Enhancing cyber resilience of high-renewable power systems: Threat pathways and targeted countermeasures
-
GRAPHICAL ABSTRACT
DownLoad:
Full size image
-
PUBLIC SUMMARY
-
High penetration of Renewable Generation Units (RGUs) with Internet of Things (IoT) expands power grid cyberthreats, requiring targeted defense research on attack impact mechanisms.
The MRGIoT (Manipulation of Renewable Generation via IoT botnet) framework is proposed to assess grid-disruption risks of RGUs by manipulating active power using grid topology and load density data.
Simulations on Texas grid and New Zealand North Island power system (NIPS) prove high-degree, high-load-area RGUs cause severe power loss in peak hours, while small-capacity RGUs (≤20 MW in Texas, ≤4 MW in NIPS) have negligible system risks.
These findings provide clear and actionable guidance for strengthening the security and resilience of future net-zero power systems, supporting security planning for high-renewable zero-carbon grids.
-
-
ABSTRACT
High integration of Renewable Generation Units (RGUs), such as photovoltaic panels and wind turbines, is transforming modern power systems while also creating new cyber-attack surfaces due to the widespread adoption of Internet of Things (IoT) technologies. Understanding this emerging threat and its underlying impact mechanisms is essential for developing effective cyber-defense methods. This study presents MRGIoT (Manipulation of Renewable Generation via IoT botnet), a framework designed to evaluate which RGUs are most significant to the supply-demand balance and potentially capable of causing grid disruption. The framework focuses on the manipulation of RGU active power and leverages publicly available topology and operational data to identify high-value targets based on node degree and regional load density. Extensive simulations on the Texas grid model and the North Island power system (NIPS) of New Zealand show that RGUs located at high-degree nodes or in regions with high load density can trigger notable demand loss, especially during peak-load periods. These areas therefore represent priority targets for security reinforcement, infrastructure concealment, and operational safeguards. In contrast, RGUs with active power generation below certain thresholds, specifically 20 MW on the Texas model and 4 MW on the NIPS, exhibit limited system-scale impact even when placed at highly vulnerable grid locations. As renewable penetration rises and IoT adoption deepens, these findings provide clear and actionable guidance for strengthening the security and resilience of future net-zero power systems. -
-
REFERENCES
[1] Ritchie H., Roser M. and Rosado P. (2024). Renewable Energy. Our World in Data. https://ourworldindata.org/renewable-energy [2] Nijsse F. J. M. M., Mercure J.-F., Ameli N., et al. (2023). The momentum of the solar energy transition. Nat. Commun. 14:6542. DOI:10.1038/s41467-023-41971-7 [3] SEIA. (2025). Solar energy industries association. SEIA. URL https://seia.org/ [4] Slakaityte V., Surwillo I. and Berling T. V. (2023). A new cooperation agenda for european energy security. Nat. Energy 8:1051−1053. DOI:10.1038/s41560-023-01322-8 [5] Harnden T. (2002). Al-Qa’eda plans cyber attacks on dams. Telegraph. https://www.telegraph.co.uk/news/worldnews/asia/afghanistan/1398683/Al-Qaeda-plans-cyber-attacks-on-dams.html [6] Poulsen K. (2003). Slammer worm crashed Ohio nuke plant net. The