Kaspersky Lab Discovers Russian Hacker Infrastructure


russian hacking code

High Voltage Maintenance Training Online

Our customized live online or in‑person group training can be delivered to your staff at your location.

  • Live Online
  • 12 hours Instructor-led
  • Group Training Available
Regular Price:
$599
Coupon Price:
$499
Reserve Your Seat Today

Crouching Yeti APT targets energy infrastructure with watering-hole attacks, compromising servers to steal credentials and stage intrusions; Kaspersky Lab links the Energetic Bear group to ICS threats across Russia, US, Europe, and Turkey.

 

Key Points

Crouching Yeti APT, aka Energetic Bear, is a threat group that targets energy firms using watering-hole attacks.

✅ Targets energy infrastructure via watering-hole compromises

✅ Uses open-source tools and backdoored sshd for persistence

✅ Scans global servers to stage intrusions and steal credentials

 

A hacker collective known for attacking industrial companies around the world have had some of their infrastructure identified by Russian security specialists.

Kaspersky Lab said that it has discovered a number of servers compromised by the group, belonging to different organisations based in Russia, the US, and Turkey, as well as European countries.

The Russian-speaking hackers, known as Crouching Yeti or Energetic Bear, mostly focus on energy facilities, as seen in reports of infiltration of the U.S. power grid targeting critical infrastructure, for the main purpose of stealing valuable data from victim systems.

 

Hacked servers

Crouching Yeti is described as an advanced persistent threat (APT) group that Kaspersky Lab has been tracking since 2010.

#google#

Kaspersky Lab said that the servers it has compromised are not just limited to industrial companies. The servers were hit in 2016 and 2017 with different intentions. Some were compromised to gain access to other resources or to be used as intermediaries to conduct attacks on other resources.

Others, including those hosting Russian websites, were used as watering holes.

It is a common tactic for Crouching Yeti to utilise watering hole attacks where the attackers inject websites with a link redirecting visitors to a malicious server.

“In the process of analysing infected servers, researchers identified numerous websites and servers used by organisations in Russia, US, Europe, Asia and Latin America that the attackers had scanned with various tools, possibly to find a server that could be used to establish a foothold for hosting the attackers’ tools and to subsequently develop an attack,” said the security specialists in a blog posting.

“The range of websites and servers that captured the attention of the intruders is extensive,” the firm said. “Kaspersky Lab researchers found that the attackers had scanned numerous websites of different types, including online stores and services, public organisations, NGOs, manufacturing, etc.

Kaspersky Lab said that the hackers used publicly available malicious tools, designed for analysing servers, and for seeking out and collecting information. The researchers also found a modified sshd file with a preinstalled backdoor. This was used to replace the original file and could be authorised with a ‘master password’.

“Crouching Yeti is a notorious Russian-speaking group that has been active for many years and is still successfully targeting industrial organisations through watering hole attacks, among other techniques,” explained Vladimir Dashchenko, head of vulnerability research group at Kaspersky Lab ICS CERT.

 

Russian government?

“Our findings show that the group compromised servers not only for establishing watering holes, but also for further scanning, and they actively used open-sourced tools that made it much harder to identify them afterwards,” he said.

“The group’s activities, such as initial data collection, the theft of authentication data, and the scanning of resources, are used to launch further attacks,” said Dashchenko. “The diversity of infected servers and scanned resources suggests the group may operate in the interests of the third parties.”

This may well tie into a similar conclusion from a rival security vendor.

In 2014 CrowdStrike claimed that the ‘Energetic Bear’ group was also tracked in Symantec's Dragonfly research and had been hacking foreign companies on behalf of the Russian state.

The security vendor had said the group had been carrying out attacks on foreign companies since 2012, with reports of breaches at U.S. power plants that underscored the campaign, and there was evidence that these operations were sanctioned by the Russian government.

Last month the United States for the first time publicly accused Russia in a condemnation of Russian grid hacking of attacks against the American power grid.

Symantec meanwhile warned last year of a resurgence in cyber attacks on European and US energy companies, including reports of access to U.S. utility control rooms that could result in widespread power outages.

And last July the UK’s National Cyber Security Centre (NCSC) acknowledged it was investigating a broad wave of attacks on companies in the British energy and manufacturing sectors.

 

Related News

Related News

Symantec Proves Russian

Dragonfly energy sector cyberattacks target ICS and SCADA across critical infrastructure, including the power grid and nuclear facilities, using spearphishing, watering-hole sites, supply-chain compromises, malware, and VPN exploits to gain operational access.

 

Key Points

Dragonfly APT campaigns target energy firms and ICS to gain grid access, risking manipulation and service disruption.

✅ Breaches leveraged spearphishing, watering-hole sites, and supply chains.

✅ Targeted ICS, SCADA, VPNs to pivot into operational networks.

✅ Aimed to enable power grid manipulation and potential outages.

