Advanced Persistent Threats (APT) are stealthy multi-step attacks, often executed over an extensive time period and tailored for a specific attack target. APTs represent a “low and slow” type of cyberattack, meaning that they most often remain undetected until the consequence of the attack becomes evident. Energy infrastructure, including power grids, oil and gas infrastructure, offshore wind installations, etc., form the basis of a modern digital nation. In addition to loss of power, financial systems, banking systems, digital national services, etc., become non-operational without electricity. Loss of power from an APT cyberattack could result in loss of life and the possibility of creating digital chaos. Digital payments becomes unavailable, digital identification is affected, and even POS terminals need to run on emergency power, which is limited in time, resulting in challenges in paying for food and beverages. Examples of Advanced Persistent Threats (APTs) targeting energy infrastructures include Triton, which in 2017 aimed to manipulate the safety systems of a petrochemical plant in Saudi Arabia, potentially leading to catastrophic physical consequences. Another significant incident is the Industroyer2 malware attack in 2022, which targeted a Ukrainian energy provider in an attempt to disrupt operations. The paper combines APT knowledge with energy infrastructure domain expertise, focusing on technical aspects while at the same time providing perspectives on societal consequences that could result from APTs.

The increasing threat of cyber-attacks on modern power systems highlights the need for a comprehensive examination through simulations. This study conducts an in-depth simulation of cyber-attacks on critical smart grid components, including smart meters, substation automation, and battery management systems, to expose and analyze potential disruptions to power system operations. We identify vulnerabilities that can lead to severe grid instabilities, such as voltage variations, system collapses, and inverter failures. Our analysis underscores the complex interactions between cyber threats and grid components, revealing how disruptions extend beyond mere load interruptions to affect the core infrastructure. We advocate for integrating established cybersecurity frameworks like NIST, ISO/IEC 27001, and IEC 62443, essential in fortifying grid stability against these dynamic threats. Our findings highlight the urgent need for continuous adaptation and enforcement of these frameworks to enhance resilience and ensure the reliability of modern power grids against cyber-attacks.

The increasing integration of Industrial Control Systems (ICS) and Cyber-Physical Systems (CPS) with the Internet of Things (IoT) has significantly enhanced their operational efficiency but also exposed them to advanced cyber threats. Traditional cybersecurity approaches, often tailored for IT systems, must address the unique complexities of ICS and CPS environments. This paper systematically reviews the integration of three critical areas: context-based modeling, digital twins, and machine learning (ML), to enhance cybersecurity for ICS and CPS. Context-based modeling provides dynamic, situational awareness; digital twins offer real-time system replicas for monitoring and simulation; and ML delivers predictive and adaptive threat detection and response capabilities. The review synthesizes findings from recent literature to answer four research questions focusing on methodologies in context-based modeling, applications of digital twins and ML in attack detection, and integrating these approaches for improved cyber resilience. The results demonstrate the synergistic potential of combining these technologies, enabling real-time anomaly detection, predictive threat analysis, and adaptive response mechanisms. Challenges such as data limitations, scalability, and verification complexities are vital areas requiring further research. This integrated framework offers a robust pathway for securing critical infrastructure and advancing cybersecurity practices in increasingly interconnected ICS and CPS environments.

In this paper, we provide an approach for analyzing cyber security threats and attacks in digital substations, which is based on several steps we performed within our work on two Research Council of Norway (RCN) projects. In the literature, there are various separate or theoretical concepts to understand and follow a security analysis of smart grids in general, but none is focused specifically on digital substations. Moreover, none is showing real applicability on an existing use case, making the implementation difficult. The approach we propose here is a result of our attempts to create a comprehensive overview of the individual steps we have been taking to do the analysis. For that reason, firstly, we start with defining and explaining a digital substation and its concepts, and the security challenges related to digital substations. Afterwards, we present the main steps of the security analysis for digital substation. The first step is the security pyramid. The following steps are threat analysis, threat modeling, risk assessment and the simulation impact analysis, which are another contribution from our group presented in this paper. Considering that the main goal of a security analysis is to create awareness for the stakeholders of digital substations, such an impact simulation provides a flexible way for stakeholders to see and to understand the consequences of security threats and attacks. We summarize the paper with an illustration of the steps we are taking in the form of the approach for digital substation.