"The targeted systems provided emergency shutdown capability for industrial processes," Mandiant said Thursday. "We assess with moderate confidence that the attacker was developing the capability to cause physical damage and inadvertently shut down operations."