 

An October, 2017 report by researchers at Symantec Corp., cited by the U.S. government, has linked recent US power grid cyber attacks to a group of hackers it had code-named "Dragonfly", and said it found evidence critical infrastructure facilities in Turkey and Switzerland also had been breached.

The Symantec researchers said an earlier wave of attacks by the same group starting in 2011 was used to gather intelligence on companies and their operational systems. The hackers then used that information for a more advanced wave of attacks targeting industrial control systems that, if disabled, leave millions without power or water.

U.S. intelligence officials have long been concerned about the security of the country’s electrical grid. The recent attacks, condemned by the U.S. government, striking almost simultaneously at multiple locations, are testing the government’s ability to coordinate an effective response among several private utilities, state and local officials, and industry regulators.

#google#

While the core of a nuclear generator is heavily protected, a sudden shutdown of the turbine can trigger safety systems. These safety devices are designed to disperse excess heat while the nuclear reaction is halted, but the safety systems themselves may be vulnerable to attack.

The operating systems at nuclear plants also tend to be legacy controls built decades ago and don’t have digital control systems that can be exploited by hackers.

“Since at least March 2016, Russian government cyber actors… targeted government entities and multiple U.S. critical infrastructure sectors, including the energy, nuclear, commercial facilities, water, aviation, and critical manufacturing sectors,” according to Thursday’s FBI and Department of Homeland Security report. The report did not say how successful the attacks were or specify the targets, but said that the Russian hackers “targeted small commercial facilities’ networks where they staged malware, conducted spearphishing, and gained remote access into energy sector networks.” At least one target of a string of infrastructure attacks last year was a nuclear power facility in Kansas.

Symantec doesn’t typically point fingers at particular nations in its research on cyberattacks, said Eric Chien, technical director of Symantec’s Security Technology and Response division, though he said his team doesn’t see anything it would disagree with in the new federal report. The government report appears to corroborate Symantec’s research, showing that the hackers had penetrated computers and accessed utility control rooms that would let them directly manipulate power systems, he says.

“There were really no more technical hurdles for them to do something like flip off the power,” he said.

And as for the group behind the attacks, Chien said it appears to be relatively dormant for now, but it has gone quiet in the past only to return with new hacks.

“We expect they’re sort of retooling now, and they likely will be back,”

 


 

In some cases, Dragonfly successfully broke into the core systems that control US and European energy companies, Symantec revealed.

“The energy sector has become an area of increased interest to cyber-attackers over the past two years,” Symantec said in its report.

“Most notably, disruptions to Ukraine’s power system in 2015 and 2016 were attributed to a cyberattack and led to power outages affecting hundreds of thousands of people. In recent months, there have also been media reports of attempted attacks on the electricity grids in some European countries, as well as reports of companies that manage nuclear facilities in the US being compromised by hackers.

“The Dragonfly group appears to be interested in both learning how energy facilities operate and also gaining access to operational systems themselves, to the extent that the group now potentially has the ability to sabotage or gain control of these systems should it decide to do so. Symantec customers are protected against the activities of the Dragonfly group.”

In recent weeks, senior US intelligence officials said that the Kremlin believes it can launch hacking operations against the West with impunity, including a cyber weapon that can disrupt power grids, according to assessments.

The DHS and FBI report further elaborated: “This campaign comprises two distinct categories of victims: staging and intended targets. The initial victims are peripheral organisations such as trusted third-party suppliers with less-secure networks, referred to as ‘staging targets’ throughout this alert.

“The threat actors used the staging targets’ networks as pivot points and malware repositories when targeting their final intended victims. National Cybersecurity and Communications Integration Center and FBI judge the ultimate objective of the actors is to compromise organisational networks, also referred to as the ‘intended target’.”

According to the US alert, hackers used a variety of attack methods, including spear-phishing emails, watering-hole domains, credential gathering, open source and network reconnaissance, host-based exploitation, and deliberate targeting of ICS infrastructure.

The attackers also targeted VPN software and used password cracking tools.

Once inside, the attackers downloaded tools from a remote server and then carried out a number of actions, including modifying key systems to store plaintext credentials in memory, and built web shells to gain command and control of targeted systems.

“This actors’ campaign has affected multiple organisations in the energy, nuclear, water, aviation, construction and critical manufacturing sectors, with hundreds of victims across the U.S. power grid confirmed,” the DHS said, before outlining a number of steps that IT managers in infrastructure organisations can take to cleanse their systems and defend against Russian hackers. he said.
 

 

Related News

View more

Canada could be electric, connected and clean — if it chooses

Canada Clean Energy Transition accelerates via carbon pricing, renewables, EV incentives, energy efficiency upgrades, smart grids, interprovincial transmission, and innovation in hydro, wind, solar, and storage to cut emissions and power sustainable growth.

 

Key Points

Canada Clean Energy Transition is a shift to renewables, EVs and efficiency powered by smart policy and innovation.

