A server on the utility’s control center LAN running SQL was not patched. The worm apparently migrated through the corporate networks until it finally reached the critical SCADA network via a remote computer through a VPN connection.

The worm propagated on the control center LAN, blocking SCADA traffic.