Register. https://www.theregister.com/2003/08/20/slammer_worm_crashed_ohio_nuke/ [7] Poulsen K. (2009). Report: Cyber attacks caused power outages in Brazil. Wired. https://www.wired.com/2009/11/brazil/ [8] Meserve J. (2007). Staged cyber attack reveals vulnerability in power grid. CNN. https://edition.cnn.com/2007/US/09/26/power.at.risk/index.html [9] Kushner D. (2013). The real story of Stuxnet. IEEE Spectrum. https://spectrum.ieee.org/the-real-story-of-stuxnet [10] BBC. (2011). Iran says it has controlled Duqu malware attack. BBC. https://www.bbc.com/news/technology-15721839 [11] BBC. (2012). Shamoon virus targets energy sector infrastructure. BBC. https://www.bbc.com/news/technology-19293797 [12] CISA. (2021). Chinese gas pipeline intrusion campaign. CISA. https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-201a [13] Goodin D. (2014). Attackers poison legitimate apps to infect industrial systems. Ars Technica. https://arstechnica.com/information-technology/2014/06/active-malware-operation-let-attackers-sabotage-us-energy-industry/ [14] Khandelwal S. (2014). Dragonfly hackers target energy firms. The Hacker News. https://thehackernews.com/2014/07/dragonfly-russian-hackers-scada-havex.html [15] Khandelwal S. (2014). South Korean nuclear plant hacked. The Hacker News. https://thehackernews.com/2014/12/Korea-nuclear-power-plant-hacked.html [16] Wikipedia. (2025). 2015 Ukraine power grid hack. Wikipedia. https://en.wikipedia.org/wiki/2015_Ukraine_power_grid_hack [17] Wikipedia. (2025). 2016 Kyiv cyberattack. Wikipedia. https://en.wikipedia.org/wiki/2016_Kyiv_cyberattack [18] Greenberg A. (2017). Hackers found they could attack wind farms. Wired. https://www.wired.com/story/wind-turbine-hack/ [19] Nakashima E. (2017). US officials say Russian hackers penetrated energy networks. Washington Post. https://www.washingtonpost.com/world/national-security/us-officials-say-russian-government-hackers-have-penetrated-energy-and-nuclear-company-business-networks/2017/07/08/bbfde9a2-638a-11e7-8adc-fea80e32bf47_story.html [20] Boren Z. (2018). Dragonfly UK energy hack. Unearthed. https://unearthed.greenpeace.org/2018/06/11/dragonfly-uk-energy-hacker-cybersecurity/ [21] Geman B. (2018). Russia cyber war targeted grid. Axios. https://www.axios.com/2018/03/16/us-says-russias-cyber-war-targeted-the-grid-1521201831 [22] Addison R. (2018). UK power grid cyber attack. Industrial Cyber. https://industrialcyber.co/threats-attacks/u-k-power-grid-hit-by-cyber-attack/. [23] National Cyber Security Centre. (2018). UK exposes Russian cyber attacks. UK Gov. https://www.gov.uk/government/news/uk-exposes-russian-cyber-attacks [24] Jones T. (2018). Hackers obtain nuclear plant plans. DW. https://www.dw.com/en/hackers-obtain-nuclear-power-plants-in-france/a-46126878 [25] Austin P. (2021). Norsk Hydro ransomware attack. Time. https://time.com/6080293/norsk-hydro-ransomware-attack/ [26] Asokan A. (2019). US energy utilities targeted by malware. GovInfoSecurity. https://www.govinfosecurity.com/us-energy-utilities-targeted-by-flowcloud-malware-a-14405 [27] Paganini P. (2019). sPower cyber attack. Security Affairs. https://securityaffairs.com/93271/hacking/spower-cyber-attack.html [28] Monkey Cage. (2019). Indian nuclear plant cyberattack. Washington Post. https://www.washingtonpost.com/politics/2019/11/04/an-indian-nuclear-power-plant-suffered-cyberattack-heres-what-you-need-know/ [29] Owens C. (2019). Johannesburg electricity cyberattack. Blackout