Down, Danger, Dial: Electrical Safety Tips to Help British Columbians Stay Safe During Storm Season

Crouching Yeti APT targets energy infrastructure with watering-hole attacks, compromising servers to steal credentials and stage intrusions; Kaspersky Lab links the Energetic Bear group to ICS threats across Russia, US, Europe, and Turkey.

Key Points

Crouching Yeti APT, aka Energetic Bear, is a threat group that targets energy firms using watering-hole attacks.

✅ Targets energy infrastructure via watering-hole compromises

✅ Uses open-source tools and backdoored sshd for persistence

✅ Scans global servers to stage intrusions and steal credentials

A hacker collective known for attacking industrial companies around the world have had some of their infrastructure identified by Russian security specialists.

Kaspersky Lab said that it has discovered a number of servers compromised by the group, belonging to different organisations based in Russia, the US, and Turkey, as well as European countries.

The Russian-speaking hackers, known as Crouching Yeti or Energetic Bear, mostly focus on energy facilities, as seen in reports of infiltration of the U.S. power grid targeting critical infrastructure, for the main purpose of stealing valuable data from victim systems.

Hacked servers

Crouching Yeti is described as an advanced persistent threat (APT) group that Kaspersky Lab has been tracking since 2010.

#google#

Kaspersky Lab said that the servers it has compromised are not just limited to industrial companies. The servers were hit in 2016 and 2017 with different intentions. Some were compromised to gain access to other resources or to be used as intermediaries to conduct attacks on other resources.

Others, including those hosting Russian websites, were used as watering holes.

It is a common tactic for Crouching Yeti to utilise watering hole attacks where the attackers inject websites with a link redirecting visitors to a malicious server.

“In the process of analysing infected servers, researchers identified numerous websites and servers used by organisations in Russia, US, Europe, Asia and Latin America that the attackers had scanned with various tools, possibly to find a server that could be used to establish a foothold for hosting the attackers’ tools and to subsequently develop an attack,” said the security specialists in a blog posting.

“The range of websites and servers that captured the attention of the intruders is extensive,” the firm said. “Kaspersky Lab researchers found that the attackers had scanned numerous websites of different types, including online stores and services, public organisations, NGOs, manufacturing, etc.

Kaspersky Lab said that the hackers used publicly available malicious tools, designed for analysing servers, and for seeking out and collecting information. The researchers also found a modified sshd file with a preinstalled backdoor. This was used to replace the original file and could be authorised with a ‘master password’.

“Crouching Yeti is a notorious Russian-speaking group that has been active for many years and is still successfully targeting industrial organisations through watering hole attacks, among other techniques,” explained Vladimir Dashchenko, head of vulnerability research group at Kaspersky Lab ICS CERT.

Russian government?

“Our findings show that the group compromised servers not only for establishing watering holes, but also for further scanning, and they actively used open-sourced tools that made it much harder to identify them afterwards,” he said.

“The group’s activities, such as initial data collection, the theft of authentication data, and the scanning of resources, are used to launch further attacks,” said Dashchenko. “The diversity of infected servers and scanned resources suggests the group may operate in the interests of the third parties.”

This may well tie into a similar conclusion from a rival security vendor.

In 2014 CrowdStrike claimed that the ‘Energetic Bear’ group was also tracked in Symantec's Dragonfly research and had been hacking foreign companies on behalf of the Russian state.

The security vendor had said the group had been carrying out attacks on foreign companies since 2012, with reports of breaches at U.S. power plants that underscored the campaign, and there was evidence that these operations were sanctioned by the Russian government.

Last month the United States for the first time publicly accused Russia in a condemnation of Russian grid hacking of attacks against the American power grid.

Symantec meanwhile warned last year of a resurgence in cyber attacks on European and US energy companies, including reports of access to U.S. utility control rooms that could result in widespread power outages.

And last July the UK’s National Cyber Security Centre (NCSC) acknowledged it was investigating a broad wave of attacks on companies in the British energy and manufacturing sectors.

Related News

• Electricity Forum News

• Grid Technologies News

U.S. Power Grid Cybersecurity combats DHS-FBI flagged threats to energy infrastructure, with PJM Interconnection using ICS/SCADA segmentation, phishing defenses, incident response, and resilience exercises against Russia-linked attacks and pipeline intrusions.

Key Points

Strategies, controls, and training that protect U.S. electric infrastructure from cyber threats and disruptions.

