Energy has become one of the most sensitive areas of contemporary geopolitical rivalry. As states fight increasingly in the digital sphere, energy infrastructure represents a major strategic target. It concentrates essential resources and determines the functioning of an entire country, and its disruption can have immediate consequences for populations. Over the past 15 years or so, state-backed groups have specialized in this sector, carrying out sabotage, espionage, and operational preparation. Winter further intensifies this vulnerability, as energy demand increases and margins for flexibility decrease.
To understand the scale of the risks, it is necessary to trace the evolution of attacks against industrial systems and analyze how hostile actors exploit states’ energy dependence.
The modern history of energy cybersecurity began in 2010 with Stuxnet. This extremely sophisticated malware specifically targeted Siemens industrial programmable logic controllers used in centrifuges in Iran’s nuclear program. Unlike traditional cyberattacks, Stuxnet’s goal was not to steal data, but to cause physical damage by manipulating the speed of the centrifuges while masking the anomalies.
Its characteristics laid the foundations for modern industrial cyberattacks:
The aftermath revealed that physical infrastructure could be sabotaged remotely, without missiles or explosives. Since then, the boundary between the cyber and physical worlds has become porous.
In 2015 and then again in 2016, the Ukrainian power grid suffered two major attacks. Attributed to the Sandworm group, believed to be an elite group of hackers belonging to the Russian military, these attacks were the first large-scale power outages deliberately caused by a digital operation.
These attacks showed that it was possible
Western operators realized that their own networks, which are often old, interconnected, and partially automated, were exposed to the same risks.
In 2017, the Triton (or Trisis) attack targeted a petrochemical plant in the Middle East. The malware targeted Schneider Electric functional safety systems, designed to protect the facility in the event of a failure. The attempt was serious, as compromising these systems could have led to an explosion and human casualties.
This attack marks a turning point:
Triton remains one of the most dangerous attacks of its kind in the history of cybercrime.
In 2021, DarkSide ransomware crippled Colonial Pipeline. The attack did not target industrial systems, but administrative IT systems. However, the company shut down its pipeline network as a precautionary measure.
This crisis revealed several realities:
The queues at gas stations, the temporary surge in prices, and the government’s response showed the extreme sensitivity of energy supply chains.
Since the onset of energy tensions in Europe in 2022, attempts to infiltrate critical infrastructure have skyrocketed. The most targeted sectors are:
Groups are increasingly carrying out attacks that allow for stealthy initial access, seeking to maintain a discreet presence until a geopolitical situation makes a visible attack opportune.
The most active groups include:
Their strategy combines espionage, preparation, potential disruption, and sometimes manipulation of industrial parameters. This type of attack is called APT (Advanced Persistent Threat), and combines a very high level of technical sophistication, capable of stealthily penetrating the critical systems of large organizations (companies or institutional actors), and remaining persistent (staying dormant for long periods of time).
There are several reasons for this focus:
A well-coordinated attack can cause:
Energy is no longer a resource: it is a strategic lever.
The last fifteen years have seen a steady escalation in this area, which is often overlooked by the public. The energy sector has become a digital battleground in its own right. APT groups use winter as a strategic opportunity to maximize their impact. Understanding this threat is essential to answering the question we will address in our second part: how can continuity be guaranteed even in the event of an attack? In the meantime, if you have a movie, TV series, software, or e-book that you need to protect, don’t hesitate to call on our services by contacting one of our account managers. PDN has been a pioneer in cybersecurity and anti-piracy for over ten years, and we are sure to have a solution to help you. Enjoy reading, and see you soon!
Share this article