Report. https://www.theblackoutreport.co.uk/2019/07/29/johannesburg-ransomware-attack-july-2019/ [30] Blaze Labs. (2020). Ragnar Locker case study. Blaze Infosec. https://www.blazeinfosec.com/post/dissecting-ragnar-locker-edp/ [31] Paganini P. (2020). Sodinokibi ransomware attack. Security Affairs. https://securityaffairs.com/105477/cyber-crime/sodinokibi-ransomware-light-s-a.html [32] Nakashima E. and Timberg C. (2020). Russian hackers breach US agencies. Washington Post. https://www.washingtonpost.com/national-security/russian-government-spies-are-behind-a-broad-hacking-campaign-that-has-breached-us-agencies-and-a-top-cyber-firm/2020/12/13/d5a53b88-3d7d-11eb-9453-fc36ba051781_story.html [33] Greenberg A. (2021). Russia GRU hackers targeted US grid. Wired. https://www.wired.com/story/russia-gru-hackers-us-grid/ [34] Riis A. (2021). Cyber incident report. Vestas. https://www.vestas.com/en/media/company-news/2021/third-update-on-cyber-incident-c3466518 [35] CS Energy. (2021). Cyber security incident response. CS Energy. https://www.csenergy.com.au/news/cs-energy-responds-to-cyber-security-incident [36] Fuentes M. (2021). Fire and cyberattack cause blackout. Wise Plant. https://wiseplant.com/a-fire-and-cyberattack-cause-major-blackouts-across-puerto-rico-2/ [37] Morhan S. (2024). Meter tampering surge. The Sun. https://thesun.my/malaysia-news/tnb-s-collaboration-with-authorities-has-led-to-a-surge-in-detected-meter-tampering-cases-PE12437945 [38] Wikipedia. (2022). Viasat hack. Wikipedia. https://en.wikipedia.org/wiki/Viasat_hack [39] Paganini P. (2022). Nordex cyber attack. Security Affairs. https://securityaffairs.com/129875/security/a-cyber-attack-forced-the-wind-turbine-manufacturer-nordex-group-to-shut-down-some-of-it-systems.html [40] Engdahl T. (2022). Ukraine power grid cyber attack. Epanorama. https://www.epanorama.net/blog/2022/04/13/cyber-attack-against-electrical-power-grid-in-ukraine/ [41] Rojoef M. (2023). Russian hackers behind Ukrainian power outage. Defense Post. https://thedefensepost.com/2023/11/10/ukraine-2022-power-outage-russia/ [42] Townsend K. (2022). Chinese hackers target energy firms in South China Sea. SecurityWeek. https://www.securityweek.com/chinese-hackers-target-energy-firms-south-china-sea/ [43] CBC. (2023). Cyberattack hits Nunavut energy company. CBC News. https://www.cbc.ca/news/canada/north/qulliq-energy-corporation-cyberattack-1.6720056 [44] Joncas H., Ferah M. and Marquis M. (2023). Hydro-Québec website cyberattack. La Presse. https://www.lapresse.ca/actualites/2023-04-13/cyberattaque/le-site-web-d-hydro-quebec-paralyse.php [45] Greenberg A. (2023). China-linked hackers breached power grid again. Wired. https://www.wired.com/story/china-redfly-power-grid-cyberattack-asia/ [46] Antoniuk D. (2024). Russian citizen faces trial for power grid hack. The Record. https://therecord.media/russian-alleged-hack-power-grid [47] Toulas B. (2023). Slovenia power provider hit by ransomware. BleepingComputer. https://www.bleepingcomputer.com/news/security/slovenias-largest-power-provider-hse-hit-by-ransomware-attack/ [48] Antoniuk D. (2023). Danish energy firms hacked via firewall bug. The Record. https://therecord.media/danish-energy-companies-hacked-firewall-bug [49] The Judean Staff. (2023). Red Evil cyber attack on Iran. The Judean. https://thejudean.com/index.php/news/science-technology/1971-pro-israel-hacker-group-red-evil-strikes-iran-with-second-cyber-attack [50] nquiringminds. (2024). Iranian cyber group develops IOControl malware. Cyber News. https://nquiringminds.com/cybernews/headline-iranian-cyber-group-develops-iocontrol-malware-targeting-critical-infrastructure/ [51] CONTEC. (2024). Cyber attack on solar monitoring systems. CONTEC. https://www.contec.com/jp/info/2024/2024050700/ [52] Maundrill B. (2024). Russian hackers target Ukrainian servicemen. Cyber Report. https://shturl.cc/C5c3Y0xVpUqNBAe4ezDF5tfCnqezGbj6a1IUDyWmoKPcHsb67l9JkPb2a8zSpSZHUf. [53] Schneider Electric. (2024). Cybersecurity incident report. Schneider Electric Newsroom. https://www.se.com/ww/en/about-us/newsroom/news/press-releases/sustainability-business-division-of-schneider-electric-responds-to-cybersecurity-incident-65b8035eb11dced626091019 [54] Public Power. (2024). Cybersecurity wake-up call for utilities. Public Power. https://www.publicpower.org/periodical/article/cybersecurity-wake-call-lessons-attack-small-utility. [55] Jimada-Ojuolape B. and Teh J. (2020). Reliability impacts of cyber-physical power systems. Sustain. Cities Soc. 62:102384. DOI:10.1016/j.scs.2020.102384 [56] Antonakakis M., April T., Bailey M., et al. (2017). Understanding the Mirai botnet. USENIX Security Symposium 26:1093–1110. https://www.usenix.org/conference/usenixsecurity17/technical-sessions/presentation/antonakakis [57] Mohsenian-Rad A. H. and Leon-Garcia A. (2011). Load altering attacks in smart grids. IEEE Trans. Smart Grid 2:667−674. DOI:10.1109/TSG.2011.2160297 [58] Soltan S., Mittal P. and Poor H. V. (2018). BlackIoT botnet attacks on power grid. USENIX Security Symposium 27:15–32. https://www.usenix.org/conference/usenixsecurity18/presentation/soltan [59] Shekari T., Cardenas A. A. and Beyah R. (2022). MaDIoT 2.0: IoT botnet attacks. USENIX Security Symposium 31:3539–3556. https://www.usenix.org/conference/usenixsecurity22/presentation/shekari [60] Shekari T., Irvene C., Cardenas A. A., et al. (2021). MaMIoT energy market manipulation. ACM CCS 2021:1338−1356. DOI:10.1145/3460120.3484581 [61] Alexander O., Belisle M. and Steele J. (2020). MITRE ATT&CK for ICS. MITRE Report. https://attack.mitre.org/docs/ATTACK_for_ICS_Philosophy_March_2020.pdf [62] Google. (2025). Google Maps. Google. https://www.google.com/maps/ [63] Rosvall R., Scholtes I. and Lambiotte R. (2019). Higher-order network models. Nat. Phys. 15:313−320. DOI:10.1038/s41567-019-0459-y [64] Electricity Maps. (2025). Electricity grid visualization. Electricity Maps. https://app.electricitymaps.com/map [65] Wang Z., Scaglione A. and Thomas R. J. (2010). Power grid centrality measures. IEEE CDC 2010:5792−5797. DOI:10.1109/CDC.2010.5717964 [66] Rosas-Casals M., Valverde S. and Solé R. V. (2007). European power grid vulnerability. Int. J. Bifurc. Chaos 17:2465−2475. DOI:10.1142/S0218127407018531 [67] Wang Z., Scaglione A. and Thomas R. J. (2010). Grid robustness analysis. IEEE ICC Workshops 2010:1−5. DOI:10.1109/ICCW.2010.5503926 [68] Keliris A., Konstantinou C., Sazos M., et al. (2019). OSINT for energy cyberattacks. In Critical Infrastructure Security and Resilience (Springer), pp:261–281. DOI:10.1007/978-3-030-00024-0_14 [69] Singh A. K., Ibraheem, Khatoon S., et al. (2012). Load forecasting techniques review. IEEE ICPCES 2012:1−10. DOI:10.1109/ICPCES.2012.6508132 [70] Li X., Poor H. V. and Scaglione A. (2013). Power system topology identification. SmartGridComm 2013:91−96. DOI:10.1109/SmartGridComm.2013.6687939 [71] IEEE. (2023). IEEE P2030.5 smart energy profile. IEEE Std. https://ieeexplore.ieee.org/servlet/opac?punumber=10289673 [72] IEEE. (2012). DNP3 communication standard. IEEE Std 1815-2012. DOI:10.1109/IEEESTD.2012.6327578 [73] Colak A. M., Tawada Y., Inzunza R., et al. (2021). Modbus-TCP photovoltaic inverters. ICRERA 2021:111−115. DOI:10.1109/ICRERA52334.2021.9598491 [74] Ahn B. H., Kim T., Ahmad S., et al. (2024). Cyber-resilient smart inverters. IEEE Trans. Power Electron. 