✅ ICS/SCADA network segmentation and zero-trust architecture

✅ Employee phishing drills and incident response playbooks

✅ DOE-led grid exercises and threat intelligence sharing

The joint alert from the FBI and Department of Homeland Security last month warning that Russia was hacking into critical U.S. energy infrastructure, as outlined in six essential reads on Russian hacks from recent coverage, came as no surprise to the nation’s largest grid operator, PJM Interconnection.

“You will never stop people from trying to get into your systems. That isn’t even something we try to do.” said PJM Chief Information Officer, Tom O’Brien. “People will always try to get into your systems. The question is, what controls do you have to not allow them to penetrate? And how do you respond in the event they actually do get into your system?”

PJM is the regional transmission organization for 65 million people, covering 13 states, including Pennsylvania, and Washington D.C.

On a rainy day in early April, about 10 people were working inside PJM’s main control center, outside Philadelphia, closely monitoring floor-to-ceiling digital displays showing real-time information from the electric power sector throughout PJM’s territory in the mid-Atlantic and parts of the midwest, amid reports that hackers accessed control rooms at U.S. utilities.

#google#

Donnie Bielak, a reliability engineering manager, was overseeing things from his office, perched one floor up.

“This is a very large, orchestrated effort that goes unnoticed most of the time,” Bielak said. “That’s a good thing.”

But the industry certainly did take notice in late 2015 and early 2016, when hackers successfully disrupted power to the Ukrainian grid. The outages lasted a few hours and affected about 225,000 customers. It was the first publicly-known case of a cyber attack causing major disruptions to a power grid. It was widely blamed on Russia.

One of the many lessons of the Ukraine attacks was a reminder to people who work on critical infrastructure to keep an eye out for odd communications.

“A very large percentage of entry points to attacks are coming through emails,” O’Brien said. “That’s why PJM, as well as many others, have aggressive phishing campaigns. We’re training our employees.”

O’Brien doesn’t want to get into specifics about how PJM deals with cyber threats. But one common way to limit exposure is by having separate systems: For example, industrial controls in a power plant are not connected to corporate business networks, a separation underscored after breaches at U.S. power plants prompted reviews across the sector.

Since 2011, North American grid operators and government agencies have also done large, security exercises every two years. Thousands of people practice how they’d respond to a coordinated physical or cyber event, including rising substation attacks that highlight resilience gaps.

So far, nothing like that has happened in the U.S. It’s possible, but not likely, according to Robert M. Lee, a former military intelligence analyst, who runs the industrial cybersecurity firm Dragos.

“The more complex the system, the harder it is to have a scalable attack,” said Lee, who co-authored a report analyzing the Ukraine attacks. “If you wanted to take out a power generation station– that isn’t the most complex thing. Let’s say you cause an hour of outage. But now you want to cause two months of outages? That’s an exponential increase in effort required.”

For example, he said, it would very difficult for hackers to knock out power to the entire east coast for a long time. But briefly disrupting a major city is easier. That’s the sort of thing that keeps him up at night.

“I worry about an adversary getting into, maybe, Washington D.C.’s portion of the grid, taking down power for 30 minutes,” he said.

The Department of Energy is creating a new office focused on cybersecurity and emergency response, following the U.S. government’s condemnation of power grid hacking by Russia.

Deterrence may be one reason why there has not yet been a major attack on the U.S. grid, said John MacWilliams, a former senior DOE official who’s now a fellow at Columbia University’s Center on Global Energy Policy.

“That’s obviously an act of war,” he said. “We have the capability of responding either through cyber mechanisms or kinetic military.”

In the meantime, small-scale incidents keep happening.

This spring, another cyber attack targeted natural gas pipelines. Four companies shut down their computer systems, just in case, but they say no service was disrupted.

Related News

• Electricity Forum News

• Grid Technologies News

Puerto Rico Microgrid Regulations outline renewable energy, CHP, and storage standards, enabling islanded systems, PREPA interconnection, excess energy sales, and IRP alignment to boost resilience, distributed resources, and community power across the recovering grid.

Key Points

Rules defining microgrids, requiring 75 percent renewables or CHP, and setting interconnection and PREPA fee frameworks.

✅ 75 percent renewables or CHP; hybrids allowed

✅ Registration, engineer inspection, and annual generation reports

✅ PREPA interconnection fees; excess energy sales permitted

The Puerto Rico Energy Commission unveiled 29 pages of proposed regulations last week for future microgrid installations on the island.

