Critical Infrastructure Threat Monitoring

Grid Security Tracker

Monitoring cyber and physical threats to America's power grid, the backbone of national security, public safety, and modern life.

Threat Level
HIGH
1,162
Cyberattacks on Utilities (2024)
▲ 70% year-over-year
185
Physical Attacks/Threats (2023)
▲ Record high, 2× since 2021
$27B
Federal Grid Modernization (BIL)
Bipartisan Infrastructure Law
+60/day
New Vulnerable Grid Points
▲ NERC 2024 warning
Grid Attack Trend: Reported Incidents by Year
Incident Timeline

Known Attacks & Incidents

Chronological record of significant cyber and physical attacks on US grid infrastructure

Mar 2025 CYBER NATION-STATE
Volt Typhoon Dwelled 300 Days in US Electric Grid
Dragos case study revealed Chinese state hackers maintained persistent access to a US electric utility for approximately 300 days, collecting OT system data. The compromise affected a Massachusetts-based utility with hackers present for roughly 10 months before detection.
Target: US Electric Utility (OT Systems) Duration: ~300 days undetected Outcome: Expelled after detection by Dragos
Oct–Dec 2024 CYBER NATION-STATE
Salt Typhoon Telecom Infiltration
Chinese state-sponsored group Salt Typhoon compromised at least nine major US telecommunications companies including Verizon, AT&T, and T-Mobile. While targeting telecom, the campaign exposed infrastructure interdependencies, telecom networks are critical for grid SCADA communications and utility coordination.
Target: 9+ US Telecoms Grid Risk: SCADA comms dependency Outcome: Treasury sanctions Jan 2025
2024 (Full Year) CYBER
Utility Cyberattacks Surge 70%
Check Point Research documented 1,162 cyberattacks on US utilities in 2024, a nearly 70% increase from 689 attacks during the same period in 2023. NERC warned that susceptible points on the grid are growing by approximately 60 per day as digital infrastructure expands.
1,162 documented attacks 70% YoY increase NERC: 60 new vulnerable points/day
Apr 2024 PHYSICAL
Arrest in Pacific NW Substation Attacks
A Washington state man was arrested and charged in connection with the 2022 attacks on Oregon electrical substations. The federal charging document indicated the attack caused more than $100,000 in damage. The attacks were part of a national pattern with possible ties to extremist groups.
Target: Clackamas County substations Damage: $100K+ Outcome: Federal charges filed
Jan 2024 CYBER NATION-STATE
DOJ Disrupts Volt Typhoon KV Botnet
The US Department of Justice announced the disruption of a botnet used by Volt Typhoon to conceal hacking of critical infrastructure. The hackers had infected hundreds of privately-owned SOHO routers with "KV Botnet" malware to obscure the Chinese origin of their intrusions into US energy and utility networks.
Target: Compromised SOHO routers Action: Botnet disrupted by FBI Outcome: Five Eyes joint advisory issued
2023 (Full Year) PHYSICAL
Physical Grid Attacks Hit Record: 185 Incidents
Power providers reported 185 instances of physical attacks or threats against critical grid infrastructure in 2023, beating the previous record from 2022 and doubling the number of incidents from 2021. DOE data showed 200 instances of vandalism, suspicious activity, sabotage, or physical attacks comprising 58% of all reported incidents.
185 reported incidents Record high, 2× vs 2021 58% of all grid incidents were physical
May 2023 CYBER NATION-STATE
Volt Typhoon Campaign Disclosed by Microsoft
Microsoft publicly disclosed the Volt Typhoon campaign, a Chinese state-sponsored hacking operation that had been pre-positioning inside US critical infrastructure including energy, water, and telecommunications. The group used "living off the land" techniques to avoid detection, targeting 23 pipeline operators and multiple electric utilities.
Target: Energy, Water, Telecom, Pipelines Technique: Living off the land Intent: Pre-positioning for conflict
Dec 3, 2022 PHYSICAL
Moore County, NC. Substation Shooting
Gunfire attacks on two Duke Energy electrical distribution substations in Moore County, North Carolina left up to 45,000 customers without power for several days. One woman died during the outage. The attack exposed critical vulnerabilities in physical grid security and sparked national debate about substation protection. A county-wide curfew and state of emergency were declared.
45,000 customers without power 1 death Multi-day outage Curfew & state of emergency
Nov–Dec 2022 PHYSICAL
Pacific Northwest Substation Attack Spree
At least 15 physical attacks on electrical substations across Oregon and Washington, more than the prior six years combined. Six confirmed deliberate attacks were documented across Portland General Electric, Bonneville Power Administration, Cowlitz County PUD, and Puget Sound Energy facilities. The FBI warned of neo-Nazi plots to take down the grid. Methods included gunfire, cutting fences, and equipment sabotage.
15+ attacks in Oregon & Washington Methods: Gunfire, sabotage, fence cutting FBI offered $50K reward
Feb 2022 PHYSICAL
White Supremacist Grid Attack Conspiracy
Three white supremacists pleaded guilty to a plot to shut down parts of the nation's power system to sow unrest and cause a "race war." Separately, four neo-Nazis in North Carolina were charged with a conspiracy to destroy a critical substation using guns and explosives. These cases revealed organized domestic extremist targeting of grid infrastructure.
Multiple guilty pleas Target: Critical substations FBI: Organized extremist plots
May 2021 CYBER RANSOMWARE
Colonial Pipeline Ransomware Attack
DarkSide ransomware group shut down the largest fuel pipeline in the US, disrupting gasoline supply across the East Coast. While targeting oil/gas rather than the electric grid directly, this attack became a watershed moment for energy infrastructure cybersecurity, demonstrating how a single ransomware attack could cripple critical energy delivery. Led to major policy shifts including TSA security directives for pipelines.
5,500-mile pipeline shut down $4.4M ransom paid (partially recovered) Outcome: TSA security directives
Threat Landscape

