Energy threat landscape
Electric utilities, oil & gas and power generation — a strategic target for both state-sponsored intrusion and extortion.
Matched automatically by keyword — not by AI or analyst judgement. Rebuilt daily. Last rebuilt 2026-10-20.
- Threat actors
- 15
- Actively-attacked vulnerabilities (CISA KEV)
- 0
- Ransomware victims, last 90 days
- 94
- Ransomware victims, since 2026-06
- 128
Shared bucket: ransomware.live groups Critical Infrastructure into “Energy, Energy & Utilities” — the ransomware figures on this page are the same victims shown on the Critical Infrastructure page, not additional ones.
Threat actors
Actors whose feed descriptions reference this sector, ranked by graph connectivity.
| Actor | What the feeds say | Connections in our data |
|---|---|---|
| MuddyWater | MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS). Since at le… | 395 |
| LAPSUS$ | LAPSUS$ is cyber criminal threat group that has been active since at least mid-2021. LAPSUS$ specializes in large-scale social engineering and extortion opera… | 365 |
| OilRig | OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government… | 293 |
| APT-C-36 | APT-C-36 is a suspected South American threat group that has engaged in espionage and financially motivated operations since at least 2018. APT-C-36 has targe… | 275 |
| Threat Group-3390 | Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims. The group has been active since at least 2010 and has target… | 224 |
| HEXANE | HEXANE is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations since at least 2017. Targeted companies have been locat… | 215 |
| APT33 | APT33 is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States, Saudi Arabia, and… | 182 |
| Tonto Team | Tonto Team is a suspected Chinese state-sponsored cyber espionage threat group that has primarily targeted South Korea, Japan, Taiwan, and the United States since at least 2009; by 2020 they expanded… | 168 |
| Fox Kitten | Fox Kitten is threat actor with a suspected nexus to the Iranian government that has been active since at least 2017 against entities in the Middle East, North Africa, Europe, Australia, and North Am… | 164 |
| menuPass | menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with the Chinese Mi… | 153 |
| Moses Staff | Moses Staff is a suspected Iranian threat group that has primarily targeted Israeli companies since at least September 2021. Moses Staff openly stated their m… | 106 |
| BITTER | BITTER is a suspected South Asian cyber espionage threat group that has been active since at least 2013. BITTER has targeted government, energy, and engineeri… | 94 |
| APT19 | APT19 is a Chinese-based threat group that has targeted a variety of industries, including defense, finance, energy, pharmaceutical, telecommunications, high tech, education, manufacturing, and legal… | 80 |
| Operation Wocao | Operation Wocao described activities carried out by a China-based cyber espionage adversary. Operation Wocao targeted entities within the government, managed… | 1 |
| Sharpshooter | Operation Sharpshooter is the name of a cyber espionage campaign discovered in October 2018 targeting nuclear, defense, energy, and financial companies. Though overlaps between this adversary and [La… | 1 |
Campaigns
Campaigns and intel pulses mentioning this sector, most recent first. Showing 15 of 42.
| Campaign | Description | Linked actors | Seen |
|---|---|---|---|
| Operation Spalax | Operation Spalax was a campaign that primarily targeted Colombian government organizations and private companies, particularly those associated with the energy and metallurgical industries. The [O… | — | — |
| Operation Wocao | Operation Wocao was a cyber espionage campaign that targeted organizations around the world, including in Brazil, China, France, Germany, Italy, Mexico, Portugal, Spain, the United Kingdom, and th… | — | — |
| Night Dragon | Night Dragon was a cyber espionage campaign that targeted oil, energy, and petrochemical companies, along with individuals and executives in Kazakhstan, Taiwan, Greece, and the United States. The… | — | — |
| J-magic Campaign | The J-magic Campaign was active from mid-2023 to at least mid-2024 and featured the use of the J-magic backdoor, a custom cd00r variant tailored for use… | — | — |
| Operation Dust Storm | Operation Dust Storm was a long-standing persistent cyber espionage campaign that targeted multiple industries in Japan, South Korea, the United States, Europe, and several Southeast Asian countri… | — | — |
| Operation Sharpshooter | Operation Sharpshooter was a global cyber espionage campaign that targeted nuclear, defense, government, energy, and financial companies, with many located in Germany, Turkey, the United Kingdom,… | — | — |
| 2016 Ukraine Electric Power Attack | 2016 Ukraine Electric Power Attack was a Sandworm Team campaign during which they used Industroyer malware to ta… | Sandworm Team | — |
| 2025 Poland Wiper Attacks | 2025 Poland Wiper Attacks is a Russian state-sponsored campaign that conducted destructive cyberattacks against Polish energy infrastructure in December 2025. Targets included more than 30 wind an… | — | — |
| Indian Critical Infrastructure Intrusions | Indian Critical Infrastructure Intrusions is a sequence of intrusions from 2021 through early 2022 linked to People’s Republic of China (PRC) threat actors, particularly [RedEcho](https://attack.m… | — | — |
| C0010 | C0010 was a cyber espionage campaign conducted by UNC3890 that targeted Israeli shipping, government, aviation, energy, and healthcare organizations. Security researcher assess UNC3890 conducts op… | — | — |
| C0021 | C0021 was a spearphishing campaign conducted in November 2018 that targeted public sector institutions, non-governmental organizations (NGOs), educational institutions, and private-sector corporat… | — | — |
| 2015 Ukraine Electric Power Attack | 2015 Ukraine Electric Power Attack was a Sandworm Team campaign during which they used BlackEnergy (specifically… | Sandworm Team | — |
| KV Botnet Activity | KV Botnet Activity consisted of exploitation of primarily “end-of-life” small office-home office (SOHO) equipment from manufacturers such as Cisco, NETGEAR, and DrayTek. [KV Botnet Activity](https… | Volt Typhoon | — |
| 2022 Ukraine Electric Power Attack | The 2022 Ukraine Electric Power Attack was a Sandworm Team campaign that used a combination of GOGETTER, Neo-REGEORG, [CaddyWiper](https://attack.mitre.org… | Sandworm Team | — |
| Quad7 Activity | Quad7 Activity, also known as CovertNetwork-1658 or the 7777 Botnet, is a network of compromised small office/home office (SOHO) routers. The botnet was initially composed p… | — | — |
ATT&CK techniques
Techniques used by the actors above — what to detect for, ranked by how many of them use it. Showing 15 of 206.