The regulations, which are now open for 30 days of public comment, synthesized pages of responses received after a November 10 call for recommendations. Commission chair José Román Morales said it’s the most interest the not-yet four-year-old commission has received during a public rulemaking process.

The goal was to sketch a clearer outline for a tricky-to-define concept -- the term "microgrid" can refer to many types of generation islanded from the central grid -- as climate pressures on the U.S. grid mount and more developers eye installations on the recovering island.

“There’s not a standard definition of what a microgrid is, not even on the mainland,” said Román Morales.

According to the commission's regulation, “a microgrid shall consist, at a minimum, of generation assets, loads and distribution infrastructure. Microgrids shall include sufficient generation, storage assets and advanced distribution technologies, including advanced inverters, to serve load under normal operating and usage conditions.”

All microgrids must be renewable (with at least 75 percent of power from clean energy), combined heat and power (CHP) or hybrid CHP-and-renewable systems. The regulation applies to microgrids controlled and owned by individuals, customer cooperatives, nonprofit and for-profit companies, and cities, but not those owned by the Puerto Rico Electric Power Authority (PREPA). Owners must submit a registration application for approval, including a certification of inspection from a licensed electric engineer, and an annual fuel, generation and sales report that details generation and fuel source, as well as any change in the number of customers served.

Microgrids, like the SDG&E microgrid in Ramona in California, can interconnect with the PREPA system, but if a microgrid will use PREPA infrastructure, owners will incur a monthly fee. That amounts to $25 per customer up to a cap of $250 per month for small cooperative microgrids. The cost for larger systems is calculated using a separate, more complex equation. Operators can also sell excess energy back to PREPA.

Big goals for the island's future grid

In total, 53 groups and companies, including Sunnova, AES, the Puerto Rico Solar Energy Industries Association (PR-SEIA), the Advanced Energy Management Alliance (AEMA), and the New York Smart Grid Consortium, submitted their thoughts about microgrids or, in many cases, broader goals for the island’s future energy system. It was a quick turnaround: The Puerto Rico Energy Commission offered a window of just 10 days to submit advice, although the commission continued to accept comments after the deadline.

“PREC wanted the input as fast as possible because of the urgency,” said AES CEO Chris Shelton.

AES’ plan includes a network of “mini-grids” that could range in size from several megawatts to one large enough to service the entire city of San Juan.

“The idea is, you connect those to each other with transmission so they can have a co-optimized portfolio effect and lower the overall cost,” said Shelton. “But they would be largely autonomous in a situation where the tie-lines between them were broken.”

According to estimates provided in AES’ filing, utility-scale solar installations over 50 megawatts on the island could cost between $40 and $50 per megawatt-hour. Those prices make solar located near load centers an economic alternative to the island’s fossil-fuel generating plants. The utility’s analysis showed that a 10,000-megawatt solar system could replace 12,000 gigawatt-hours of fossil generation, with 25 gigawatt-hours of battery storage leveling out load throughout the day. Puerto Rico’s peak load is 3,000 megawatts.

In other filings, PR-SEIA urged a restructuring of FEMA funds so they’re available for microgrid development. GridWise Alliance wrote that plans should consider cybersecurity, and AEMA recommended the commission develop an integrated resource plan (IRP) that includes distributed energy resources, microgrids and non-wires alternatives.

An air of optimism, though 1.5 million are still without power

After the commission completes the microgrid rulemaking, a new IRP is next on the commission’s to-do list. PREPA must file that plan in July, and regulators are working furiously to make sure it incorporates the recent flood of rebuilding recommendations from the energy industry.

Though the commission has the final say when it comes to approval of the plan, PREPA will lead the IRP process. The utility’s newly formed Transformation Advisory Council (TAC), a group of 11 energy experts, will contribute.

With that group, along with New York’s Resiliency Working Group, lessons from California's grid transition, the Energy Commission, the utility itself, and the dozens of other clean energy experts and entrepreneurs who want to offer their two cents, the energy planning process has a lot of moving parts. But according to Julia Hamm, CEO of the Smart Electric Power Alliance and a member of both the Energy Resiliency Working Group and the TAC, those working to establish standards for Puerto Rico’s future are hitting their stride.

“Certainly over the past three months, it has been a bit of a challenge to ensure that everybody has been coordinating efforts. Just over the past couple of weeks, we’ve seen some good progress on that front. We’re starting to see a lot more communication,” she said, adding that an air of optimism has settled on the process. “The key stakeholders all have a very common vision for Puerto Rico when it comes to the power sector.”