Who's Targeting the Grid

Five categories of threats facing America's power infrastructure

Nation-State Cyber Operations
CRITICAL THREAT
State-sponsored hackers are actively pre-positioning inside US grid infrastructure. The primary threat is China's Volt Typhoon campaign, which maintains persistent access to energy systems for potential wartime disruption. Russia's Sandworm (APT44/GRU Unit 74455) has demonstrated the capability to cause physical grid damage, executing two successful attacks on Ukraine's power grid (2015, 2016) and attacking Poland's grid in late 2025. Iran has also targeted US infrastructure.
Volt Typhoon Salt Typhoon Sandworm/APT44 Kamacite APT33
Physical Attacks & Domestic Extremism
HIGH THREAT
Physical attacks on substations reached 185 reported incidents in 2023, more than double the 2021 count. Tactics include gunfire at transformer equipment, fence-cutting, arson, and deliberate sabotage. The FBI has linked multiple plots to white supremacist and neo-Nazi groups seeking to cause mass blackouts and social disorder. The Moore County attack demonstrated how a simple rifle attack can knock out power for tens of thousands.
White Supremacists Neo-Nazi Groups Eco-Extremists Vandals/Thieves
Ransomware (Criminal)
HIGH THREAT
Criminal ransomware groups increasingly target energy infrastructure for financial gain. The Colonial Pipeline attack (2021) demonstrated cascading impacts across energy supply chains. Utilities face growing risk as IT/OT convergence creates new attack surfaces. The energy sector consistently ranks among the top targeted sectors in FBI IC3 reports, with attacks on utility operational technology becoming more sophisticated.
DarkSide/BlackMatter LockBit BlackCat/ALPHV Cl0p
Insider Threats
MEDIUM THREAT
Employees, contractors, and vendors with authorized access to grid systems pose a unique risk. Insiders can bypass technical controls, access sensitive OT environments, and cause damage that's difficult to detect. The GAO has flagged insider threats as a persistent concern for the electricity grid, noting that utilities often lack robust monitoring of privileged user behavior on industrial control systems.
Disgruntled Employees Compromised Contractors Privileged Access Abuse
Supply Chain Risks
HIGH THREAT
The grid depends on hardware and software from global supply chains, creating opportunities for compromise before equipment even reaches utilities. Malicious firmware in transformers, compromised SCADA components, and backdoored network equipment are all documented threat vectors. The DOE's 2024 Large Power Transformer Resilience Report highlighted that foreign-manufactured components in critical grid equipment pose national security risks. Supply chain attacks are projected to cost $60 billion in 2025.
Foreign-Made Components Software Supply Chain Counterfeit Equipment
Defense & Standards

