The result is that the grid is more capable, but also more exposed and less consistently visible unless electric operators extend the boundaries that have historically defined operational environments. But they also introduce new control interfaces, new access pathways, and new dependencies on external systems. It was the first major coordinated attack against Distributed Energy Resources (DER) anywhere in the world, and the activity confirmed deliberate attempts to directly impact operational assets rather than remaining confined to enterprise reconnaissance. Dragos has acquired NetRise and runZero, building the industry’s first end-to-end xOT cybersecurity platform. Increasingly distributed networked grid assets present a broader attack surface for adversaries to exploit. PNNL also operates an Energy Communications Cyber Test Range, a software-defined radio test range with a two-mile-plus radio frequency range and more than six miles of optical fiber.
The attackers aimed to exfiltrate data related to OT operating procedures and the spatial http://emergingequity.org/2015/06/26/vladimir-putin-on-the-global-economy-geopolitics-and-russia-europe-relations/?shared=email&msg=fail layout of the energy grid. Importantly, no customer-sensitive data was compromised during the US Grid Cyberattack in Massachusetts. “One of the biggest challenges with cybersecurity in critical infrastructure is the long lifespan of the devices. Security researchers at Dragos uncovered a prolonged cyber intrusion by the Volt Typhoon advanced persistent threat (APT) group, a threat actor linked to China. Quickly and easily find the right products and accessories for your applications.
Posts will tie GAO work to current events and the news; show how GAO’s work is affecting agencies or legislation; highlight reports, testimonies, and issue areas where GAO does work; and provide information about GAO itself, among other things. Find out more about https://serumset.com/satellite-communications-for-safer-and-greener-aviation.html our work on electricity grid cybersecurity by checking out our recent reports linked above. After identifying this vulnerability, we recommended the Department of Energy (DOE)—in coordination with the Department of Homeland Security, state, and industry partners—address risks to the distribution systems. But it hasn’t taken steps to ensure that those standards fully address leading federal guidance for critical infrastructure cybersecurity. For National Cybersecurity Awareness Month (October), today’s WatchBlog post looks at two of our recent reports on cybersecurity risks to the U.S. electric grid and federal efforts to address them.
PNNL and Amazon Partner to Advance AI Tools for a More Reliable, Secure and Affordable Grid
In 2025, the threat to electric infrastructure moved beyond access and persistence into deliberate, active preparation for operational impact. In parallel, the grid itself is changing and expanding into distributed, software-driven, and remotely accessible systems that were not part of traditional security models. Instead,they areobservedincreasinglytargeting the systems that operators rely on to see, understand, and manage the grid.
Electric Utility OT Security Starts with Visibility
Take steps to ensure business continuity with comprehensive grid cybersecurity. Protecting your data and communications during infrastructure disruptions. Nation-state cyber operations and critical infrastructure targeting. In May 2025, the NightSpire ransomware group disabled control systems at a Southeast Asian energy provider for 18 days, demanding an $8 million ransom. The North American Electric Reliability Corporation (NERC) reports that susceptible points on the grid are increasing by approximately 60 per day as the grid expands to incorporate distributed energy resources and smart grid technology. In 2019, we recommended that FERC consider adopting changes to its approved standards to more fully address federal guidance and evaluate the potential risks of a coordinated attack.
- Explore our case study, white paper, reference guide and blog posts to learn more on grid cybersecurity.
- The adversaries targeting electric infrastructure each follow distinct attack frameworks and understanding these patterns is the first step to defending against them.
- As renewable integration grows and substations modernize, operators face rising vulnerability from legacy systems, siloed tools, and expanding attack surfaces.
- After identifying this vulnerability, we recommended the Department of Energy (DOE)—in coordination with the Department of Homeland Security, state, and industry partners—address risks to the distribution systems.
- The North American Electric Reliability Corporation (NERC) reports that susceptible points on the grid are increasing by approximately 60 per day as the grid expands to incorporate distributed energy resources and smart grid technology.
OpenCode Console Breach May Have Exposed Saved AI Provider API Keys
Our nation’s energy system is heavily dependent on information networks for operational reliability. Supported by DOE’s Office of Electricity, the EIOC offers a secure and collaborative environment for tackling the nation’s most pressing energy challenges—ensuring the nations critical electrical infrastructure is reliable, secure, and affordable. PNNL plays a lead role in CRISP, which uses advanced sensors and data analysis to identify new and ongoing cyber threats. The federal government and its national laboratories complement these efforts as part of their mission to protect national and economic security.
The attack came close to blacking out approximately 500,000 people, according to ESET Research. The American Society of Civil Engineers rates U.S. energy infrastructure at D+, with 70% of power transformers and transmission lines over 25 years old. Physical attacks on grid infrastructure more than doubled – the Western Interconnection logged 220 physical security incidents in 2024 versus 107 in 2023 (DOE OE-417 data). Cyberattacks on utilities increased 70% in 2024, averaging over 1,300 weekly incidents by Q3 according to Check Point Research. The blog format allows GAO to provide a little more context about its work than it can offer on its other social media platforms. GAO launched its WatchBlog in January, 2014, as part of its continuing effort to reach its audiences—Congress and the American people—where they are currently looking for information.
People and organization
For electric environments where patching is often constrained by operational requirements, these timelines compress the window for defensive action. Of the vulnerabilities disclosed in 2025, approximately 4 percent of ICS vulnerabilities were actively exploited at the time of disclosure. In 2025, Dragos observed a median time of just 24 days between vulnerability disclosure and public exploit availability. Without a clear understanding of what assets exist, how they communicate, and what normal operations look like, it becomes extremely difficult to identify when adversaries are interacting with systems that influence grid operations. Across environments analyzed in 2025, Dragos consistently observes that lack of OT asset visibility remains one of the most significant drivers of cyber risk.
Other examples include data resilience tools like blockchain and adaptive control systems, which adjust in real time based on system conditions. For example, software-defined networks provide an additional defense layer to communications networks by detecting and stopping unauthorized traffic in real time. The Volt Typhoon advanced persistent threat (APT) group maintained access to a Massachusetts power utility’s OT network for almost a year, highlighting critical infrastructure vulnerabilities.
The report makes clear that risk grows when those pathways are poorly segmented or when supporting systems are allowed to sit too close to operational functions without sufficient boundaries. In practice, that means preparing for scenarios where operators may lose confidence in telemetry or visibility is degraded across substations and distributed assets, and where systems may need to be managed manually while an investigation is underway. These are the controls most directly tied to how grid environments are actually accessed, monitored, and operated. The findings of this year’s report reinforce that the SANS Five ICS Critical Controls remain the most practical way to reduce real operational risk.