Nisha Desai, a PREPA board member who is liaising with the TAC, affirmed that collaborators are on the same page. “Everyone is violently in agreement that the future of Puerto Rico involves renewables, microgrids and distributed generation,” she said.

The TAC will hold its first in-person meeting in mid-January, and has already consulted with the utility on its formal fiscal plan submission, due January 10.

Though many taking part in the process feel the once-harried recovery is beginning to adopt a more organized approach, Desai acknowledges that “there are a lot of people in Puerto Rico who feel forgotten.”

Puerto Rico’s current generation sits at just 72.6 percent, in a nation facing longer, more frequent outages due to extreme weather. The government recently offered its first estimate that about half the island, 1.5 million residents, remains without power.

In late December and into January, 1,500 more crewmembers from 18 utilities in states as far flung as Minnesota, Missouri and Arizona will land on the island to aid further restoration through mutual aid agreements.

“The system is getting up to speed, getting to 100 percent, but there’s still some instability,” said Román Morales. “Right now it’s a matter of time.”

Related News

• Electricity Forum News

• Grid Technologies News

UK Free Electricity Debate weighs soaring energy prices against market regulation, renewables, and social equity, examining price caps, funding via windfall taxes, grid investment, and consumer protection in the UK's evolving energy policy landscape.

Key Points

A policy dispute over free power, balancing consumer relief with market stability, renewables, and investment.

✅ Pros: relief for households; boosts efficiency and green adoption.

✅ Cons: risks to market signals, quality, and grid investment.

✅ Policy options: price caps, windfall taxes, targeted subsidies.

In recent months, the debate over free electricity in the UK has intensified, revealing a divide within the energy sector. With soaring energy prices and economic pressures impacting consumers, the discussion around providing free electricity has gained traction. However, the idea has sparked significant controversy among industry stakeholders, each with their own perspectives on the feasibility and implications of such a move.

The Context of Rising Energy Costs

The push for free electricity is rooted in the UK’s ongoing energy crisis, exacerbated by geopolitical tensions, supply chain disruptions, and the lingering effects of the COVID-19 pandemic. As energy prices reached unprecedented levels, households faced the harsh reality of skyrocketing bills, prompting calls for government intervention to alleviate financial burdens.

Supporters of free electricity argue that it could serve as a vital lifeline for struggling families and businesses. The proposal suggests that by providing a certain amount of electricity for free, the government could help mitigate the effects of rising costs while encouraging energy conservation and efficiency.

Industry Perspectives

However, the notion of free electricity has not been universally embraced within the energy sector. Some industry leaders express concerns about the financial viability of such a scheme. They argue that providing free electricity could undermine the market dynamics that incentivize investment in infrastructure and renewable energy, in a market already exposed to natural gas price volatility today. Critics warn that if energy companies are forced to absorb costs, it could lead to diminished service quality and investment in necessary advancements.

Additionally, there are worries about how free electricity could be funded. Proponents suggest that a tax on energy companies could generate the necessary revenue, but opponents question whether this would stifle innovation and competition. The fear is that placing additional financial burdens on energy providers could ultimately lead to higher prices in the long run.

Renewable Energy and Sustainability

Another aspect of the debate centers around the UK’s commitment to transitioning to renewable energy sources. Supporters of free electricity emphasize that such a policy could encourage more widespread adoption of green technologies by making energy more accessible. They argue that by removing the financial barriers associated with energy costs, households would be more inclined to invest in solar panels, heat pumps, and other sustainable solutions.

On the other hand, skeptics contend that the focus should remain on ensuring a stable and reliable energy supply as the UK moves toward its climate goals. They caution against implementing policies that might disrupt the balance of the energy market, potentially hindering the necessary investments in renewable infrastructure.

Government's Role

As discussions unfold, the government’s role in this debate is crucial. Policymakers must navigate the complex landscape of energy regulation, market dynamics, and consumer needs. The government has already introduced measures aimed at assisting vulnerable households, such as energy price caps and direct financial support. However, the question remains whether these initiatives go far enough in addressing the root causes of the energy crisis.

In this context, the government faces pressure from both consumers demanding relief and industry leaders advocating for market stability, including proposals to end the link between gas and electricity prices to curb price volatility. The challenge lies in finding a middle ground that balances immediate support for households with long-term sustainability and investment in the energy sector.