✅ Carbon pricing and EV incentives accelerate adoption

✅ Grid upgrades, storage, and transmission expand renewables

✅ Industry efficiency and smart tech cut energy waste

 

So, how do we get there?

We're already on our way.

The final weeks of 2016 delivered some progress, as Prime Minister Justin Trudeau and premiers of 11 of the 13 provinces and territories negotiated a new national climate plan. The deal is a game changer. It marks the moment that Canada stopped arguing about whether to tackle climate change and started figuring out how we're going to get there.

We can each be part of the solution by reducing the amount of energy we use, making sure our homes and workplaces are well insulated and choosing energy efficient appliances. When the time comes to upgrade our cars, washing machines and refrigerators, we can take advantage of rebates that cut the cost of electric models. In our homes, we can install smart technology — like automated thermostats — to cut down on energy waste and reduce power bills.

Even industries that use a lot of energy, like mining and manufacturing, could become leaders in sustainability. It would mean investing in energy saving technology, making their operations more efficient and running conveyor belts, robots and other equipment off locally produced renewable electricity.

Meanwhile, laboratories and factories in Ontario, Quebec and British Columbia are making breakthroughs in areas like energy storage, while renewable energy growth in the Prairie Provinces gathers momentum, which will make it possible to access clean power even when the sun isn't shining and the wind isn't blowing.

Liberal leader Justin Trudeau holds a copy of his environmental platform after announcing details of it at Jericho Beach Park in Vancouver, B.C., on Monday June 29, 2015. (Darryl Dyck/Canadian Press)

The scale and speed of Canada's transition to clean energy depends on provincial and federal policies that do things like tax carbon pollution, build interprovincial electricity transmission lines, invest in renewable energy and grid modernization projects that strengthen the system, and increase incentives for electric vehicles. 

Of course, even the best policies won't produce lasting results unless Canadians fight for them and take ownership for our role in the energy transition. Global momentum toward clean energy may be "irreversible," as former U.S. President Barack Obama recently wrote in the journal Science — but it's up to us whether Canada catches that wave or misses out.

Fortunately, clean energy has always been part of Canada's DNA.

We can learn from the past

In remote corners of the newly minted Dominion of Canada, rushing rivers turned the waterwheels that powered the lumber mills that built the places we inhabit today. The first electric lights were switched on in Winnipeg shortly after Confederation. By the turn of the 20th century, hydro power was lighting up towns and cities from coast to coast.  

Our country is home to some of the world's best clean energy resources, and experts note that zero-emissions electricity by 2035 is possible given our strengths, and fully two-thirds of our power is generated from renewable sources like hydro, wind and solar.

Looking to our heritage, we can make clean growth the next chapter in Canada's history

Recent commitments to phase out coal and invest in clean energy infrastructure mean the share of renewable power in Canada's energy mix is poised to grow. The global shift from fossil fuels to clean energy is opening up huge opportunities and Canada's opportunity in the global electricity market is growing as the country has the expertise to deliver solutions around the world.

Looking to our heritage, we can make clean growth the next chapter in Canada's history — building a nation that's electric, connected and on a practical, profitable path to 2035 zero-emission power for households and industry, stronger than ever.

 

Related News

View more

US Government Condemns Russia for Power Grid Hacking

Russian Cyberattacks on U.S. Critical Infrastructure target energy grids, nuclear plants, water systems, and aviation, DHS and FBI warn, using spear phishing, malware, and ICS/SCADA intrusion to gain footholds for potential sabotage and disruption.

 

Key Points

State-backed hacks targeting U.S. energy, nuclear, water and aviation via phishing and ICS access for sabotage.

✅ DHS and FBI detail multi-stage intrusion since 2016

✅ Targets include energy, nuclear, water, aviation, manufacturing

✅ TTPs: spear phishing, lateral movement, ICS reconnaissance

 

Russia is attacking the U.S. energy grid, with reported power plant breaches unfolding alongside attacks on nuclear facilities, water processing plants, aviation systems, and other critical infrastructure that millions of Americans rely on, according to a new joint analysis by the FBI and the Department of Homeland Security.

In an unprecedented alert, the US Department of Homeland Security (DHS) and FBI have warned of persistent attacks by Russian government hackers on critical US government sectors, including energy, nuclear, commercial facilities, water, aviation and manufacturing.

The alert details numerous attempts extending back to March 2016 when Russian cyber operatives targeted US government and infrastructure.

The DHS and FBI said: “DHS and FBI characterise this activity as a multi-stage intrusion campaign by Russian government cyber-actors who targeted small commercial facilities’ networks, where they staged malware, conducted spear phishing and gained remote access into energy sector networks.

“After obtaining access, the Russian government cyber-actors conducted network reconnaissance, moved laterally and collected information pertaining to industrial control systems.”

The Trump administration has accused Russia of engineering a series of cyberattacks that targeted American and European nuclear power plants and water and electric systems, and could have sabotaged or shut power plants off at will.

