Power Producers Oppose Legislation Helping Millstone Nuclear Plant

Russian cyberattacks on U.S. power grid exposed DHS warnings: Dragonfly/Energetic Bear breached control rooms, ICS networks, and could trigger blackouts via switch manipulation, phishing, and malware, threatening critical infrastructure and utility operations nationwide.

Key Points

State-backed breaches of utility ICS and control rooms enabled potential switch manipulation and blackouts.

✅ DHS: Dragonfly/Energetic Bear breached utility networks

✅ Access reached control rooms and ICS for switch control

✅ Ongoing campaign via phishing, malware, lateral movement

Russian hackers for a state-sponsored organization invaded hundreds of control rooms of U.S. electric utilities that could have led to blackouts, a new report says.

The group, known as Dragonfly or Energetic Bear, infiltrated networks of U.S. utilities as part of an effort that is likely ongoing, Department of Homeland Security officials told the Wall Street Journal.

Jonathan Home, chief of industrial-control-system analysis for DHS, said the hackers “got to the point where they could have thrown switches” and upset power flows.

Although the agency did not disclose which companies were impacted, the officials at a briefing Monday said that there were “hundreds of victims” including breaches at power plants across the U.S., and that some companies may not be aware that hackers infiltrated their networks yet.

According to experts, Russia has been preparing for such attacks for some time now, prompting a renewed focus on protecting the grid among utilities and policymakers.

“They’ve been intruding into our networks and are positioning themselves for a limited or widespread attack,” said former Deputy Assistant Defense Secretary Michael Carpenter, now senior director at the Penn Biden Center at the University of Pennsylvania, per the Wall Street Journal. “They are waging a covert war on the West.”

Earlier this year, the Trump administration claimed Russia had staged a power grid hacking campaign against the U.S. energy grid and other U.S. infrastructure.

The report comes after President Trump told reporters last week during a joint press conference in Helsinki alongside Russian President Vladimir Putin that he had no reason not to believe the Russian leader's assurances to him that the Kremlin was not to blame for interference in the election.

Trump later admitted that he misspoke when he said he didn’t “see any reason why” Russia would have meddled in the 2016 election, and said he believes the U.S. intelligence community assessment that found that the Russian government did interfere in the electoral process.

Related News

• Electricity Forum News

• Grid Technologies News

Crouching Yeti APT targets energy infrastructure with watering-hole attacks, compromising servers to steal credentials and stage intrusions; Kaspersky Lab links the Energetic Bear group to ICS threats across Russia, US, Europe, and Turkey.

Key Points

Crouching Yeti APT, aka Energetic Bear, is a threat group that targets energy firms using watering-hole attacks.

✅ Targets energy infrastructure via watering-hole compromises

✅ Uses open-source tools and backdoored sshd for persistence

✅ Scans global servers to stage intrusions and steal credentials

A hacker collective known for attacking industrial companies around the world have had some of their infrastructure identified by Russian security specialists.

Kaspersky Lab said that it has discovered a number of servers compromised by the group, belonging to different organisations based in Russia, the US, and Turkey, as well as European countries.

The Russian-speaking hackers, known as Crouching Yeti or Energetic Bear, mostly focus on energy facilities, as seen in reports of infiltration of the U.S. power grid targeting critical infrastructure, for the main purpose of stealing valuable data from victim systems.

Hacked servers

Crouching Yeti is described as an advanced persistent threat (APT) group that Kaspersky Lab has been tracking since 2010.

#google#

Kaspersky Lab said that the servers it has compromised are not just limited to industrial companies. The servers were hit in 2016 and 2017 with different intentions. Some were compromised to gain access to other resources or to be used as intermediaries to conduct attacks on other resources.

Others, including those hosting Russian websites, were used as watering holes.

It is a common tactic for Crouching Yeti to utilise watering hole attacks where the attackers inject websites with a link redirecting visitors to a malicious server.

“In the process of analysing infected servers, researchers identified numerous websites and servers used by organisations in Russia, US, Europe, Asia and Latin America that the attackers had scanned with various tools, possibly to find a server that could be used to establish a foothold for hosting the attackers’ tools and to subsequently develop an attack,” said the security specialists in a blog posting.

