations and systems can also become costly and operationally complex, especially when skilled operators are required at each site.
Still, air gapping adds a valuable security layer that can take many different forms, depending on its implementation.
Air gapping in critical infrastructure: A boon or a challenge?
But before we dive into the varied forms of air gapping, first, let’s circle back to the intro story, as it’s not just meant to bait readers. A similar situation almost transpired in Poland last year, where likely Russia-aligned attackers (identified by ESET as belonging to the Sandworm APT group) almost brought down a part of the power grid, assisted by the DynoWiper malware.
There are many reasons why a critical party like a power plant might want its systems to be “connected,” as in the modern age, connection is now often crucial for productivity and efficiency:
- Manufacturers and energy companies: Factory environments are becoming increasingly interconnected, driven by demand for enhanced supervisory visibility and control. This has led to the widespread enablement of remote OT management, whether through internal IT integration or third‑party access, expanding operational flexibility, but also introducing additional exposure pathways. This is even more true in the energy sector, due to its greater scale and complexity.
- Transportation: Rail systems, including signaling and control, are connected for more than operational reasons—safety factors are involved. This is true also in the maritime industry, where container cranes, terminal operating systems, and systems are either automated or effectively monitored and integrated via IT. Traffic systems also apply here (e.g., highway monitoring, tunnel controls, and etc.).
- Cities and utilities: The smarter our cities get, the more exposed they are. Public infrastructure (utilities), environmental systems (flood control) and surveillance (CCTV cameras) are now also centrally managed and remotely accessible, eroding the isolation they once relied on.
- ICT services: As regulators zero in on supply-chain attacks, the exposure of IT service providers comes into the spotlight. The connectedness of ICT services with any critical actor exposes them, potentially acting as a jumping-off point for attacks.
One can, of course, restrict these environments, for example, by segmenting PLCs (programmable logic controllers) and related devices from the internet; enforcing tightly controlled internal networks for systems like railway switches; or fully isolating such critical assets as recovery infrastructure.
Physical air gaps
Putting aside segmentation, let’s look at physical air gaps and how they work.
The principle is straightforward: A device or network is physically disconnected from external networks, including the internet. There is no network connection across that boundary, and any data transfer must happen manually, under human control.
That does not mean every device inside the air gap has to operate alone. Computers, servers, and industrial equipment can still communicate within an isolated network. What matters is that this network has no wired or wireless connection to the outside, as simply unplugging an Ethernet cable is not enough if another connection remains available, obviously.
For example, an organization might want to keep an operational technology (OT) environment separate from corporate IT, removing the network route between the two can result in a reduced exposure to attacks originating from outside the isolated environment. But it also changes how that environment is maintained: Updates, files, and security information would now need controlled offline transfer processes rather than being able to use a live external connection. Also, monitoring and protection must accommodate those disconnected conditions, as well.
Hence, the trade-off for stronger isolation is more deliberate, if not arduous, maintenance. And while removing external connections creates a substantial barrier, it does not ensure total security.
Can air-gapped systems be hacked?
Isolation can fail. The truth is that air-gapped systems are not completely sealed off from human activity (a major vector for cyber-attacks). Even physically separated environments often need updates, files, or maintenance data to move between systems. That transfer point, whether a USB drive, a trusted contractor, or a controlled process, can become the bridge an attacker needs, especially when social engineering is involved.
A great example is the father of all OT attacks, Stuxnet, which shocked the world in 2010 when it was deployed against a nuclear facility. Although the facility was believed to be fully isolated, it still relied on controlled data transfer mechanisms. The attackers leveraged malicious USB drives and trusted contractors to bridge the air gap. Once inside, the malware moved laterally across systems and reprogrammed industrial controllers, all while masking its activity.
One could argue that USB‑based compromise is not strictly a consequence of partial air gaps, but of air‑gapped environments in general. Even fully isolated systems typically depend on removable media for data transfer.
Only seven years later, in 2017, TRITON was used against safety-instrumented systems at a petrochemical plant, exploiting weaknesses in IT-OT segmentation (insufficient isolation) and compromising an engineering station within the safety system. From there, TRITON backdoored into the PLC, giving the attackers control over it. This intrusion ultimately failed though, as the systems shut down before the attackers could achieve their objective.
In both cases, isolation failed. Half-measures are not acceptable in critical sectors. Any gap, any, even physical ones, can be exploited with the right tactic.
ESET Research: The case of GoldenJackal bridging air gaps
ESET has also contributed to discovering … well, gaps, in air gaps. In 2024, ESET researchers reported on a series of attacks on governmental organizations in Europe by the GoldenJackal APT group, using tools capable of targeting air-gapped systems. These attacks took place in 2019, and between May 2022 and March 2024.
Compromising an air-gapped network is very resource intensive, but not impossible. In the span of five years, GoldenJackal managed to build multiple toolsets to manage the task: GoldenDealer (to deliver executables to systems via USB monitoring), GoldenHowl (a modular backdoor), and GoldenRobo (a file collector and exfiltrator).
The description of the attack is a bit complex (much like the environments it targeted), so bear with us for a moment.
Initially, GoldenJackal compromised an internet-connected system (likely via a malicious file). This file contained GoldenDealer, which self-replicates onto USB drives. When such a compromised drive was used within an air-gapped environment, the malicious program would execute, and GoldenDealer would collect information from the PC. Upon reinsertion of the drive to a connected computer, the program would communicate with a C2 server for additional executables to be run. When next inserted back into an isolated device, GoldenDealer, on its own, would execute these new programs.
How likely is it for a USB drive to travel between isolated and connected environments? When your air-gapped devices rely on physically distributed updates (such as via USB ports, for example), then the likelihood of using such a drive to bridge the airgap rises considerably.
