Energy Sector Threat Actors Guide: Who Targets Grids, Pipelines and Renewables

Energy operators face an unusually wide spread of capable attackers, from state units that have already switched off power to criminals who shut a fuel pipeline with one leaked VPN password. This guide maps the actor types that government advisories and MITRE ATT&CK document against electricity, oil and gas and the newer renewable estate, how each one usually gets in, and what it does once inside. It then turns that map into a prioritised defence plan, detection points and metrics. It is written for security leads, OT engineers and threat intelligence analysts at utilities, generators, pipeline and refinery operators, and the suppliers who support them. Detailed profiles of individual groups live in their own pages, which are linked rather than repeated.

Key takeaways

• Three motives, one entry pattern: state disruption, state pre-positioning and criminal extortion all lean heavily on valid accounts, exposed remote access and internet-facing edge devices rather than novel exploits.
• Disruption has already happened: MITRE ATT&CK records three Sandworm Team attacks on Ukrainian electric power (2015, 2016 and 2022), and the 2017 Triton campaign against a petrochemical safety system tripped the plant.
• Pre-positioning is the current state threat: US agencies assess with high confidence that Volt Typhoon has been placing itself in energy and other critical infrastructure IT networks to disrupt OT in a crisis, with some access lasting at least five years.
• Criminals stop operations without touching OT: Colonial Pipeline shut its pipeline for about six days after ransomware hit IT, reached through a dormant VPN account without MFA.
• Identity is the shared control point: domain credentials, VPN accounts, default device passwords and engineering workstation access recur in every actor's path, so identity hygiene across the IT and OT boundary gives the widest return.

Why attackers pick energy

• Strategic leverage: power and fuel underpin every other sector, so the ability to disrupt them is a lever in conflict. This drives the state groups.
• Intolerance of downtime: operators cannot pause supply for long, which raises the pressure to pay ransoms or restore quickly, and drives criminal targeting.
• Long-lived OT and wide geography: substations, compressor stations and wind or solar sites are remote, run equipment for decades and depend on remote access for maintenance.
• Dense supplier ecosystem: integrators, OEM support staff and software vendors hold remote access and software update paths. Dragonfly has used trojanised ICS vendor software packages, according to MITRE ATT&CK.
• Converging IT and OT identities: domain-joined OT assets, shared engineering accounts and VPNs that bridge networks mean an IT credential can reach control systems. See the Energy Sector Identity and OT Access Guide.

The actor map

The table lists the actors with the strongest public record against the sector. ATT&CK IDs are from ATT&CK v20. Aliases are those MITRE lists.

See the Sandworm Threat Actor Profile, Berserk Bear Threat Actor Profile Guide, Volt Typhoon Threat Actor Profile, APT33 Threat Actor Profile Guide and CyberAv3ngers Threat Actor Profile Guide.

Grids, pipelines and renewables: how the targets differ

• Electricity transmission and distribution: the only segment with confirmed power outages caused by cyber attack (Ukraine). Targets are SCADA, substation devices, serial-to-Ethernet converters and the operators' control-system VPN.
• Oil, gas and petrochemicals: Triton shows that safety instrumented systems are in scope. Colonial shows that business-side IT failure alone can halt physical supply when billing and scheduling stop. See the Safety Instrumented Systems Security Guide.
• Renewables and distributed energy: large fleets of inverters, battery systems and small PLCs, often managed through vendor clouds and remote access, match the internet-exposed, default-password pattern CyberAv3ngers exploited. See the Distributed Energy Resources and Solar Inverter Security Guide and the Battery Energy Storage System Security Guide.

How they get in

The entry routes repeat across actors. The table maps each to ATT&CK and the actors documented using it.

See the Edge Device Security Guide and the OT Remote Access Guide.

What they do once inside

• Harvest the domain: CISA reports Volt Typhoon extracting the Active Directory database (NTDS.dit, ATT&CK T1003.003) and re-dumping domain credentials to keep access current. Those credentials were then used against OT systems in some cases.
• Live off the land: Volt Typhoon relies mainly on built-in tools and RDP rather than malware, and deletes targeted logs (T1070 Indicator Removal). Sandworm's 2022 attack also used living-off-the-land techniques. See the Living Off the Land Guide.
• Cross into OT through trusted paths: in the Triton campaign MITRE records lateral movement through RDP jump boxes, poorly configured OT firewalls and valid credentials before the safety controllers were reached.
• Manipulate control: Sandworm used the utility's own SCADA software to send unauthorised commands to substations in 2022, and Industroyer targeted distribution substation components in 2016.
• Block recovery: in 2015 Sandworm used KillDisk on devices needed for remote recovery, overwrote serial-to-Ethernet converter firmware and scheduled UPS shutdowns of data and telephone servers (ICS T0816 Device Restart/Shutdown). In 2022 CaddyWiper was pushed through Group Policy to destroy IT data.
• Tamper with logic: CyberAv3ngers replaced ladder logic, renamed devices and changed the port used for remote communication on compromised PLCs, according to CISA. Triton downloaded control logic to Triconex controllers (ICS T0843 Program Download).

Where identity fits

Every documented path above uses an identity at some point: a domain account, a VPN user, a vendor support login, a default device password or an engineering workstation session. Treat these as the sector's critical assets alongside the controllers themselves.