“The range of websites and servers that captured the attention of the intruders is extensive,” the firm said. “Kaspersky Lab researchers found that the attackers had scanned numerous websites of different types, including online stores and services, public organisations, NGOs, manufacturing, etc.

Kaspersky Lab said that the hackers used publicly available malicious tools, designed for analysing servers, and for seeking out and collecting information. The researchers also found a modified sshd file with a preinstalled backdoor. This was used to replace the original file and could be authorised with a ‘master password’.

“Crouching Yeti is a notorious Russian-speaking group that has been active for many years and is still successfully targeting industrial organisations through watering hole attacks, among other techniques,” explained Vladimir Dashchenko, head of vulnerability research group at Kaspersky Lab ICS CERT.

Russian government?

“Our findings show that the group compromised servers not only for establishing watering holes, but also for further scanning, and they actively used open-sourced tools that made it much harder to identify them afterwards,” he said.

“The group’s activities, such as initial data collection, the theft of authentication data, and the scanning of resources, are used to launch further attacks,” said Dashchenko. “The diversity of infected servers and scanned resources suggests the group may operate in the interests of the third parties.”

This may well tie into a similar conclusion from a rival security vendor.

In 2014 CrowdStrike claimed that the ‘Energetic Bear’ group was also tracked in Symantec's Dragonfly research and had been hacking foreign companies on behalf of the Russian state.

The security vendor had said the group had been carrying out attacks on foreign companies since 2012, with reports of breaches at U.S. power plants that underscored the campaign, and there was evidence that these operations were sanctioned by the Russian government.

Last month the United States for the first time publicly accused Russia in a condemnation of Russian grid hacking of attacks against the American power grid.

Symantec meanwhile warned last year of a resurgence in cyber attacks on European and US energy companies, including reports of access to U.S. utility control rooms that could result in widespread power outages.

And last July the UK’s National Cyber Security Centre (NCSC) acknowledged it was investigating a broad wave of attacks on companies in the British energy and manufacturing sectors.

Related News

• Electricity Forum News

• Grid Technologies News

Russia-Ukraine Energy Ceasefire explores halting strikes on power plants, safeguarding energy infrastructure and grids, easing humanitarian crises, stabilizing European markets, and advancing diplomatic talks on security, resilience, and critical infrastructure protection.

Key Points

A proposed pact to halt strikes on power plants, protect energy infrastructure, and stabilize grids and security.

✅ Shields power plants and grid infrastructure from attacks

✅ Eases humanitarian strain and improves winter resilience

✅ Supports European energy security and market stability

In a significant diplomatic development amid ongoing conflict, Russia and Ukraine are reportedly exploring the possibility of reaching an agreement to halt attacks on each other’s power plants. This potential cessation of hostilities could have far-reaching implications for the energy security and stability of both nations, as well as for the broader European energy landscape.

The Context of Energy Warfare

The conflict between Russia and Ukraine has escalated into what many analysts term "energy warfare," where both sides have targeted each other’s energy infrastructure. Such actions not only aim to undermine the adversary’s military capabilities but also have profound effects on civilian populations, leading to widespread power outages and humanitarian crises. Energy infrastructure has become a focal point in the conflict, with power plants and grids frequently damaged or destroyed.

The ongoing hostilities have raised concerns about energy security in Europe, with some warning of an energy nightmare if disruptions escalate, especially as many countries in the region rely on energy supplies from Russia. The attacks on power facilities exacerbate vulnerabilities in the energy supply chain, prompting calls for a ceasefire that encompasses energy infrastructure.

The Humanitarian Implications

The humanitarian impact of the conflict has been staggering, with millions of civilians affected by power outages, heating shortages, and disrupted access to essential services. The winter months, in particular, pose a grave challenge, as Ukraine prepares for winter amid ongoing energy constraints for vulnerable populations. A potential agreement to cease attacks on power plants could provide much-needed relief and stability for civilians caught in the crossfire.