#google#

United States officials and private security firms saw the attacks as a signal by Moscow that it could disrupt the West’s critical facilities in the event of a conflict.

They said the strikes accelerated in late 2015, at the same time the Russian interference in the American election was underway. The attackers had compromised some operators in North America and Europe by spring 2017, after President Trump was inaugurated.

In the following months, according to the DHS/FBI report, Russian hackers made their way to machines with access to utility control rooms and critical control systems at power plants that were not identified. The hackers never went so far as to sabotage or shut down the computer systems that guide the operations of the plants.

Still, new computer screenshots released by the Department of Homeland Security have made clear that Russian state hackers had the foothold they would have needed to manipulate or shut down power plants.

“We now have evidence they’re sitting on the machines, connected to industrial control infrastructure, that allow them to effectively turn the power off or effect sabotage,” said Eric Chien, a security technology director at Symantec, a digital security firm.

“From what we can see, they were there. They have the ability to shut the power off. All that’s missing is some political motivation,” Mr. Chien said.

American intelligence agencies were aware of the attacks for the past year and a half, and the Department of Homeland Security and the F.B.I. first issued urgent warnings to utility companies in June, 2017. Both DHS/FBI have now offered new details as the Trump administration imposed sanctions against Russian individuals and organizations it accused of election meddling and “malicious cyberattacks.”

It was the first time the administration officially named Russia as the perpetrator of the assaults. And it marked the third time in recent months that the White House, departing from its usual reluctance to publicly reveal intelligence, blamed foreign government forces for attacks on infrastructure in the United States.

In December, the White House said North Korea had carried out the so-called WannaCry attack that in May paralyzed the British health system and placed ransomware in computers in schools, businesses and homes across the world. Last month, it accused Russia of being behind the NotPetya attack against Ukraine last June, the largest in a series of cyberattacks on Ukraine to date, paralyzing the country’s government agencies and financial systems.

But the penalties have been light. So far, President Trump has said little to nothing about the Russian role in those attacks.

The groups that conducted the energy attacks, which are linked to Russian intelligence agencies, appear to be different from the two hacking groups that were involved in the election interference.

That would suggest that at least three separate Russian cyberoperations were underway simultaneously. One focused on stealing documents from the Democratic National Committee and other political groups. Another, by a St. Petersburg “troll farm” known as the Internet Research Agency, used social media to sow discord and division. A third effort sought to burrow into the infrastructure of American and European nations.

For years, American intelligence officials tracked a number of Russian state-sponsored hacking units as they successfully penetrated the computer networks of critical infrastructure operators across North America and Europe, including in Ukraine.

Some of the units worked inside Russia’s Federal Security Service, the K.G.B. successor known by its Russian acronym, F.S.B.; others were embedded in the Russian military intelligence agency, known as the G.R.U. Still others were made up of Russian contractors working at the behest of Moscow.

Russian cyberattacks surged last year, starting three months after Mr. Trump took office.

American officials and private cybersecurity experts uncovered a series of Russian attacks aimed at the energy, water and aviation sectors and critical manufacturing, including nuclear plants, in the United States and Europe. In its urgent report in June, the Department of Homeland Security and the F.B.I. notified operators about the attacks but stopped short of identifying Russia as the culprit.

By then, Russian spies had compromised the business networks of several American energy, water and nuclear plants, mapping out their corporate structures and computer networks.

They included that of the Wolf Creek Nuclear Operating Corporation, which runs a nuclear plant near Burlington, Kan. But in that case, and those of other nuclear operators, Russian hackers had not leapt from the company’s business networks into the nuclear plant controls.

Forensic analysis suggested that Russian spies were looking for inroads — although it was not clear whether the goal was to conduct espionage or sabotage, or to trigger an explosion of some kind.

In a report made public in October, Symantec noted that a Russian hacking unit “appears to be interested in both learning how energy facilities operate and also gaining access to operational systems themselves, to the extent that the group now potentially has the ability to sabotage or gain control of these systems should it decide to do so.”

The United States sometimes does the same thing. It bored deeply into Iran’s infrastructure before the 2015 nuclear accord, placing digital “implants” in systems that would enable it to bring down power grids, command-and-control systems and other infrastructure in case a conflict broke out. The operation was code-named “Nitro Zeus,” and its revelation made clear that getting into the critical infrastructure of adversaries is now a standard element of preparing for possible conflict.

 


Reconstructed screenshot fragments of a Human Machine Interface that the threat actors accessed, according to DHS


Sanctions Announced

The US treasury department has imposed sanctions on 19 Russian people and five groups, including Moscow’s intelligence services, for meddling in the US 2016 presidential election and other malicious cyberattacks.

Russia, for its part, has vowed to retaliate against the new sanctions.

The new sanctions focus on five Russian groups, including the Russian Federal Security Service, the country’s military intelligence apparatus, and the digital propaganda outfit called the Internet Research Agency, as well as 19 people, some of them named in the indictment related to election meddling released by special counsel Robert Mueller last month.