• Separate IT and OT identity stores: credentials stolen from a corporate domain should not authenticate to OT. Where OT assets are domain-joined, use a separate OT domain or tier, as CISA's Volt Typhoon advisory points to by recommending separate user and privileged accounts and segmentation.
• Own every remote access account: vendor, integrator and staff VPN accounts each need an owner, MFA and an expiry. Colonial's entry was an account nobody was using.
• Treat device credentials as non-human identities: PLC, inverter, RTU and OPC UA credentials need inventory, unique values and rotation. CISA's INCONTROLLER advisory asks operators to configure OPC UA application authentication with explicit trust lists and to protect certificate keys.
• Protect engineering workstations: they hold the software and credentials that can change logic. See the PLC Security Guide.

Implementing the defences: a phased plan

The order below is NHI Mgmt Group's recommendation, weighted towards the routes every actor shares.

1. Weeks 1 to 4, close the front doors: list every internet-facing device and remote access path (including vendor portals and inverter or PLC management interfaces). Remove OT devices from the internet, replace default passwords, and require phishing-resistant MFA on all VPN and remote access. Test MFA on a pilot group of field engineers before enforcing, and keep a documented break-glass route.
2. Weeks 5 to 10, cut identity bridges: disable dormant accounts, split IT and OT administrative accounts, remove cached and stored credentials from edge devices, and restrict RDP into OT to managed jump hosts.
3. Weeks 11 to 16, see the attack: centralise authentication, VPN, domain controller and OT network logs; deploy OT network monitoring at IT and OT boundaries and key substations or sites; add the detections listed below.
4. Months 4 to 6, prepare to recover: keep offline, integrity-checked backups of controller logic and firmware, test manual operation and restoration, and rehearse an incident in which IT is lost but supply must continue. See the Utility Incident Response Guide.
5. Ongoing: replace end-of-life edge devices, verify vendor software before installation, and feed sector threat intelligence into detection content.

Small and large operators: a small generator or renewables owner should spend first on removing internet exposure, defaults and password-only remote access, and buy managed monitoring. A large utility needs a dedicated OT security operations function, threat hunting for living-off-the-land activity, and supplier access governance at scale.

Detection and measurement

Metrics:

• Internet-exposed OT and management interfaces (target: zero).
• Remote access paths with phishing-resistant MFA, as a percentage of all paths including vendor access.
• Dormant accounts disabled within 30 days of last use (our recommended threshold).
• OT devices still using default credentials.
• Sites with OT network monitoring and central log collection.
• Time to restore a controller from a verified backup, measured in an exercise.

Framework mapping

NIST SP 800-82 Rev. 3 tailors these controls to OT. See the NIST SP 800-82 OT Security Guide, and for North American bulk electric systems the NERC CIP Guide.

Common failure patterns

• Dormant remote access accounts: the Colonial Pipeline ransomware attack began with a VPN account no longer in use, whose leaked password worked because MFA was not required.
• Treating IT incidents as non-operational: Colonial halted the pipeline although the ransomware hit IT, so business systems need to be in the operational resilience plan.
• Defaults on exposed devices: CyberAv3ngers compromised at least 75 devices, according to CISA, largely because PLCs were reachable with a default or no password.
• One domain for IT and OT: Volt Typhoon and Sandworm both turned domain credentials into OT access.
• Waiting for malware alerts: living-off-the-land intrusions produce no malware, so detection must rest on identity and behaviour.
• Backups that cannot restore OT: the 2015 attack destroyed the devices needed for remote recovery; logic and firmware backups must be offline and tested.

Practitioner checklist

• Keep an actor-to-entry-route map for your segment (grid, oil and gas, renewables) and review it with each new advisory.
• Remove every OT device and management interface from direct internet exposure.
• Replace all default device passwords and record device credentials in a managed inventory.
• Require phishing-resistant MFA on every VPN and remote access path, including vendors.
• Disable dormant accounts and give every remote access account an owner and expiry.
• Separate IT and OT administrative identities and restrict OT access to managed jump hosts.
• Monitor domain controllers for NTDS.dit access and log clearing.
• Keep offline, integrity-checked backups of controller logic and firmware and test restoration.
• Verify the integrity of vendor OT software before installing it.

Standards and references

• CISA: AA24-038A PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure
• CISA: AA23-335A IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors
• CISA: AA22-103A APT Cyber Tools Targeting ICS/SCADA Devices
• US Department of Justice: Six Russian GRU officers charged in connection with worldwide deployment of destructive malware
• US Treasury: Sanctions on Russian government research institution connected to the Triton malware
• MITRE ATT&CK: 2015 Ukraine Electric Power Attack (C0028)
• MITRE ATT&CK: 2022 Ukraine Electric Power Attack (C0034)
• MITRE ATT&CK: Triton Safety Instrumented System Attack (C0030)
• MITRE ATT&CK: Dragonfly (G0035)
• MITRE ATT&CK: APT33 (G0064)

Related NHI Mgmt Group resources: Energy Sector Identity and OT Access Guide · Electric Utility Cybersecurity Programme Guide · Energy Sector Cyber Regulation Map · Threat Actors Targeting Healthcare Guide · OT Security Guide