International organizations, including the United Nations and various humanitarian NGOs, have been vocal in urging both parties to prioritize civilian safety and to protect critical infrastructure. Any agreement reached could facilitate aid efforts and enhance the overall humanitarian situation in affected areas.

Diplomatic Efforts and Negotiations

Reports indicate that diplomatic channels are being utilized to explore this potential agreement. While the specifics of the negotiations remain unclear, the idea of protecting energy infrastructure has been gaining traction among international diplomats. Key players, including European nations and the United States, with debates over U.S. energy security shaping positions, may play a pivotal role in mediating discussions.

Negotiating a ceasefire concerning energy infrastructure could serve as a preliminary step toward broader peace talks. By demonstrating goodwill through a tangible agreement, both parties might foster an environment conducive to further negotiations on other contentious issues in the conflict.

The Broader European Energy Landscape

The ramifications of an agreement between Russia and Ukraine extend beyond their borders. The stability of energy supplies in Europe is inextricably linked to the dynamics of the conflict, and the posture of certain EU states, such as Hungary's energy alliance with Russia, also shapes outcomes across the region. Many European nations have been grappling with rising energy prices and supply uncertainties, particularly in light of reduced gas supplies from Russia.

A halt to attacks on power plants could alleviate some of the strain on energy markets, which have experienced price hikes and instability in recent months, helping to stabilize prices and improve energy security for neighboring countries. Furthermore, it could pave the way for increased cooperation on energy issues, such as joint projects for renewable energy development or grid interconnections.

Future Considerations

While the prospect of an agreement is encouraging, skepticism remains about the willingness of both parties to adhere to such terms. The historical context of mistrust and previous violations of ceasefires, as both sides have accused each other of violations in recent months, raises questions about the durability of any potential pact. Continued dialogue and monitoring by international entities will be essential to ensure compliance and to build confidence between the parties.

Moreover, as discussions progress, it will be crucial to consider the long-term implications for energy policy in both Russia and Ukraine. The conflict has already prompted Ukraine to seek alternative energy sources and reduce its dependence on Russian gas, turning to electricity imports to keep the lights on, while Russia is exploring new markets for its energy exports.

The potential agreement between Russia and Ukraine to stop targeting each other’s power plants represents a glimmer of hope in a protracted conflict characterized by violence and humanitarian suffering. As both nations explore this diplomatic avenue, the implications for energy security, civilian safety, and the broader European energy landscape could be profound. Continued international support and monitoring will be vital to ensure that any agreement reached translates into real-world benefits for affected populations and contributes to a more stable energy future for the region.

Related News

• Electricity Forum News

• Power Generation News

Netherlands renewable energy progress highlights rising wind energy and solar power output, delivering 17 billion kWh of green electricity from sustainable sources, yet trailing EU targets, with wind providing 60% and solar 34%.

Key Points

It is the country's growth in green electricity, led by wind and solar, yet short of EU targets at 13.8% of generation.

✅ 17 billion kWh green output; 13.8% of total generation

✅ Wind energy up 16% to 9.6 billion kWh; 60% of green power

✅ Solar power up about 13%; 34% of renewable production

The Netherlands is generating more electricity from sustainable sources as US renewable record 28% in April underscores broader momentum but is still far from reaching its targets, the national statistics office CBS said on Friday.

In total, the Netherlands produced 17 billion kilowatts of green energy last year, a rise of 10% on 2016. Sustainable sources now account for 13.8 per cent of energy generation, even as solar reshapes prices in Northern Europe across the region.

The biggest growth was in wind energy – up 16 per cent to 9.6 billion kWh – or the equivalent of energy for three million households. Wind energy now accounts for 60 per cent of green Dutch power. The amount of solar power, which accounts for 34% of green energy production, rose almost 13 per cent, and Dutch solar outpaces Canada according to recent reports.

In January, European statistics agency Eurostat said the Netherlands is near the bottom of a new table on renewable energy use in Europe. The EU has a target of a fifth of all energy use from green sources by 2020 and – while some countries have reached their own targets, including Germany's 50% clean power milestones – the Dutch, French and Irish need to increase their rates by at least 6%, Eurostat said, and Ireland has set green electricity goals for the next four years to close the gap.

