Log in Request a demo
Industry · Energy And Utilities

Know What Attackers Can See Of Our Network.

Operators of energy and utility services depend on systems that must keep running. Attackers look for exposed ones first, so it helps to look for them first.

Request A Demo See The Platform
What We Watch For Energy And Utilities 4 Threats

In Short

Energy and utility operators run systems that must stay up, and some of them are reachable from the internet. Attackers look for exposed network devices and remote access first, and state-backed groups have been documented in these sectors. Knowing what you expose, and who is active, lets you fix problems before they are used.

At A GlanceExposed network devices, destructive attacks, ransomware and state-backed groups that target energy and utility operators, and the rules that apply.

Main Threats

What Threatens Energy And Utility Operators.

Technique Exposed Network Devices Routers, VPNs and firewalls that face the internet. CISA reports that Volt Typhoon got in by exploiting known or zero-day flaws in public-facing appliances like these. Open Technique → Incident Destructive Attacks On Energy Sites On 29 December 2025 coordinated destructive attacks hit more than 30 wind and solar farms and a combined heat and power plant in Poland. CERT Polska reports the attackers entered through internet-facing VPN and firewall devices. Read The Incident → Glossary term Ransomware CISA lists exposed remote services, compromised credentials and phishing among the ways ransomware actors get in. See The Definition → Technique Remote Access That Stays Open Remote services left reachable from the internet are a common first step. Open Technique →

Threat Actors

Who Targets This Sector.

CISA assesses that Volt Typhoon is a People's Republic of China state-sponsored actor that compromised critical infrastructure in the communications, energy, transport and water sectors. Sandworm's profile is linked too, with the governments that attribute it named there.

Volt Typhoon China · Since 2021 Attributed by the US government and its Five Eyes partners to a People's Republic of China state-sponsored actor, Volt Typhoon is described in US advisories as pre-positioning inside critical infrastructure IT networks to be able to disrupt operations in a crisis. Open Profile → Sandworm Russia · Since 2009 Attributed by the US, UK and EU governments to Russian military intelligence (GRU Unit 74455), this group is linked to the 2015 and 2016 power grid attacks in Ukraine, the 2017 NotPetya attack and the 2018 Winter Olympics attack. Open Profile →

Compliance

Which Rules Apply To You.

NIS2 Directive The European Commission lists energy among the sectors the directive covers. It asks covered entities to take appropriate cybersecurity risk-management measures and to notify authorities of significant incidents, and applies to medium-sized and large entities. Official Site ↗

A plain summary of who each rule covers, taken from the official page. Not legal advice. Your legal team decides what applies to you.

Products

How Brandefense Helps.

Threat Landscape

Who Targets Energy And Utilities, And Where.

