Stuxnet

The Stuxnet worm recorded normal centrifuge sensor readings for thirty days before beginning its destructive sequence. It then replayed those recordings back to SCADA monitoring stations while physically destroying equipment, demonstrating that the most dangerous attack is not one that looks suspicious—it is one that looks exactly like normal operations.