Electric Grid Cybersecurity: 2026 Threat Insights for OT Defenders
Summary: Dragos's 2026 OT/ICS Year in Review reports that ELECTRUM, the group behind the 2015 and 2016 Ukrainian power outages, expanded its targeting to Polish energy infrastructure in late December 2025 in what Dragos calls the first major coordinated attack against Distributed Energy Resources anywhere in the world. The report also describes KAMACITE scanning internet-exposed HMIs, variable frequency drives, meters, and cellular gateways across the United States for four months, and SYLVANITE observed inside a U.S. electric utility network in a confirmed incident response.
Key Takeaway: Dragos measured a median of just 24 days between vulnerability disclosure and public exploit availability in 2025, with some windows nonexistent, while roughly 4 percent of ICS vulnerabilities were already being exploited at disclosure. For electric operators whose patching is constrained by operational requirements, that leaves little room to treat exposure as something to schedule into the next maintenance cycle.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026