Further air gap-penetrating GoldenJackal activity
In May 2022, ESET observed GoldenJackal targeting a governmental organization in Europe. The toolset still relied on USB drives to collect files, spread payloads, and exfiltrate files using some PCs in the organization’s network as servers to deliver files to other systems, while also using Impacket to help the attackers move laterally across the network.
During this campaign, GoldenJackal adopted a highly modular approach, deploying specialized components for file collection, staging, distribution, command delivery, and exfiltration. Different compromised systems could therefore support different parts of the operation according to their connectivity and position in the network: Some acted as local staging or distribution points, while internet-connected machines could exfiltrate collected data through services such as Google Drive or Outlook SMTP.
This modularity gave the attackers the flexibility to build a multistage path via the use of removable media to bridge isolated and connected environments without relying on a single, all-purpose implant.
What does such a modular approach achieve? Flexibility, and, potentially, stealth. By splitting the operation across different components and hosts, attackers can limit what any single machine does, reduce their footprint on individual systems, and adapt their toolset to take maximum advantage of the specific role played by each compromised device. Such an approach does not make malicious activity invisible, but it can make detection harder, especially in environments with limited internal monitoring.
In this context, an air gap is less an impenetrable barrier than a stretch of distance. If the “island” itself lacks strong internal controls, it simply becomes a more remote network with delayed visibility, which helps to explain why modular approaches like GoldenJackal’s can succeed.
Best practices for air-gapped security: A layered, offline approach
While air-gapped environments can significantly reduce exposure to cyber-attacks, isolation alone does not guarantee security. Organizations must also address risks associated with human error, physical access, and controlled data transfers.
Thus, air-gapped systems are most effective when supported by strong operational processes and additional security controls, such as:
- Offline cyber protection: Ensure that the environment can maintain uninterrupted security, data confidentiality, and operational continuity, even when fully isolated. This reduces dependence on external connectivity and eliminates exposure from network-based threats.
- On‑prem threat detonation: Analyze suspicious or unknown files locally rather than sending them externally. This protects sensitive data from leaving your environment while still enabling effective threat investigation.
- More secure update mechanisms: Avoid ad hoc methods like USB transfers or temporary unsecured connections. Instead, use controlled, purpose-built update processes to deliver patches and intelligence safely and on time.
- Flexible deployment: Choose solutions that operate reliably across diverse setups: from private networks to air‑gapped systems. This ensures consistent protection and reduces the risk of attackers exploiting environment-specific weaknesses.
- Secure data handling: Even isolated systems require backups or occasional file transfers. Establish tightly controlled processes for transferring and managing sensitive data. This prevents tampering, reduces the risk of unauthorized changes, and ensures trust in the integrity of your data.
- Planning for regulatory readiness: Keep sensitive data within isolated environments, and implement strong on-site controls like logging, monitoring, and reporting. This simplifies compliance efforts, strengthens auditability, and aligns data sovereignty requirements.
For organizations with complex infrastructure and strict isolation requirements, ESET PRIVATE Air-Gapped Solutions help deliver layered protection that supports secure operations across even the most restricted environments.
Also, don’t forget to test recovery capabilities regularly. Many organizations use air-gapped environments to protect backups. However, backups only provide value if they can be successfully restored when needed. Regular testing helps ensure that recovery plans will work during a real incident. Alongside this practice, penetration testing is also a good idea, to make sure that the “gap” is as tight as it should be when put against a simulated attack.
Conclusion
Critical infrastructure organizations face a difficult balancing act. Greater connectivity enables better efficiencies and visibility but also creates new opportunities for attackers. Air-gapped environments help reduce this risk by limiting exposure to external networks and restricting potential attack paths. However, as real-world incidents have demonstrated, isolated systems can still be compromised through indirect methods, such as removable media, supply-chain compromises, or insider activity.
Nonetheless, when intentionally architected as part of layered security control, air‑gapped environments remain one of the most effective ways to reduce systemic exposure, forcing adversaries into more complex, more resource‑intensive, and ultimately more detectable attack paths.
Next steps for building air-gapped resilienceExplore secure deployment options. Discover how ESET supports digital independence with flexible deployment options, including air-gapped environments in Gartner’s Europe Context: 2026 Magic QuadrantTM for Endpoint Protection report.Benchmark public-sector readiness. Explore the SANS 2026 Government Readiness Survey to gain data-driven insights into how government agencies are preparing for the evolving threat landscape.Talk to an expert. Speak with an ESET expert, and explore how to accelerate your cybersecurity readiness in complex ecosystems.
FAQ: About air gaps
What is an air-gapped system?
An air-gapped system is a device, network, or environment that is isolated from external networks, especially the internet, thereby reducing the risk of unauthorized access and of a resultant cyber-attack.
Who should air gap?
Critical infrastructure operators, such as energy providers, transportation entities, healthcare organizations, and utilities, use air gapping to protect operational technology (OT), backups, and sensitive data from cyber threats that could disrupt essential services.
Can hackers breach air-gapped networks?
Yes. While air-gapped environments are much harder to compromise, attackers can still use methods such as infected USB drives, compromised contractors, insider threats, or supply-chain attacks to gain access. Breaching an air-gapped network typically requires more time, resources, and sophistication though.
Is air gapping still relevant in the era of cloud and connected infrastructure?
Absolutely. As critical environments become more interconnected, air gapping remains a valuable security strategy for protecting high-value assets, backup repositories, and mission-critical systems. Modern organizations, should, however, combine air gapping with layered security controls, not only to balance resilience, compliance, and operational efficiency but also not to ensure that an air gap is not relied upon as the sole protection measure.