What's Being Done

Federal standards, investments, and utility security programs protecting the grid

NERC CIP Standards
13 mandatory Critical Infrastructure Protection standards regulating cybersecurity for the Bulk Electric System. Enforced by NERC with penalties up to $1M/day for violations. CIP-015-1 (Internal Network Security Monitoring) added in 2024.
13 Active CIP standards with mandatory compliance
DOE Grid Modernization
The Bipartisan Infrastructure Law allocated $27 billion to DOE for grid modernization, resilience, and cybersecurity. DOE's Office of Cybersecurity, Energy Security, and Emergency Response (CESER) leads grid security research and incident response.
$27B BIL funding for grid modernization
CISA Cyber Programs
CISA received a $3 billion FY2025 budget, with $1.7B for cybersecurity programs. Leads the Joint Cyber Defense Collaborative (JCDC) for coordinating grid defense, and administers $1 billion in state/local cybersecurity grants over four years.
$3B CISA FY2025 budget allocation
Utility Security Spending
The global utilities security market was valued at $7.3 billion in 2023 and is growing at 17.4% CAGR. Smart grid cybersecurity spending alone reached $7.5 billion in 2024. Post-Moore County, utilities have increased investment in physical hardening including ballistic barriers, cameras, and motion sensors.
$7.5B Smart grid cybersecurity market (2024)

NERC CIP Standards Overview

Standard Focus Area Purpose
CIP-002BES Cyber System CategorizationIdentify and categorize critical cyber assets
CIP-003Security Management ControlsEstablish security policies and governance
CIP-004Personnel & TrainingBackground checks and cybersecurity training
CIP-005Electronic Security PerimetersNetwork segmentation and access controls
CIP-006Physical SecurityPhysical protection of BES cyber systems
CIP-007System Security ManagementPorts, services, patch management, malware prevention
CIP-008Incident Reporting & ResponseIncident response plans and reporting requirements
CIP-009Recovery PlansBackup and recovery procedures for cyber systems
CIP-010Configuration ManagementBaseline configurations and vulnerability assessments
CIP-011Information ProtectionProtection of BES cyber system information
CIP-012Communications ProtectionSecure real-time monitoring and assessment data
CIP-013Supply Chain Risk ManagementVendor and supply chain security
CIP-014Physical Security (Transmission)Protect critical transmission stations and substations
CIP-015Internal Network MonitoringNetwork security monitoring within BES environments (New: 2024)
Vulnerability Assessment

What Makes the Grid Vulnerable

Structural weaknesses in America's power infrastructure that amplify both cyber and physical risks

