This paper discusses how a cyber attack could take advantage of torsional resonances in the shaft of turbo-generators to inflict severe physical damage to a power system. If attackers were able to take over the control of a battery energy storage device, they could modulate the injection of this device at a frequency that matches one of the sub-synchronous resonance frequencies of a generator. Small changes in injection might be sufficient to excite one of these mechanical resonances, resulting in metal fatigue and ultimately a catastrophic failure in the shaft of the generator. Using a state-space model of the electromechanical system, the paper develops transfer functions linking the magnitude of the malicious injections to the magnitude of oscillations in the speed and angle of the various masses connected to the shaft. Numerical results from a two-area power system demonstrate the existence of vulnerable frequencies and show that damaging mechanical oscillations can be triggered without causing easily detectable signals at the generator terminals.