Utilities, energy sector attacked mainly via IT, not ICS