39:4657−4673. DOI:10.1109/TPEL.2023.3342842 [75] Daniel dos Santos F. L. S. (2025). Solar system vulnerabilities. BlackHat Asia. https://www.blackhat.com/asia-25/briefings/schedule/#a-closer-look-at-the-gaps-in-the-grid-new-vulnerabilities-and-exploits-affecting-solar-power-systems-43223 [76] Liu Y., Ning P. and Reiter M. K. (2011). False data injection attacks. ACM Trans. Inf. Syst. Secur. 14:1−33. DOI:10.1145/1952982.1952995 [77] Sun C.-C., Cardenas D. J. S., Hahn A., et al. (2021). Smart meter intrusion detection. IEEE Trans. Smart Grid 12:612−622. DOI:10.1109/TSG.2020.3010230 [78] ISA Global Cybersecurity Alliance. (2025). ISA/IEC 62443 standards. ISA GCA. URL https://isagca.org/isa-iec-62443-standards [79] Chen P., Desmet L. and Huygens C. (2014). Advanced persistent threats study. In CMS 2014 (Springer), pp:63–72. [80] Alshamrani A., Myneni S., Chowdhary A., et al. (2019). Survey on APTs. IEEE Commun. Surveys Tuts. 21:1851−1877. DOI:10.1109/COMST.2019.2891891 [81] Alshamrani A., Myneni S., Chowdhary A. and Huang D. (2019). A survey on advanced persistent threats. IEEE Commun. Surv. Tutor. 21:1851−1877. DOI:10.1109/COMST.2019.2891891 [82] Barua A. A. and Faruque M. A. A. (2020). Hall spoofing: A non-invasive DoS attack on grid-tied solar inverter. USENIX Security Symposium 29:1273–1290. https://www.usenix.org/conference/usenixsecurity20/presentation/barua [83] Wang Z., Pan K. and Xu W. (2025). Sensor attacks on grid-tied photovoltaic inverters. IEEE Trans. Ind. Inform. 21:820−829. DOI:10.1109/TII.2024.3463704 [84] Dan Z., Yang F., Pan K., et al. (2022). EMI attack on photovoltaic inverter control systems. IEEE EI2 2022:1076–1080. DOI:10.1109/EI256261.2022.10116254 [85] Yang F., Dan Z., Pan K., et al. (2025). Electromagnetic interference attacks on power inverters. NDSS Symposium 2025:24−28. DOI:10.14722/ndss.2025.23069 [86] Staggs J., Ferlemann D. and Shenoi S. (2017). Wind farm security and attack surfaces. Int. J. Crit. Infrastruct. Prot. 17:3−14. DOI:10.1016/j.ijcip.2017.03.001 [87] DIgSILENT PowerFactory Dev. Core Team. (2022). DIgSILENT PowerFactory. DIgSILENT. URL https://www.digsilent.de/en/ [88] ERCOT. (2025). Electric reliability council of Texas. ERCOT. URL https://www.ercot.com/ [89] Singh S. and Singh S. (2003). Simple random sampling. Adv. Samp. Theory :71–136. DOI:10.1007/978-94-007-0789-4_2 [90] Transpower New Zealand. (2026). Empowering our energy future. Transpower. https://www.transpower.co.nz/ [91] Liu M., Teng F., Zhang Z., et al. (2024). Enhancing cyber-resiliency of DER-based smart grid. IEEE Trans. Smart Grid 15:4998−5030. DOI:10.1109/TSG.2024.3373008 [92] Wang R., Ji H., Li P., et al. (2024). Multi-resource coordinated planning of distribution networks. Nat. Commun. 15:4576. DOI:10.1038/s41467-024-48862-5 [93] Spyrou E., Hobbs B. F., Bazilian M. D. and Chattopadhyay D. (2019). Power system planning in fragile states. Nat. Energy 4:300−310. DOI:10.1038/s41560-019-0346-x [94] Zappa W., Junginger M. and van den Broek M. (2019). 