In announcing the sanctions, which will generally ban U.S. people and financial institutions from doing business with those people and groups, the Treasury Department pointed to alleged Russian election meddling, involvement in the infrastructure hacks, and the NotPetya malware, which the Treasury Department called “the most destructive and costly cyberattack in history.”

The new sanctions come amid ongoing criticism of the Trump administration’s reluctance to punish Russia for cyber and election meddling. Sen. Mark Warner (D-Va.) said that, ahead of the 2018 mid-term elections, the administration’s decision was long overdue but not enough. “Nearly all of the entities and individuals who were sanctioned today were either previously under sanction during the Obama Administration, or had already been charged with federal crimes by the Special Counsel,” Warner said.

 

Warning: The Russians Are Coming

In an updated warning to utility companies, DHS/FBI officials included a screenshot taken by Russian operatives that proved they could now gain access to their victims’ critical controls, prompting a renewed focus on protecting the U.S. power grid among operators.

American officials and security firms, including Symantec and CrowdStrike, believe that Russian attacks on the Ukrainian power grid in 2015 and 2016 that left more than 200,000 citizens there in the dark are an ominous sign of what the Russian cyberstrikes may portend in the United States and Europe in the event of escalating hostilities.

Private security firms have tracked the Russian government assaults on Western power and energy operators — conducted alternately by groups under the names Dragonfly campaigns alongside Energetic Bear and Berserk Bear — since 2011, when they first started targeting defense and aviation companies in the United States and Canada.

By 2013, researchers had tied the Russian hackers to hundreds of attacks on the U.S. power grid and oil and gas pipeline operators in the United States and Europe. Initially, the strikes appeared to be motivated by industrial espionage — a natural conclusion at the time, researchers said, given the importance of Russia’s oil and gas industry.

But by December 2015, the Russian hacks had taken an aggressive turn. The attacks were no longer aimed at intelligence gathering, but at potentially sabotaging or shutting down plant operations.

At Symantec, researchers discovered that Russian hackers had begun taking screenshots of the machinery used in energy and nuclear plants, and stealing detailed descriptions of how they operated — suggesting they were conducting reconnaissance for a future attack.

Eventhough the US government enacted sanctions, cybersecurity experts are still questioning where the Russian attacks could lead, given that the United States was sure to respond in kind.

“Russia certainly has the technical capability to do damage, as it demonstrated in the Ukraine,” said Eric Cornelius, a cybersecurity expert at Cylance, a private security firm, who previously assessed critical infrastructure threats for the Department of Homeland Security during the Obama administration.

“It is unclear what their perceived benefit would be from causing damage on U.S. soil, especially given the retaliation it would provoke,” Mr. Cornelius said.

Though a major step toward deterrence, publicly naming countries accused of cyberattacks still is unlikely to shame them into stopping. The United States is struggling to come up with proportionate responses to the wide variety of cyberespionage, vandalism and outright attacks.

Lt. Gen. Paul Nakasone, who has been nominated as director of the National Security Agency and commander of United States Cyber Command, the military’s cyberunit, said during his recent Senate confirmation hearing, that countries attacking the United States so far have little to worry about.

“I would say right now they do not think much will happen to them,” General Nakasone said. He later added, “They don’t fear us.”

 

 

Related News

View more

After rising for 100 years, electricity demand is flat. Utilities are freaking out.

US Electricity Demand Stagnation reflects decoupling from GDP as TVA's IRP revises outlook, with energy efficiency, distributed generation, renewables, and cheap natural gas undercutting coal, reshaping utility business models and accelerating grid modernization.

 

Key Points

US electricity demand stagnation is flat load growth driven by efficiency, DG, and decoupling from GDP.

✅ Flat sales pressure IOU profits and legacy baseload investments.

✅ Efficiency and rooftop solar reduce load growth and capacity needs.

✅ Utilities must pivot to services, DER orchestration, and grid software.

 

The US electricity sector is in a period of unprecedented change and turmoil, with emerging utility trends reshaping strategies across the industry today. Renewable energy prices are falling like crazy. Natural gas production continues its extraordinary surge. Coal, the golden child of the current administration, is headed down the tubes.

In all that bedlam, it’s easy to lose sight of an equally important (if less sexy) trend: Demand for electricity is stagnant.

Thanks to a combination of greater energy efficiency, outsourcing of heavy industry, and customers generating their own power on site, demand for utility power has been flat for 10 years, with COVID-19 electricity demand underscoring recent variability and long-run stagnation, and most forecasts expect it to stay that way. The die was cast around 1998, when GDP growth and electricity demand growth became “decoupled”:


 

This historic shift has wreaked havoc in the utility industry in ways large and small, visible and obscure. Some of that havoc is high-profile and headline-making, as in the recent requests from utilities (and attempts by the Trump administration) to bail out large coal and nuclear plants amid coal and nuclear industry disruptions affecting power markets and reliability.