DarkSide Inactive DarkSide was a ransomware as a service group that CISA and the FBI named in advisory AA21-131A, first published May 11, 2021, after an attack on a U.S. Since 2020 · Ransomware as a service LockBit Disrupted LockBit is a ransomware as a service operation first seen in January 2020. Since 2020 · Ransomware as a service RansomHub Ransomware group RansomHub is a ransomware as a service operation, formerly known as Cyclops and Knight, according to a joint advisory (AA24-242A) from the FBI, CISA, MS-ISAC and HHS released on August 29, 2024. Since 2024 · Ransomware as a service REvil ransomware group Disrupted REvil, also called Sodinokibi, is a ransomware as a service operation that MITRE ATT&CK says ran since at least April 2019. Since 2019 · Ransomware as a service Warlock Ransomware group Warlock is a ransomware family that Microsoft says a China-based actor it tracks as Storm-2603 deployed in July 2025 after exploiting on-premises SharePoint servers. Since 2025 · Not stated by the sources
2015 Ukraine power grid attack Incident On 23 December 2015, remote intruders opened breakers at three regional electricity distribution companies in Ukraine. December 2015 · Energy and utilities Colonial Pipeline ransomware attack (May 2021) Incident The Colonial Pipeline ransomware attack began on 7 May 2021, when the US petroleum pipeline operator shut down its pipeline system after a DarkSide attack on its IT network. May 2021 · Energy and utilities CyberAv3ngers attacks on Unitronics PLCs, 2023 Incident CyberAv3ngers is an Iranian IRGC-affiliated persona that claimed attacks on Israeli water, energy and shipping PLCs from September 2023. September 2023 · Energy and utilities Iranian-affiliated attacks on US industrial controllers Incident US agencies say Iranian-affiliated actors have been disrupting internet-exposed industrial controllers (PLCs) in US government, water and energy organizations since at least March 2026. April 2026 · Critical infrastructure KHNP nuclear operator hack and data leak, 2014 Incident In December 2014 data from Korea Hydro & Nuclear Power Co. December 2014 · Energy and utilities Kudankulam nuclear plant malware, 2019 Incident In late October 2019 researchers said the network of the Kudankulam Nuclear Power Plant in Tamil Nadu was infected with Dtrack spyware. September to November 2019 · Energy and utilities Kyiv substation attack with Industroyer Incident On 17 December 2016, malware called Industroyer, also known as CrashOverride, disrupted a transmission substation outside Kyiv, Ukraine. December 2016 · Energy and utilities Mumbai power outage and cyber sabotage claim, 2020 Incident On 12 October 2020 a widespread power outage hit Mumbai and its suburbs, stopping trains and delaying exams. October 2020 to July 2021 · Energy and utilities Pemex ransomware attack, Mexico, 2019 Incident Pemex, Mexico's state oil company, detected a ransomware attack on 10 November 2019 that began at a computer center in the State of Mexico. November 2019 · Energy and utilities Poland energy sector attacks Incident On 29 December 2025, coordinated destructive attacks hit more than 30 wind and solar farms, a large combined heat and power plant and a manufacturing company in Poland. December 2025 · Energy and utilities Shamoon wiper attack on Saudi Aramco Incident On 15 August 2012 the Shamoon wiper virus hit workstations at Saudi Aramco, the Saudi national oil company. August 2012 · Energy and utilities
Brazil Country Brazil faces banking trojans and fraud, ransomware against health services and other organizations, and state-linked campaigns. Latin America Canada Country Canada faces state espionage, ransomware against hospitals, governments and critical infrastructure, and pro-Russia denial of service campaigns. North America Germany Country Germany faces cyber espionage by state actors, ransomware against companies and local governments, and DDoS campaigns against critical infrastructure. Europe India Country India is one of the world's largest digital economies, and its government reports millions of cyber incidents a year, with over 29.44 lakh handled by CERT-In in 2025. Asia Pacific Indonesia Country Indonesia is a large digital economy where cyber risk is shaped by ransomware, data leaks and fraud against banks and public bodies. Asia Pacific Ireland Country Ireland is a European country whose national cyber center (NCSC) leads the response to major cyber incidents. Europe Israel Country Israel is a small, highly connected country that faces frequent cyber activity linked to the region's conflicts. Middle East Italy Country Italy faces ransomware, DDoS campaigns by pro-Russian groups and data exposure. Europe Kazakhstan Country Kazakhstan faces fast-growing cybercrime, mostly theft of personal data, and DDoS waves against its national internet and state sites. Asia Pacific Mexico Country Mexico faces attacks on banks and payment systems, attacks on state bodies and companies, and banking fraud. Latin America Pakistan Country Pakistan appears in MITRE ATT&CK and US government texts as a target of South Asian and Chinese espionage groups and as one of the nations a North Korean bank-robbing team likely targeted. Asia Pacific Poland Country Poland faces cyber threats from state-linked actors such as APT28, Sandworm and Dragonfly, and from ransomware families such as LockBit. Europe Qatar Country Qatar is a small, wealthy Gulf state with a national cyber agency that runs yearly drills and sets security standards. Middle East Romania Country Romania is targeted by Russian state-linked actors and hacktivists, according to official sources. Europe Saudi Arabia Country Saudi Arabia is a Gulf state whose energy, aviation, government and telecommunications sectors have been named by official sources as targets of Iran-linked and other state-linked groups. Middle East South Korea Country South Korea faces cyber espionage and destructive attacks linked by official sources to North Korean state groups, and large data breaches at telecom and retail firms. Asia Pacific Spain Country Spain faces fraud, malware and ransomware, and its public bodies have been hit directly. Europe Taiwan Country Taiwan faces constant cyber pressure that its National Security Bureau ties to China: 2.63 million intrusion attempts a day against critical infrastructure in 2025, by the Bureau's count. Asia Pacific Türkiye Country Türkiye faces cyber threats from state-linked groups and criminals. Europe Ukraine Country Ukraine is the country where Russian state cyber operations have been most destructive, from the 2015 power grid attack to wiper malware in 2022. Europe United Arab Emirates Country The United Arab Emirates is a Gulf state with a national Cyber Security Council and separate bodies in Dubai and Abu Dhabi. Middle East United Kingdom Country The United Kingdom faces cyber threats from states and from ransomware crews. Europe United States Country This page collects what matters for cyber threats in the United States: the sectors attackers go after, the threat groups that US government sources link to the country, the major national incidents, and the bodies and rules to know. North America

FAQ

Frequently Asked Questions.