Future Implications

The ongoing debate about free electricity in the UK underscores broader themes related to energy policy, market regulation, and social equity, with rising electricity prices abroad offering context for comparison. As the country navigates its energy transition, the decisions made today will have far-reaching implications for both consumers and the industry.

If the government chooses to pursue a model that includes free electricity, it will need to carefully consider how to implement such a system without jeopardizing the market. Transparency, stakeholder engagement, and thorough impact assessments will be essential to ensure that any new policies are sustainable and equitable.

Conversely, if the concept of free electricity is ultimately rejected, the focus will likely shift back to addressing energy costs through other means, such as enhancing energy efficiency programs or increasing support for vulnerable populations.

The divide within the UK’s energy industry regarding free electricity highlights the complexities of balancing consumer needs with market stability. As the energy crisis continues to unfold, the conversations surrounding this issue will remain at the forefront of public discourse. Ultimately, finding a solution that addresses the immediate challenges while promoting a sustainable energy future will be key to navigating this critical juncture in the UK’s energy landscape.

Related News

• Electricity Forum News

• Energy Policy News

EV-Driven Electricity Demand Growth will reshape utilities through electrification, EV adoption, grid modernization, and ratebasing of charging, as NREL forecasts rising terawatt-hours, CAGR increases, and demand-side flexibility to manage emissions and reliability.

Key Points

Growth in power consumption fueled by EV adoption and electrification, increasing utility sales and grid investment.

✅ NREL projects 20%-38% higher U.S. load by 2050

✅ Utilities see CAGR up to 1.6% and 80 TWh/year growth

✅ Demand-side flexibility and EV charging optimize grids

Utilities have struggled with flat demand for years, but analysis by the National Renewable Energy Laboratory predicts steady growth across the next three decades — largely driven by the adoption of electric vehicles, including models like the Tesla Model 3 that are reshaping expectations.

The study considers three scenarios, a reference case and medium- and high-adoption electrification predictions. All indicate demand growth, but in the medium and high scenarios for 2050, U.S. electricity consumption increases by 20% and 38%, respectively, compared to business as usual.

Utilities could go from stagnant demand to compound annual growth rates of 1.6%, which would amount to sustained absolute growth of 80 terawatt-hours per year.

"This unprecedented absolute growth in annual electricity consumption can significantly alter supply-side infrastructure development requirements," the report says, and could challenge state power grids in multiple regions.

NREL's Trieu Mai, principal investigator for the study, cautions that more research is needed to fully assess the drivers and impacts of electrification, "as well as the role and value of demand-side flexibility."

"Although we extensively and qualitatively discuss the potential drivers and barriers behind electric technology adoption in the report, much more work is needed to quantitatively understand these factors," Mai said in a statement.

However, utilities have largely bought into the dream.

"Electric vehicles are the biggest opportunity we see right now," Energy Impact Partners CEO Hans Kobler told Utility Dive. And the impact could go beyond just higher kilowattt-hour sales, particularly as electric truck fleets come online.

"When the transportation sector is fully electrified, it will result in around $6 trillion in investment," Kobler said. "Half of that is on the infrastructure side of the utility." And the industry can also benefit through ratebasing charging stations and managing the new demand.

One benefit that NREL's report points to is the possibility of "expanded value streams enabled by electric and/or grid-connected technologies," such as energy storage and mobile chargers that enhance flexibility.

"Many electric utilities are carefully watching the trend toward electrification, as it has the potential to increase sales and revenues that have stagnated or fallen over the past decade," the report said, highlighting potential benefits for all customers as adoption grows. "Beyond power system planning, other motivations to study electrification include its potential to impact energy security, emissions, and innovation in electrical end-use technologies and overall efficient system integration. The impacts of electrification could be far-reaching and have benefits and costs to various stakeholders."

Related News

• Electricity Forum News

• EV Infrastructure News

Dragonfly energy sector cyberattacks target ICS and SCADA across critical infrastructure, including the power grid and nuclear facilities, using spearphishing, watering-hole sites, supply-chain compromises, malware, and VPN exploits to gain operational access.

Key Points

Dragonfly APT campaigns target energy firms and ICS to gain grid access, risking manipulation and service disruption.

✅ Breaches leveraged spearphishing, watering-hole sites, and supply chains.

✅ Targeted ICS, SCADA, VPNs to pivot into operational networks.

✅ Aimed to enable power grid manipulation and potential outages.

