Network monitoring solutions detect unusual lateral movement between the IT and OT networks, indicating the attackers are attempting to access the SCADA systems controlling the power grid. A suspicious connection attempt from an internal IT network to the OT network was observed using a compromised user account.