Loading story…
A recent study from the Karlsruhe Institute of Technology has highlighted the increasing impact of geopolitical tensions on cyberattacks targeting the energy sector, including power grids and fuel systems. Researchers analyzed major cyber threat databases such as MITRE ATT&CK Groups, CSIS, ThaiCERT, Malpedia, EuRepoC, and the AI Incident Database to identify patterns in attacks against energy infrastructure. They developed an AI-powered pipeline to structure unstandardized incident data, achieving higher accuracy and recall for energy-related incidents compared to traditional rule-based systems. The study found that energy sector attacks are more specialized and regionally concentrated, with Russia and China frequently identified as origin countries and the Middle East as a prominent target. Conflict zones, such as Russia-Ukraine and Israel-Palestine, experience spikes in cyberattacks on energy infrastructure during periods of heightened tension. The digital transformation of the electric sector, including the integration of operational technology (OT) and information technology (IT), has increased both efficiency and vulnerability. Notable incidents, such as the 2015 Ukraine power grid attack and the 2021 Colonial Pipeline ransomware event, demonstrate the real-world consequences of cyberattacks on critical energy systems. U.S. utilities continue to face persistent threats from both nation-state and criminal actors, prompting federal agencies to issue repeated warnings. The growing reliance on AI and digital technologies in the energy sector further expands the attack surface, making robust cybersecurity measures essential. Experts emphasize the need for electric firms to harden their systems and invest in workforce training to address evolving threats. As AI becomes more integral to energy operations, the risk of attackers weaponizing AI to exploit vulnerabilities in the grid increases. The dependency of AI-driven systems on uninterrupted energy supply makes the grid an even more attractive target for sophisticated adversaries. Risk management strategies must adapt to address the convergence of IT, OT, and AI in the energy sector. The combination of geopolitical motivations, advanced attack techniques, and expanding digital infrastructure underscores the urgency for comprehensive security frameworks. Ongoing research and cross-sector collaboration are critical to defending against the escalating threat landscape facing global energy infrastructure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Researchers at the Karlsruhe Institute of Technology published a study examining how geopolitical tensions shape cyberattacks on energy infrastructure, using aggregated threat databases and a generative-AI pipeline to classify incidents.
By 2025, U.S. federal warnings cited ongoing probing activity against North American utilities, underscoring continued concern over threats to the electric sector.
After 2022, researchers observed increased and more clustered cyber activity targeting energy systems in connection with the Russia-Ukraine conflict.
In 2021, a ransomware attack on Colonial Pipeline disrupted pipeline operations and highlighted the real-world impact of cyberattacks on energy-related infrastructure.
In 2015, a cyberattack on Ukraine's power grid caused a large electricity outage, becoming a landmark example of cyber operations disrupting electric infrastructure.
3 references tracked. Mallory keeps watching after this page renders.
helpnetsecurity.com
Open sourcesecuritysenses.com
Open sourcesecuritysenses.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Critical infrastructure worldwide, including power grids, water systems, and transportation networks, is increasingly vulnerable due to aging hardware and outdated cybersecurity measures. Many of these systems, built between the 1950s and 1970s, were never designed for the hyperconnected digital environment of today, leaving them exposed to both physical decay and cyber threats. In the United States, nearly 70% of the power grid is over 25 years old, and similar conditions exist in Europe, with a significant portion of bridges and other infrastructure in need of repair. As operators modernize these systems with digital controls and cloud-based monitoring, new attack surfaces emerge, such as legacy interfaces, unpatched software, and unsupported protocols, which can be exploited by threat actors. The interconnectedness of these systems means that a single vulnerability, such as an infected maintenance laptop or a misconfigured firewall, can have cascading effects across multiple sectors. The adoption of digital twins and shared data platforms is helping operators predict failures and coordinate responses, but the risk remains high. The rapid growth of renewable energy, particularly solar power, has introduced additional cybersecurity challenges. Solar inverters, aggregators, and control software have become attractive targets for cybercriminals, as demonstrated by real-world incidents where hackers exploited default credentials and known software flaws to hijack remote monitoring devices. The FBI has issued alerts about threats to renewable energy systems, and experts warn that tampering with connected infrastructures, including EV charging networks, could lead to widespread blackouts. The transition to renewables is outpacing the implementation of robust cybersecurity measures, making the sector a potential weak link in national energy resilience. High-profile attacks, such as the hijacking of 800 monitoring devices in Japan using a Mirai botnet-linked vulnerability, highlight the global nature of the threat. Hacktivist groups have also targeted solar monitoring systems, further exposing the sector's vulnerabilities. The integration of renewables into the grid, often outside the direct control of traditional operators, complicates efforts to secure the entire energy ecosystem. As the share of renewables in power generation is projected to rise significantly by 2030, the urgency to address these cybersecurity gaps is growing. Experts emphasize the need for proactive monitoring, regular updates, and coordinated information sharing between engineers and security teams to mitigate risks. The resilience of critical infrastructure now depends not only on physical maintenance but also on the ability to anticipate and defend against sophisticated cyber threats targeting both legacy and emerging technologies.
Jun 29, 2026
The U.S. government is advancing multiple **critical infrastructure cybersecurity** initiatives focused on resilience, public-private coordination, and the secure adoption of **AI**. National Cyber Director Sean Cairncross said the administration wants AI to be **secure by design**, framing technical security as an enabler of innovation rather than a barrier. The approach includes closer collaboration with private industry, expanded threat-information sharing, federal support for offensive cyber operations, and new mechanisms for AI companies to coordinate on threat response while the administration revises earlier policies it views as constraining competitiveness. The Department of Energy is preparing to release its first cybersecurity strategic plan to strengthen defenses for the **power grid** and improve preparedness for cyber and physical incidents affecting the energy sector. That effort is expected to deepen coordination with private operators and evaluate AI investments that could help defend critical infrastructure against AI-enabled threats. A separate article on why attacks against critical national infrastructure are dangerous is **not about this same policy development**; it is a general explainer on infrastructure targeting and disruption rather than reporting on the U.S. government’s current AI and energy cybersecurity initiatives.
Jun 29, 2026
European officials and industry reporting have highlighted a widening threat to critical infrastructure as cyber risks to electricity networks grow alongside military monitoring of subsea assets. An International Energy Agency assessment cited in Spanish reporting said cyberattacks on critical energy infrastructure rose 30% in 2023 to **420 million** globally, while attacks on energy service companies have quadrupled since 2020. Recent incidents include the 2022 satellite communications disruption that knocked **5,800 wind turbines** offline in Germany and breaches affecting more than 20 Danish energy companies. Authorities have also warned that compromised smart meters, solar inverters, and battery systems could be used to destabilize grid frequency or trigger broader outages. The concern extends beyond direct hacking to supply-chain and geopolitical exposure tied to digitally connected clean-energy equipment and other strategic infrastructure. European and U.S. authorities reviewed communications modules in imported solar and battery systems, while Lithuania moved to block remote access by Chinese suppliers to solar, wind, and storage control platforms. Separately, the UK said British and Norwegian forces carried out a month-long operation to track a Russian attack submarine and two GUGI-linked spy submarines near North Atlantic cables and pipelines, underscoring fears that hostile states could target the seabed networks that carry **99% of international telecommunications traffic** and support a major share of regional energy supplies.
Jun 29, 2026