Some of it, however, is unfolding in more obscure quarters. A great example recently popped up in Tennessee, where one utility is finding its 20-year forecasts rendered archaic almost as soon as they are released.

 

Falling demand has TVA moving up its planning process

Every five years, the Tennessee Valley Authority (TVA) — the federally owned regional planning agency that, among other things, supplies electricity to Tennessee and parts of surrounding states — develops an Integrated Resource Plan (IRP) meant to assess what it requires to meet customer needs for the next 20 years.

The last IRP, completed in 2015, anticipated that there would be no need for major new investment in baseload (coal, nuclear, and hydro) power plants; it foresaw that energy efficiency and distributed (customer-owned) energy generation would hold down demand.

Even so, TVA underestimated. Just three years later, the Times Free Press reports, “TVA now expects to sell 13 percent less power in 2027 than it did two decades earlier — the first sustained reversal in the growth of electricity usage in the 85-year history of TVA.”

TVA will sell less electricity in 10 years than it did 10 years ago. That is bonkers.

This startling shift in prospects has prompted the company to accelerate its schedule. It will now develop its next IRP a year early, in 2019.

Think for a moment about why a big utility like TVA (serving 9 million customers in seven states, with more than $11 billion in revenue) sets out to plan 20 years ahead. It is investing in extremely large and capital-intensive infrastructure like power plants and transmission lines, which cost billions of dollars and last for decades. These are not decisions to make lightly; the utility wants to be sure that they will still be needed, and will still pay off, for many years to come.

Now think for a moment about what it means for the electricity sector to be changing so fast that TVA’s projections are out of date three years after its last IRP, so much so that it needs to plunge back into the multimillion-dollar, year-long process of developing a new plan.

TVA wanted a plan for 20 years; the plan lasted three.

 

The utility business model is headed for a reckoning

TVA, as a government-owned, fully regulated utility, has only the goals of “low cost, informed risk, environmental responsibility, reliability, diversity of power and flexibility to meet changing market conditions,” as its planning manager told the Times Free Press. (Yes, that’s already a lot of goals!)

But investor-owned utilities (IOUs), which administer electricity for well over half of Americans, face another imperative: to make money for investors. They can’t make money selling electricity; monopoly regulations forbid it, raising questions about utility revenue models as marginal energy costs fall. Instead, they make money by earning a rate of return on investments in electrical power plants and infrastructure.

The problem is, with demand stagnant, there’s not much need for new hardware. And a drop in investment means a drop in profit. Unable to continue the steady growth that their investors have always counted on, IOUs are treading water, watching as revenues dry up

Utilities have been frantically adjusting to this new normal. The generation utilities that sell into wholesale electricity markets (also under pressure from falling power prices; thanks to natural gas and renewables, wholesale power prices are down 70 percent from 2007) have reacted by cutting costs and merging. The regulated utilities that administer local distribution grids have responded by increasing investments in those grids, including efforts to improve electricity reliability and resilience at lower cost.

But these are temporary, limited responses, not enough to stay in business in the face of long-term decline in demand. Ultimately, deeper reforms will be necessary.

As I have explained at length, the US utility sector was built around the presumption of perpetual growth. Utilities were envisioned as entities that would build the electricity infrastructure to safely and affordably meet ever-rising demand, which was seen as a fixed, external factor, outside utility control.

But demand is no longer rising. What the US needs now are utilities that can manage and accelerate that decline in demand, increasing efficiency as they shift to cleaner generation. The new electricity paradigm is to match flexible, diverse, low-carbon supply with (increasingly controllable) demand, through sophisticated real-time sensing and software.

That’s simply a different model than current utilities are designed for. To adapt, the utility business model must change. Utilities need newly defined responsibilities and new ways to make money, through services rather than new hardware. That kind of reform will require regulators, politicians, and risky experiments. Very few states — New York, California, Massachusetts, a few others — have consciously set off down that path.

 

Flat or declining demand is going to force the issue

Even if natural gas and renewables weren’t roiling the sector, the end of demand growth would eventually force utility reform.

To be clear: For both economic and environmental reasons, it is good that US power demand has decoupled from GDP growth. As long as we’re getting the energy services we need, we want overall demand to decline. It saves money, reduces pollution, and avoids the need for expensive infrastructure.

But the way we’ve set up utilities, they must fight that trend. Every time they are forced to invest in energy efficiency or make some allowance for distributed generation (and they must always be forced), demand for their product declines, and with it their justification to make new investments.

Only when the utility model fundamentally changes — when utilities begin to see themselves primarily as architects and managers of high-efficiency, low-emissions, multidirectional electricity systems rather than just investors in infrastructure growth — can utilities turn in earnest to the kind planning they need to be doing.

In a climate-aligned world, utilities would view the decoupling of power demand from GDP growth as cause for celebration, a sign of success. They would throw themselves into accelerating the trend.

