Cybersecurity for the Energy sector

2023 & 2024

Recent incidents highlight the prevalence of ransomware attacks in the energy sector. In November 2023, Slovenia’s largest power producer, Holding Slovenske Elektrarne (HSE), fell victim to an attack attributed to Rhysida ransomware group. Corporate systems were temporarily disrupted, but the overall impact was limited: power production continued uninterrupted, and the attack was contained within two days of the initial notification.[5]  

Similarly, in December 2024, one of Romania’s largest energy suppliers, Electrica Group, was targeted by ransomware. Once again, the attack led to temporary disruptions in customer services, but crucially, the electricity supply remained unaffected. This was largely due to the isolation of SCADA and other operational technology (OT) systems from the compromised networks. The timing of the incident prompted speculation that there was a geopolitical motive for the attack. Intelligence analysts suggested that it was launched by a pro-Russian group in retaliation for Romania's annulment of its presidential election over alleged Russian interference.[6]  

These cases highlight a few important points about ransomware attacks in the energy sector. First, they demonstrate the importance of proper segmentation and isolation of critical systems from general corporate networks. This is especially important for companies like HSE and Electrica, who are major players in their respective countries’ energy supply chains. Second, ransomware is not always profit-driven. The Electrica incident illustrates how financial crime can converge with ideological or strategic motivations, particularly in the context of hybrid warfare.

2022 & 2024

In addition to disruptive attacks, like ransomware and sabotage, the energy sector is at risk of more subtle, long-term espionage campaigns. A 2024 PWC report noted that espionage posed the highest risk to the sector due to its high-value R&D, which has only been intensified in recent years due to climate-related issues and the impact of geopolitical uncertainties on energy supply.[7]  

One such campaign was observed in 2022, when the Russia-linked group Cold River targeted three US nuclear research laboratories. They sought to obtain credentials by creating spoofed login pages for each institution and spear-phishing nuclear scientists. The timing of the campaign revealed a strategic motive, as it coincided with UN inspections of Europe’s largest atomic power plant, located in Russian-controlled Ukrainian territory.[8]  

Another espionage campaign targeting the nuclear sector was observed in 2024, when an Iran-linked hacking group known as “Anonymous” breached the IT network of an Israeli nuclear facility, resulting in the theft of thousands of documents including PDFs, emails and presentations. This was one of many cyberattacks launched by Iranian hacking groups against Israel in relation to the conflict in the Gaza Strip. Luckily, the hackers did not appear to gain access to the facility’s operational technology (OT) network, limiting the incident’s impact. Nonetheless, Anonymous sought to ignite panic among Israeli populations living in nearby areas, posting threats and images depicting a nuclear explosion to social media.[9]  

2022

In September 2022, the Nord Stream subsea pipelines were damaged by a series of explosions in the Baltic Sea, near the Danish island of Bornholm. Nord Stream was built by Russia’s state-controlled energy agency Gazprom and consisted of two double-pipelines, Nord Stream 1 (NS1) and Nord Stream 2 (NS2). The explosions ruptured three of the four pipelines, releasing about 800 million cubic meters of gas into the atmosphere – equivalent to three months of Danish gas supply. Authorities concluded that the incident was an act of sabotage by a pro-Ukrainian group, likely in retaliation for the Russian invasion of Ukraine earlier that year.[10] Ukraine has denied involvement in the attack. Germany has since issued arrest warrants for at least six people, including former Ukrainian military officer Serhiy Kuznetsov and Ukrainian diver Volodymyr Zhuravlyov.[11]

The Netherlands was not directly dependent on Nord Stream for its gas supply, but it was indirectly influenced by its role in the European gas market. Crucially, Dutch energy companies and engineering expertise were involved in the ownership, financing, design, and construction of both Nord Stream pipelines.

2022

The shift towards renewable energy is motivated by more than just sustainability ambitions, but by escalating geopolitical tensions. After the war broke out in Ukraine, many European Member States pledged to consider alternatives to Russian energy imports. Germany, which is Europe’s largest economy, moved up its plan to reach nearly 100% renewable electricity by 2035 and reduce reliance on Russian energy sources. In 2022, 40% of Germany’s natural-gas imports came from Russia.[12]  

Naturally, Russia views the shift to renewables as an economic threat. Russian hacking groups working to protect the state’s interests have increasingly targeted European companies in the renewable energy sector. A clear example of this was seen in a spate of attacks throughout 2022, during which at least three German organizations were compromised: Deutsche Windtechnik AG, which specializes in wind turbine maintenance; turbine maker Nordex SE; and Enercon GmbH, another turbine manufacturer who became collateral damage in an attack on the satellite company Viasat.[13] The Danish turbine maker Vestas was also hit by a ransomware attack during the same period. It is believed that Russia-aligned actors were responsible for these attacks. The now disbanded Conti ransomware group, who had ties with Russia’s FSB, claimed responsibility for the attack on Deutsche Windtechnik.[14]  As tensions with Russia increase, it’s likely that threat actors will continue to target the renewable energy sector in hopes of undermining Europe’s energy transition and safeguarding Russia’s economy.  

2015, 2016 & 2022 

The attacks on Ukraine’s national power grid are perhaps some of the most sophisticated and disruptive incidents that have occurred in the energy sector. The first of these attacks occurred in 2015, when three power distribution companies in western Ukraine were compromised. The attackers used BlackEnergy malware to collect information from IT and OT platforms over the course of several months, before creating a custom exploit designed to execute the final attack. Two days before Christmas, the attackers started remotely disabling breakers and switchgears of the grids. The malware KillDisk was used to wipe many of the disks in the network, preventing the operators from regaining control.[15] The attack resulted in power outages impacting 225,000 people in Western Ukraine, lasting between one and six hours. This was the first publicly acknowledged successful cyberattack on a national power grid. It was attributed to Sandworm, a sophisticated Advanced Persistent Threat (APT) affiliated with Russia's GRU military intelligence agency.[16]  

In 2016, Sandworm returned with another attack on Ukrainian grid operators, resulting in an hour-long electricity disruption in parts of Kyiv. This time the group used Industroyer malware which represented a significant leap in complexity beyond earlier variants like BlackEnergy, boasting autonomous capabilities and the ability to operate even in isolated networks.[17] In 2020, six GRU officers were indicted by the US for their involvement in these and other high-profile cyber campaigns, including NotPetya and Olympic Destroyer.[18] 

Nonetheless, another attack followed shortly after the outbreak of war in 2022, when a modified version of the same malware, Industroyer2, was leveraged against a Ukrainian energy supplier. This attack aimed to cause a widespread blackout by shutting down substations, potentially affecting up to two million people. However, the attack was detected and neutralized before it could achieve its full intended impact.[19] 

These cases underscore that sabotage of energy systems can be used to support strategic objectives during physical conflicts, as well as highlighting the role of cyberattacks in hybrid warfare. Well-resourced and technically sophisticated actors, like Sandworm, pose a significant threat, and the energy sector will need to adapt accordingly.