Related News

• Electricity Forum News

• Renewable Energy News

Dragonfly energy sector cyberattacks target ICS and SCADA across critical infrastructure, including the power grid and nuclear facilities, using spearphishing, watering-hole sites, supply-chain compromises, malware, and VPN exploits to gain operational access.

Key Points

Dragonfly APT campaigns target energy firms and ICS to gain grid access, risking manipulation and service disruption.

✅ Breaches leveraged spearphishing, watering-hole sites, and supply chains.

✅ Targeted ICS, SCADA, VPNs to pivot into operational networks.

✅ Aimed to enable power grid manipulation and potential outages.

An October, 2017 report by researchers at Symantec Corp., cited by the U.S. government, has linked recent US power grid cyber attacks to a group of hackers it had code-named "Dragonfly", and said it found evidence critical infrastructure facilities in Turkey and Switzerland also had been breached.

The Symantec researchers said an earlier wave of attacks by the same group starting in 2011 was used to gather intelligence on companies and their operational systems. The hackers then used that information for a more advanced wave of attacks targeting industrial control systems that, if disabled, leave millions without power or water.

U.S. intelligence officials have long been concerned about the security of the country’s electrical grid. The recent attacks, condemned by the U.S. government, striking almost simultaneously at multiple locations, are testing the government’s ability to coordinate an effective response among several private utilities, state and local officials, and industry regulators.

#google#

While the core of a nuclear generator is heavily protected, a sudden shutdown of the turbine can trigger safety systems. These safety devices are designed to disperse excess heat while the nuclear reaction is halted, but the safety systems themselves may be vulnerable to attack.

The operating systems at nuclear plants also tend to be legacy controls built decades ago and don’t have digital control systems that can be exploited by hackers.

“Since at least March 2016, Russian government cyber actors… targeted government entities and multiple U.S. critical infrastructure sectors, including the energy, nuclear, commercial facilities, water, aviation, and critical manufacturing sectors,” according to Thursday’s FBI and Department of Homeland Security report. The report did not say how successful the attacks were or specify the targets, but said that the Russian hackers “targeted small commercial facilities’ networks where they staged malware, conducted spearphishing, and gained remote access into energy sector networks.” At least one target of a string of infrastructure attacks last year was a nuclear power facility in Kansas.

Symantec doesn’t typically point fingers at particular nations in its research on cyberattacks, said Eric Chien, technical director of Symantec’s Security Technology and Response division, though he said his team doesn’t see anything it would disagree with in the new federal report. The government report appears to corroborate Symantec’s research, showing that the hackers had penetrated computers and accessed utility control rooms that would let them directly manipulate power systems, he says.

“There were really no more technical hurdles for them to do something like flip off the power,” he said.

And as for the group behind the attacks, Chien said it appears to be relatively dormant for now, but it has gone quiet in the past only to return with new hacks.

“We expect they’re sort of retooling now, and they likely will be back,”

In some cases, Dragonfly successfully broke into the core systems that control US and European energy companies, Symantec revealed.

“The energy sector has become an area of increased interest to cyber-attackers over the past two years,” Symantec said in its report.

“Most notably, disruptions to Ukraine’s power system in 2015 and 2016 were attributed to a cyberattack and led to power outages affecting hundreds of thousands of people. In recent months, there have also been media reports of attempted attacks on the electricity grids in some European countries, as well as reports of companies that manage nuclear facilities in the US being compromised by hackers.

“The Dragonfly group appears to be interested in both learning how energy facilities operate and also gaining access to operational systems themselves, to the extent that the group now potentially has the ability to sabotage or gain control of these systems should it decide to do so. Symantec customers are protected against the activities of the Dragonfly group.”

In recent weeks, senior US intelligence officials said that the Kremlin believes it can launch hacking operations against the West with impunity, including a cyber weapon that can disrupt power grids, according to assessments.

The DHS and FBI report further elaborated: “This campaign comprises two distinct categories of victims: staging and intended targets. The initial victims are peripheral organisations such as trusted third-party suppliers with less-secure networks, referred to as ‘staging targets’ throughout this alert.