Instead, utilities find themselves constantly surprised, caught flat-footed again and again by a trend they desperately want to believe is temporary. Unless we can collectively reorient utilities to pursue rather than fear current trends in electricity, they are headed for a grim reckoning.

 

Related News

View more

Power Outage in Northeast D.C.

Northeast D.C. Power Outage highlights Pepco substation equipment failure, widespread service disruptions, grid reliability concerns, and restoration efforts, with calls for smart grid upgrades, better communication, and resilient infrastructure to protect residents, schools, and businesses.

 

Key Points

A Pepco substation failure caused outages, prompting restoration work and plans for smarter, resilient grid upgrades.

✅ Pepco cites substation equipment failure as root cause

✅ Crews prioritized rapid restoration and customer updates

✅ Calls grow for smart grid, resilience, and transparency

 

A recent power outage affecting Northeast Washington, D.C., has drawn attention to the vulnerabilities within the city’s energy infrastructure. The outage, caused by equipment failure at a Pepco substation, left thousands of residents in the dark and raised concerns about the reliability of electricity services in the area.

The Outage: What Happened?

On a typically busy weekday morning, Pepco, the local electric utility, reported significant power disruptions that affected several neighborhoods in Northeast D.C. Initial reports indicated that around 3,000 customers were without electricity due to issues at a nearby substation. The outages were widespread, impacting homes, schools, and businesses, and reflecting pandemic energy insecurity seen in many communities, creating a ripple effect of inconvenience and frustration.

Residents experienced not only the loss of power but also disruptions in daily activities. Many were unable to work from home, students faced challenges with remote learning, and businesses had to close or operate under limited conditions. The timing of the outage further exacerbated the situation, as it coincided with a period of increased demand for electricity, making efforts to prevent summer outages even more crucial for residents and businesses.

Community Response

In the wake of the outage, local community members and leaders quickly mobilized to assess the situation. Pepco crews were dispatched to restore power as swiftly as possible, but residents were left grappling with the immediate consequences. Local organizations and community leaders stepped in to provide support, especially as extreme heat can exacerbate electricity struggles for vulnerable households, offering resources such as food and shelter for those most affected.

Social media became a vital tool for residents to share information and updates about the situation. Many took to platforms like Twitter and Facebook to report their experiences and seek assistance. This grassroots communication helped keep the community informed and fostered a sense of solidarity during the disruption.

The Utility's Efforts

Pepco’s response involved not only restoring power but also addressing the underlying issues that led to the outage. The utility company communicated its commitment to investigating the cause of the equipment failure and ensuring that similar incidents would be less likely in the future. As part of this commitment, Pepco outlined plans for infrastructure upgrades, despite supply-chain constraints facing utilities nationwide, aimed at enhancing reliability across its service area.

Moreover, Pepco emphasized the importance of communication during outages. The company has been working to improve its notification systems, ensuring that customers receive timely updates about outages and restoration efforts. Enhanced communication can help mitigate the frustration experienced during such events and keep residents informed about when they can expect power to be restored.

Broader Implications for D.C.'s Energy Infrastructure

This recent outage has sparked a larger conversation about the resilience of Washington, D.C.’s energy infrastructure. As the city continues to grow and evolve, the demand for reliable electricity is more critical than ever. Frequent outages can undermine public confidence in utility providers and highlight the need for ongoing investment in infrastructure amid an aging U.S. grid that complicates renewable deployment and EV adoption across the country.

Experts suggest that to ensure a more reliable energy supply, utilities must embrace modernization efforts, including the integration of smart grid technology and renewable energy sources. These innovations can enhance the ability to manage electricity supply and demand, especially during unprecedented demand in the Eastern U.S. when heatwaves strain systems, reduce outages, and improve response times during emergencies.

The Path Forward

In response to the outage, community advocates are calling for greater transparency from Pepco and other utility companies. They emphasize the importance of holding utilities accountable for maintaining reliable service and communicating effectively with customers, while also promoting customer bill-reduction initiatives that help households manage costs. Public forums and discussions about energy policy can empower residents to voice their concerns and contribute to solutions.

As D.C. looks to the future, it is essential to prioritize investments in energy infrastructure that can withstand the demands of a growing population. Collaborations between local government, utility companies, and community organizations can drive initiatives aimed at enhancing resilience and ensuring that all residents have access to reliable electricity.

The recent power outage in Northeast D.C. serves as a reminder of the challenges facing urban energy infrastructure. While Pepco's efforts to restore power and improve communication are commendable, the incident highlights the need for long-term solutions to enhance reliability. By investing in modern technology and fostering community engagement, D.C. can work towards a more resilient energy future, ensuring that residents can count on their electricity service even in times of crisis.

 

Related News

View more

Florida Power & Light Faces Controversy Over Hurricane Rate Surcharge

FPL Hurricane Surcharge explained: restoration costs, Florida PSC review, rate impacts, grid resilience, and transparency after Hurricanes Debby and Helene as FPL funds infrastructure hardening and rapid storm recovery across Florida.