Known-exploited CVEs
CISA KEV entries whose vendor, product or description matches this sector — 0 total, latest below.
No known-exploited CVEs currently surfaced in the graph for this sector. That's the honest reading — we report what the feeds show, not what would fill a table.
High-severity CVEs
Vulnerabilities whose descriptions reference this sector, by CVSS.
| CVE | CVSS | Description | KEV |
|---|---|---|---|
| CVE-2025-64123 | 9.8 | Unintended Proxy or Intermediary vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Network Boundary Bridging.This issue affects Multi-Stack Controller (MSC): through and including release 2.5.1.… | |
| CVE-2025-64121 | 9.8 | Authentication Bypass Using an Alternate Path or Channel vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Authentication Bypass.This issue affects Multi-Stack Controller (MSC): from 2.3.8 before 2.5.1… | |
| CVE-2026-8066 | 9.1 | A directory traversal vulnerability in the file upload functionality of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to write or overwrite arbitrary files on the device file system. Depen… | |
| CVE-2026-8065 | 9.1 | An authentication bypass vulnerability in the firmware update endpoint of Hitachi Energy RTU500 end-of-life versions allows an unauthenticated attacker to upload arbitrary firmware through a crafted POST request. Success… | |
| CVE-2025-65824 | 8.8 | An unauthenticated attacker within proximity of the Meatmeet device can perform an unauthorized Over The Air (OTA) firmware upgrade using Bluetooth Low Energy (BLE), resulting in the firmware on the device being overwrit… | |
| CVE-2026-38056 | 8.8 | A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT terminal running firmware 23.0.1.0. The iQ200 is a rackmount satellite modem deployed across oil and gas, maritime, defense, and remote infrastr… | |
| CVE-2025-64124 | 8.8 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows OS Command Injection.This issue affects Multi-Stack Controll… | |
| CVE-2025-32283 | 8.8 | Deserialization of Untrusted Data vulnerability in designthemes Solar Energy solar allows Object Injection.This issue affects Solar Energy: from n/a through <= 3.5.… | |
| CVE-2025-64120 | 8.8 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows OS Command Injection.This issue affects Multi-Stack Controll… | |
| CVE-2026-69419 | 8.5 | Integer overflow or wraparound in Azure Data Manager for Energy allows an authorized attacker to execute code over a network.… | |
| CVE-2026-18844 | 8.1 | The firmware of the Pulsetto Vagus Nerve Stimulator accepts several undisclosed commands over its Bluetooth Low Energy (BLE) interface. These commands are sent without authentication or encryption, and are never issued b… | |
| CVE-2026-48486 | 7.5 | Signum Node is a HDD-mined cryptocurrency using an energy efficient and fair Proof-of-Commitment (PoC+) consensus algorithm. Prior to version 3.9.9, an integer overflow in BlockServiceImpl.applyBlock() allowed a miner to… | |
| CVE-2025-10456 | 7.1 | A vulnerability was identified in the handling of Bluetooth Low Energy (BLE) fixed channels (such as SMP or ATT). Specifically, an attacker could exploit a flaw that causes the BLE target (i.e., the device under attack) … | |
| CVE-2025-58262 | 7.1 | Cross-Site Request Forgery (CSRF) vulnerability in WPDirectoryKit Sweet Energy Efficiency sweet-energy-efficiency allows Stored XSS.This issue affects Sweet Energy Efficiency: from n/a through <= 1.0.8.… | |
| CVE-2025-65828 | 6.5 | An unauthenticated attacker within proximity of the Meatmeet device can issue several commands over Bluetooth Low Energy (BLE) to these devices which would result in a Denial of Service. These commands include: shutdown,… |
Ransomware victims
Named leak-site victims classified into this sector (ransomware.live taxonomy: Energy & Utilities / Energy), latest 15 shown.
| Victim | Crew | Discovered |
|---|---|---|
| Pengurusan Aset Air Berhad | qilin | 2026-10-18 |
| Luzco Ilumination | emperador | 2026-10-18 |
| ECO USA | N0n | 2026-10-18 |
| ONEOK, Inc. | Redact | 2026-10-16 |
| Petroleum Telcom Communications | thegentlemen | 2026-10-16 |
| Hocon Gas | qilin | 2026-10-15 |
| Colorado Texas | nightspire | 2026-10-14 |
| IGPL | HYFLOCK | 2026-10-13 |
| Comisión Municipal de Agua Potable y Alcantarillado de Victoria | qilin | 2026-10-13 |
| Greentech Environmental | interlock | 2026-10-12 |
| Prodiel | qilin | 2026-10-12 |
| Eversource Energy | Redact | 2026-10-12 |
| Confipetrol | qilin | 2026-10-11 |
| CALICHE | Majinahanashi | 2026-10-10 |
| Supreme Energy | Panzer | 2026-10-09 |
Most active crews · since 2026-06
watch this sector
Get a daily email when something new touches energy — or your own vendors, products and suppliers. Deterministic graph matches, one email a day, one-click unsubscribe.