An October, 2017 report by researchers at Symantec Corp., cited by the U.S. government, has linked recent US power grid cyber attacks to a group of hackers it had code-named "Dragonfly", and said it found evidence critical infrastructure facilities in Turkey and Switzerland also had been breached.

The Symantec researchers said an earlier wave of attacks by the same group starting in 2011 was used to gather intelligence on companies and their operational systems. The hackers then used that information for a more advanced wave of attacks targeting industrial control systems that, if disabled, leave millions without power or water.

U.S. intelligence officials have long been concerned about the security of the country’s electrical grid. The recent attacks, condemned by the U.S. government, striking almost simultaneously at multiple locations, are testing the government’s ability to coordinate an effective response among several private utilities, state and local officials, and industry regulators.

#google#

While the core of a nuclear generator is heavily protected, a sudden shutdown of the turbine can trigger safety systems. These safety devices are designed to disperse excess heat while the nuclear reaction is halted, but the safety systems themselves may be vulnerable to attack.

The operating systems at nuclear plants also tend to be legacy controls built decades ago and don’t have digital control systems that can be exploited by hackers.

“Since at least March 2016, Russian government cyber actors… targeted government entities and multiple U.S. critical infrastructure sectors, including the energy, nuclear, commercial facilities, water, aviation, and critical manufacturing sectors,” according to Thursday’s FBI and Department of Homeland Security report. The report did not say how successful the attacks were or specify the targets, but said that the Russian hackers “targeted small commercial facilities’ networks where they staged malware, conducted spearphishing, and gained remote access into energy sector networks.” At least one target of a string of infrastructure attacks last year was a nuclear power facility in Kansas.

Symantec doesn’t typically point fingers at particular nations in its research on cyberattacks, said Eric Chien, technical director of Symantec’s Security Technology and Response division, though he said his team doesn’t see anything it would disagree with in the new federal report. The government report appears to corroborate Symantec’s research, showing that the hackers had penetrated computers and accessed utility control rooms that would let them directly manipulate power systems, he says.

“There were really no more technical hurdles for them to do something like flip off the power,” he said.

And as for the group behind the attacks, Chien said it appears to be relatively dormant for now, but it has gone quiet in the past only to return with new hacks.

“We expect they’re sort of retooling now, and they likely will be back,”

In some cases, Dragonfly successfully broke into the core systems that control US and European energy companies, Symantec revealed.

“The energy sector has become an area of increased interest to cyber-attackers over the past two years,” Symantec said in its report.

“Most notably, disruptions to Ukraine’s power system in 2015 and 2016 were attributed to a cyberattack and led to power outages affecting hundreds of thousands of people. In recent months, there have also been media reports of attempted attacks on the electricity grids in some European countries, as well as reports of companies that manage nuclear facilities in the US being compromised by hackers.

“The Dragonfly group appears to be interested in both learning how energy facilities operate and also gaining access to operational systems themselves, to the extent that the group now potentially has the ability to sabotage or gain control of these systems should it decide to do so. Symantec customers are protected against the activities of the Dragonfly group.”

In recent weeks, senior US intelligence officials said that the Kremlin believes it can launch hacking operations against the West with impunity, including a cyber weapon that can disrupt power grids, according to assessments.

The DHS and FBI report further elaborated: “This campaign comprises two distinct categories of victims: staging and intended targets. The initial victims are peripheral organisations such as trusted third-party suppliers with less-secure networks, referred to as ‘staging targets’ throughout this alert.

“The threat actors used the staging targets’ networks as pivot points and malware repositories when targeting their final intended victims. National Cybersecurity and Communications Integration Center and FBI judge the ultimate objective of the actors is to compromise organisational networks, also referred to as the ‘intended target’.”

According to the US alert, hackers used a variety of attack methods, including spear-phishing emails, watering-hole domains, credential gathering, open source and network reconnaissance, host-based exploitation, and deliberate targeting of ICS infrastructure.

The attackers also targeted VPN software and used password cracking tools.

Once inside, the attackers downloaded tools from a remote server and then carried out a number of actions, including modifying key systems to store plaintext credentials in memory, and built web shells to gain command and control of targeted systems.

“This actors’ campaign has affected multiple organisations in the energy, nuclear, water, aviation, construction and critical manufacturing sectors, with hundreds of victims across the U.S. power grid confirmed,” the DHS said, before outlining a number of steps that IT managers in infrastructure organisations can take to cleanse their systems and defend against Russian hackers. he said.
 

Related News

• Electricity Forum News

• Grid Technologies News