 

Key Points

A fee by Florida Power & Light to recoup hurricane restoration costs, under Florida PSC review for consumer fairness.

✅ Funds Debby and Helene restoration, materials, and crews

✅ Reviewed by Florida PSC for consumer protection and fairness

✅ Raises questions on grid resilience, transparency, and renewables

 

In the aftermath of recent hurricanes, Florida Power & Light (FPL) is under scrutiny as it implements a rate surcharge, alongside proposed rate hikes that span multiple years, to help cover the costs of restoration and recovery efforts. The surcharges, attributed to Hurricanes Debby and Helene, have stirred significant debate among consumers and state regulators, highlighting the ongoing challenges of hurricane preparedness and response in the Sunshine State.

Hurricanes are a regular threat in Florida, and FPL, as the state's largest utility provider, plays a critical role in restoring power and services after such events. However, the financial implications of these natural disasters often leave residents questioning the fairness and necessity of additional charges on their monthly bills. The newly proposed surcharge, which is expected to affect millions of customers, has ignited discussions about the adequacy of the company’s infrastructure investments and its responsibility in disaster recovery.

FPL’s decision to implement a surcharge comes as the company faces rising operational costs due to extensive damage caused by the hurricanes. Restoration efforts are not only labor-intensive but also require significant investment in materials and equipment to restore power swiftly and efficiently. With the added pressures of increased demand for electricity during peak hurricane seasons, utilities like FPL must navigate complex financial landscapes, similar to Snohomish PUD's weather-related rate hikes seen in other regions, while ensuring reliable service.

Consumer advocacy groups have raised concerns over the timing and justification for the surcharge. Many argue that frequent rate increases following natural disasters can strain already financially burdened households, echoing pandemic-related shutoff concerns raised during COVID that heightened energy insecurity. Florida residents are already facing inflationary pressures and rising living costs, making additional surcharges particularly difficult for many to absorb. Critics assert that utility companies should prioritize transparency and accountability, especially when it comes to costs incurred during emergencies.

The Florida Public Service Commission (PSC), which regulates utility rates and services, even as California regulators face calls for action amid soaring bills elsewhere, is tasked with reviewing the surcharge proposal. The commission’s role is crucial in determining whether the surcharge is justified and in line with the interests of consumers. As part of this process, stakeholders—including FPL, consumer advocacy groups, and the general public—will have the opportunity to voice their opinions and concerns. This input is essential in ensuring that the commission makes an informed decision that balances the utility’s financial needs with consumer protection.

In recent years, FPL has invested heavily in strengthening its infrastructure to better withstand hurricane impacts. These investments include hardening power lines, enhancing grid resilience, and implementing advanced technologies for quicker recovery, with public outage prevention tips also promoted to enhance preparedness. However, as storms become increasingly severe due to climate change, the question arises: are these measures sufficient? Critics argue that more proactive measures are needed to mitigate the impacts of future storms and reduce the reliance on post-disaster rate increases.

Additionally, the conversation around climate resilience is becoming increasingly prominent in discussions about energy policy in Florida. As extreme weather events grow more common, utilities are under pressure to innovate and adapt their systems. Some experts suggest that FPL and other utilities should explore alternative strategies, such as investing in decentralized energy resources like solar and battery storage, even as Florida declined federal solar incentives that could accelerate adoption, which could provide more reliable service during outages and reduce the overall strain on the grid.

The issue of rate surcharges also highlights a broader conversation about the energy landscape in Florida. With a growing emphasis on renewable energy and sustainability, consumers are becoming more aware of the environmental impacts of their energy choices, and some recall a one-time Gulf Power bill decrease as an example of short-term relief. This shift in consumer awareness may push utilities like FPL to reevaluate their business models and explore more sustainable practices that align with the public’s evolving expectations.

As FPL navigates the complexities of hurricane recovery and financial sustainability, the impending surcharge serves as a reminder of the ongoing challenges faced by utility providers in a climate-volatile world. While the need for recovery funding is undeniable, the manner in which it is implemented and communicated will be crucial in maintaining public trust and ensuring fair treatment of consumers. As discussions unfold in the coming weeks, all eyes will be on the PSC’s decision and FPL’s approach to balancing recovery efforts with consumer affordability.

 

Related News

View more

Sign Up for Electricity Forum’s Newsletter

Stay informed with our FREE Newsletter — get the latest news, breakthrough technologies, and expert insights, delivered straight to your inbox.

Electricity Today T&D Magazine Subscribe for FREE

Stay informed with the latest T&D policies and technologies.
  • Timely insights from industry experts
  • Practical solutions T&D engineers
  • Free access to every issue

Download the 2025 Electrical Training Catalog

Explore 50+ live, expert-led electrical training courses –

  • Interactive
  • Flexible
  • CEU-cerified