55,000+
Unmanned Substations
The US has over 55,000 substations connected to the grid, the vast majority unmanned and often protected by little more than chain-link fencing. A FERC analysis found that a coordinated attack on just 9 key substations could cripple the entire national grid. Many older substations lack modern physical security measures like ballistic barriers, CCTV, or advanced access controls.
60/day
Growing Attack Surface
NERC warned in 2024 that the number of susceptible points on the electrical grid is growing by approximately 60 per day as utilities digitize operations, deploy smart grid technology, and connect distributed energy resources. Each new internet-connected device, from smart meters to battery management systems, creates a potential entry point for attackers.
20+ yrs
Aging SCADA Systems
Many Supervisory Control and Data Acquisition (SCADA) systems controlling grid operations were designed decades ago without cybersecurity in mind. These legacy systems often can't be patched, run obsolete operating systems, and were never intended for internet connectivity. The convergence of IT and OT networks has connected these vulnerable systems to corporate networks, and by extension, the internet.
18–24 mo
Transformer Supply Crisis
Large power transformers (LPTs) take 18–24 months to manufacture and can cost $3–10 million each. The US has no domestic manufacturing capacity for the largest units. The DOE's 2024 LPT Resilience Report warned that extended replacement lead times present significant challenges, a coordinated attack destroying multiple transformers could cause outages lasting months to over a year.
IT↔OT
IT/OT Convergence Risk
The merging of Information Technology (IT) networks with Operational Technology (OT) systems creates pathways from the internet directly to physical grid controls. Volt Typhoon exploited exactly this, gaining access through IT networks and moving laterally toward OT systems controlling power delivery. Many utilities still lack adequate segmentation between business and operational networks.
3 Grids
Interconnection Cascading
The US grid operates as three interconnections (Eastern, Western, ERCOT) with interdependencies that can cascade failures. The 2003 Northeast Blackout demonstrated how a single point of failure can cascade, a software bug and untrimmed trees triggered a blackout affecting 50 million people across eight states and Canada. An intentional attack could trigger similar or worse cascading effects.
Scenario Analysis

What Would a Major Attack Look Like?

Estimated impacts based on public analyses from DOE, FERC, Lloyd's, CFR, and congressional testimony

Scenario 1: Targeted Physical Attack
Coordinated Substation Shootings
Rifle attacks on 9 critical high-voltage transformer substations simultaneously, modeled on the FERC "Metcalf scenario." Attackers target cooling systems and bushings of large power transformers, causing irreparable damage.
Customers Affected Tens of millions
Outage Duration Months to 18+ months
Recovery Constraint LPT lead time: 18-24 months
Source: FERC analysis; Congressional Research Service R43604; National Academies Press
Scenario 2: Cyberattack on Grid Controls
SCADA/ICS Compromise & Disruption
Nation-state actors (modeled on Russia's Sandworm Ukraine attacks) compromise SCADA systems controlling generation and transmission, opening breakers, damaging generators through false commands, and wiping control systems to delay recovery.
Customers Affected Up to 93 million (Lloyd's)
Economic Impact $243B. $1 trillion
Recovery Time Days to weeks
Death Rate Impact "Small rise" (Lloyd's estimate)
Source: Lloyd's of London/Cambridge Centre for Risk Studies; Council on Foreign Relations
Scenario 3: Combined Cyber-Physical Attack
Coordinated Multi-Vector Assault
A sophisticated adversary combines cyberattacks on control systems with physical sabotage of key substations, disabling protective relays via malware while simultaneously attacking transformers. Recovery efforts are hampered by compromised communications and control systems. Congressional testimony has identified this as the most dangerous scenario.
Economic Impact "Hundreds of billions"
Recovery Complexity Extreme, manual restart required
Precedent Ukraine 2015/2016 (smaller scale)
Source: Congressional hearing testimony (2015); DOE analysis; Ukraine grid attack case studies
Scenario 4: Reference: 2003 Northeast Blackout
Accidental Cascading Failure (Baseline)
The 2003 blackout, caused by a software bug and untrimmed trees, not an attack, provides a baseline for understanding cascading grid failures. An intentional attack exploiting similar cascade dynamics would be far worse because attackers could prevent automatic recovery mechanisms and target multiple simultaneous failure points.
People Affected 50 million
Duration Up to 4 days
Economic Losses $4B. $10B
Texas 2021 Comparison $130B, 240+ deaths
Source: US-Canada Power System Outage Task Force; Texas 2021 winter storm data (FAS)
Sources & References