“The threat actors used the staging targets’ networks as pivot points and malware repositories when targeting their final intended victims. National Cybersecurity and Communications Integration Center and FBI judge the ultimate objective of the actors is to compromise organisational networks, also referred to as the ‘intended target’.”

According to the US alert, hackers used a variety of attack methods, including spear-phishing emails, watering-hole domains, credential gathering, open source and network reconnaissance, host-based exploitation, and deliberate targeting of ICS infrastructure.

The attackers also targeted VPN software and used password cracking tools.

Once inside, the attackers downloaded tools from a remote server and then carried out a number of actions, including modifying key systems to store plaintext credentials in memory, and built web shells to gain command and control of targeted systems.

“This actors’ campaign has affected multiple organisations in the energy, nuclear, water, aviation, construction and critical manufacturing sectors, with hundreds of victims across the U.S. power grid confirmed,” the DHS said, before outlining a number of steps that IT managers in infrastructure organisations can take to cleanse their systems and defend against Russian hackers. he said.
 

Related News

• Electricity Forum News

• Grid Technologies News

ICT Electricity Demand is surging as data centers, 5G, IoT, and server farms expand, straining grids, boosting carbon emissions, and challenging climate targets unless efficiency, renewable energy, and smarter cooling dramatically improve.

Key Points

ICT electricity demand is power used by networks, devices, and data centers across the global communications sector.

✅ Projected to reach up to 20 percent of global electricity by 2025

✅ Driven by data centers, 5G traffic, IoT, and high-res streaming

✅ Mitigation: efficiency, renewable PPAs, advanced cooling, workload shifts

The communications industry could use 20% of all the world’s electricity by 2025, hampering attempts to meet climate change targets, even as countries like New Zealand's electrification plans seek broader decarbonization, and straining grids as demand by power-hungry server farms storing digital data from billions of smartphones, tablets and internet-connected devices grows exponentially.

The industry has long argued that it can considerably reduce carbon emissions by increasing efficiency and reducing waste, but academics are challenging industry assumptions. A new paper, due to be published by US researchers later this month, will forecast that information and communications technology could create up to 3.5% of global emissions by 2020 – surpassing aviation and shipping – and up to 14% 2040, around the same proportion as the US today.

Global computing power demand from internet-connected devices, high resolution video streaming, emails, surveillance cameras and a new generation of smart TVs is increasing 20% a year, consuming roughly 3-5% of the world’s electricity in 2015, says Swedish researcher Anders Andrae.

In an update o a 2016 peer-reviewed study, Andrae found that without dramatic increases in efficiency, the ICT industry could use 20% of all electricity and emit up to 5.5% of the world’s carbon emissions by 2025. This would be more than any country, except China, India and the USA, where China's data center electricity use is drawing scrutiny.

He expects industry power demand to increase from 200-300 terawatt hours (TWh) of electricity a year now, to 1,200 or even 3,000TWh by 2025. Data centres on their own could produce 1.9 gigatonnes (Gt) (or 3.2% of the global total) of carbon emissions, he says.

“The situation is alarming,” said Andrae, who works for the Chinese communications technology firm Huawei. “We have a tsunami of data approaching. Everything which can be is being digitalised. It is a perfect storm. 5G [the fifth generation of mobile technology] is coming, IP [internet protocol] traffic is much higher than estimated, and all cars and machines, robots and artificial intelligence are being digitalised, producing huge amounts of data which is stored in data centres.”

US researchers expect power consumption to triple in the next five years as one billion more people come online in developing countries, and the “internet of things” (IoT), driverless cars, robots, video surveillance and artificial intelligence grows exponentially in rich countries.

The industry has encouraged the idea that the digital transformation of economies and large-scale energy efficiencies will slash global emissions by 20% or more, but the scale and speed of the revolution has been a surprise.

Global internet traffic will increase nearly threefold in the next five years says the latest Cisco Visual Networking Index, a leading industry tracker of internet use.

“More than one billion new internet users are expected, growing from three billion in 2015 to 4.1bn by 2020. Over the next five years global IP networks will support up to 10bn new devices and connections, increasing from 16.3bn in 2015 to 26bn by 2020,” says Cisco.