  • Does this reach our control systems?

    No. It looks at what is visible from the internet and at criminal sources. It does not connect to plant or control networks.

  • What should we look at first?

    The remote access and network edge devices of your sites. The Poland attacks and the Volt Typhoon advisory both involve internet-facing devices.

  • Which rules does an energy operator face?

    The NIS2 Directive covers energy. National laws differ, so check the detail with your legal team.

  • Do you attribute attacks?

    We link to groups only as attributed by named governments, and say who attributes them. See the profiles for detail.

  • Why are exposed VPNs and firewalls a risk for energy operators?

    Routers, VPNs and firewalls that face the internet are a common way in. CISA reports that Volt Typhoon got in by exploiting known or zero-day flaws in public-facing appliances like these. External Attack Surface Management shows which VPNs, gateways and remote services of your group face the internet.

  • What happened in the Poland energy attacks of December 2025?

    On 29 December 2025 coordinated destructive attacks hit more than 30 wind and solar farms and a combined heat and power plant in Poland. CERT Polska reports the attackers entered through internet-facing VPN and firewall devices.

  • Why is open remote access a problem for utilities?

    Remote services left reachable from the internet are a common first step for attackers. CISA also lists exposed remote services among the ways ransomware actors get in. Knowing what you expose lets you close it before it is used.

  • What is Volt Typhoon?

    CISA assesses that Volt Typhoon is a People's Republic of China state-sponsored actor. It compromised critical infrastructure in the communications, energy, transport and water sectors. US advisories describe it as pre-positioning inside critical infrastructure IT networks to be able to disrupt operations in a crisis.

  • How does ransomware tracking help an energy company?

    Ransomware Intelligence follows ransomware groups and the victims they announce, including in your sector. That shows you which groups are active near you. Cyber Threat Intelligence also tracks the groups that go after energy and critical infrastructure, and what they use.

  • What did the 2015 Ukraine power grid attack involve?

    On 23 December 2015 remote intruders opened breakers at three regional electricity distribution companies in Ukraine. In December 2016 malware called Industroyer disrupted a transmission substation outside Kyiv. Both are on record as attacks on power systems.

Mentioned In
  1. EASM Best Practices for the Energy Sector →October 2025
  2. Customizing Threat Intelligence Services for the Energy Sector →January 2024
  3. Tackling Ransomware Threats in the Energy Sector: Prevention and Response →January 2024
  4. Phishing Campaign for Turkish Energy Sector →June 2022
  5. Cyber incidents of 2026: lessons from official reports →October 2026
  6. NIS2 and DORA Compliance: What They Require for Third-Party Risk Management →July 2026

Related Reading.

Knowledge Hub →
101 guide Threat Intelligence 101 A plain introduction to threat intelligence: what it is, how it works and how a small team can start using it. Open → 101 guide External Attack Surface Management 101 How to find, check and reduce everything an attacker could reach from the internet, and how to keep that list true as your company changes. Open → Glossary Attack surface An attack surface is everything an attacker could reach to try to get into your organization. Open →

Other Ways In.

All Roles →
RoleCISOSee what is exposed outside your network in terms a board understands, and know what to… RoleCIO and IT directorSee what your company exposes to the internet, which suppliers carry risk into your systems, and… ArticleKasablanka: The Emerging North African Cyber Threat ActorKasablanka is described as a threat group active since about 2021. Read its reported tradecraft, targets… ArticleCrafty Camel APT: Iran’s Expanding Espionage Footprint in the Modern Cyber BattlespaceCrafty Camel profile: a cluster tied to a 2025 report on UAE aviation and transport phishing,…

For Energy And Utilities

Stay Ahead Of Digital Threats.

Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.

Request a demo See The Platform