A 2016 Berkeley laboratory report for the US government estimated the country’s data centres, which held about 350m terabytes of data in 2015, could together need over 100TWh of electricity a year by 2020. This is the equivalent of about 10 large nuclear power stations.

Data centre capacity is also rocketing in Europe, where the EU's plan to double electricity use by 2050 could compound demand, and Asia with London, Frankfurt, Paris and Amsterdam expected to add nearly 200MW of consumption in 2017, or the power equivalent of a medium size power station.

“We are seeing massive growth of data centres in all regions. Trends that started in the US are now standard in Europe. Asia is taking off massively,” says Mitual Patel, head of EMEA data centre research at global investment firm CBRE.

“The volume of data being handled by such centres is growing at unprecedented rates. They are seen as a key element in the next stage of growth for the ICT industry”, says Peter Corcoran, a researcher at the university of Ireland, Galway.

Using renewable energy sounds good but no one else benefits from what will be generated, and it skews national attempts to reduce emissions

Ireland, which with Denmark is becoming a data base for the world’s biggest tech companies, has 350MW connected to data centres but this is expected to triple to over 1,000MW, or the equivalent of a nuclear power station size plant, in the next five years.

Permission has been given for a further 550MW to be connected and 750MW more is in the pipeline, says Eirgrid, the country’s main grid operator.

“If all enquiries connect, the data centre load could account for 20% of Ireland’s peak demand,” says Eirgrid in its All-Island Generation Capacity Statement 2017-2026  report.

The data will be stored in vast new one million square feet or larger “hyper-scale” server farms, which companies are now building. The scale of these farms is huge; a single $1bn Apple data centre planned for Athenry in Co Galway, expects to eventually use 300MW of electricity, or over 8% of the national capacity and more than the daily entire usage of Dublin. It will require 144 large diesel generators as back up for when the wind does not blow.

 Facebook’s Lulea data centre in Sweden, located on the edge of the Arctic circle, uses outside air for cooling rather than air conditioning and runs on hydroelectic power generated on the nearby Lule River. Photograph: David Levene for the Guardian

Pressed by Greenpeace and other environment groups, large tech companies with a public face , including Google, Facebook, Apple, Intel and Amazon, have promised to use renewable energy to power data centres. In most cases they are buying it off grid but some are planning to build solar and wind farms close to their centres.

Greenpeace IT analyst Gary Cook says only about 20% of the electricity used in the world’s data centres is so far renewable, with 80% of the power still coming from fossil fuels.

“The good news is that some companies have certainly embraced their responsibility, and are moving quite aggressively to meet their rapid growth with renewable energy. Others are just growing aggressively,” he says.

Architect David Hughes, who has challenged Apple’s new centre in Ireland, says the government should not be taken in by the promises.

“Using renewable energy sounds good but no one else benefits from what will be generated, and it skews national attempts to reduce emissions. Data centres … have eaten into any progress we made to achieving Ireland’s 40% carbon emissions reduction target. They are just adding to demand and reducing our percentage. They are getting a free ride at the Irish citizens’ expense,” says Hughes.

Eirgrid estimates indicate that by 2025, one in every 3kWh generated in Ireland could be going to a data centre, he added. “We have sleepwalked our way into a 10% increase in electricity consumption.”

Fossil fuel plants may have to be kept open longer to power other parts of the country, and manage issues like SF6 use in electrical equipment, and the costs will fall on the consumer, he says. “We will have to upgrade our grid and build more power generation both wind and backup generation for when the wind isn’t there and this all goes onto people’s bills.”

Under a best case scenario, says Andrae, there will be massive continuous improvements of power saving, as the global energy transition gathers pace, renewable energy will become the norm and the explosive growth in demand for data will slow.

But equally, he says, demand could continue to rise dramatically if the industry keeps growing at 20% a year, driverless cars each with dozens of embedded sensors, and cypto-currencies like Bitcoin which need vast amounts of computer power become mainstream.

“There is a real risk that it all gets out of control. Policy makers need to keep a close eye on this,” says Andrae.

Related News

• Electricity Forum News

• Climate Change News