100% renewable European power system feasibility. Appl. Energy 233–234:1027–1050. DOI:10.1016/j.apenergy.2018.08.109 [95] Cao M., Guo J., Xiao H. and Wu L. (2022). Reliability analysis of non-repairable power systems. Reliab. Eng. Syst. Saf. 222:108443. DOI:10.1016/j.ress.2022.108443 [96] Wang R., Ji H., Li P., et al. (2024). Multiresource dynamic coordinated planning of flexible distribution network. Nat. Commun. 15:4576. DOI:10.1038/s41467-024-48862-5 [97] Xiao H. and Cao M. (2020). Reliability modeling and maintenance optimization. Energy 210:118470. DOI:10.1016/j.energy.2020.118470 [98] Hou J., Deng H. and Peng J. C.-H. (2024). Attack-induced equilibrium in HVDC systems. IEEE Trans. Smart Grid 15:5992−6004. DOI:10.1109/TSG.2024.3409704 [99] Jimada-Ojuolape B., Teh J. and Lai C.-M. (2025). PMU placement in cyber-physical grids. Electric Power Syst. Res. 241:111327. DOI:10.1016/j.epsr.2025.111327 [100] Jimada-Ojuolape B., Teh J. and Lai C.-M. (2024). Cybersecurity challenges in PMU systems. Electric Power Syst. Res. 233:110509. DOI:10.1016/j.epsr.2024.110509 [101] Jimada-Ojuolape B. and Teh J. (2022). Composite reliability of synchrophasor systems. IEEE Syst. J. 16:3927−3938. DOI:10.1109/JSYST.2021.3132657 [102] Lawal O. A. and Teh J. (2023). Reliability modeling of dynamic line rating. Sustain. Energy Grids Netw. 35:101140. DOI:10.1016/j.segan.2023.101140 [103] Su Y., Dai Z., Teh J., et al. (2026). Attack and defense in DRL-based grid reconfiguration. Expert Syst. Appl. 309:131209. DOI:10.1016/j.eswa.2026.131209 [104] Lawal O. A., Teh J., Alharbi B. and Lai C.-M. (2024). FDI attack mitigation in DLR systems. Sustain. Energy Grids Netw. 38:101347. DOI:10.1016/j.segan.2024.101347 [105] Chen D., Lü L., Shang M.-S., et al. (2012). Influential node identification in complex networks. Physica A 391:1777−1787. DOI:10.1016/j.physa.2011.09.017 [106] Delfino B., Massucco S., Morini A., et al. (2001). Under-frequency load shedding schemes. In IEEE Power Engineering Society Summer Meeting 2001:307−312. DOI:10.1109/PESS.2001.970031 [107] ICSEG. (2025). IEEE 39-bus system dataset. ICSEG. URL https://icseg.iti.illinois.edu/ieee-39-bus-system/ [108] Electricity Authority NZ. (2025). PowerFactory case files. EA NZ. URL https://www.emi.ea.govt.nz/Wholesale/Datasets/Transmission/PowerSystemAnalysis/PowerFactoryCaseFiles -
ABOUT THIS ARTICLE
Cite this article:
Liu Y., Liu M., Ma W., et al. (2026). Enhancing cyber resilience of high-renewable power systems: Threat pathways and targeted countermeasures. The Innovation Energy 3:100169. https://doi.org/10.59717/j.xinn-energy.2026.100169
Welcome!
To request copyright permission to republish or share portions of our works, please visit Copyright Clearance Center's (CCC) Marketplace website at marketplace.copyright.com.
Export File
Citation
Liu Y., Liu M., Ma W., et al. (2026). Enhancing cyber resilience of high-renewable power systems: Threat pathways and targeted countermeasures. The Innovation Energy 3:100169. https://doi.org/10.59717/j.xinn-energy.2026.100169
Format
Content
-
Figure 1.
Escalating cyber security posture of power systems dominated by RGUs
-
Figure 2.
Overview of the MRGIoT framework
-
Figure 3.
Sensitivity of attack impact (i.e., demand loss) to node degree, RGU output power, and attack time
-
Figure 4.
MRGIoT attack strategy design and corresponding impact analysis in the Texas power grid model
-
Figure 5.
Impact of attack timing on MRGIoT effectiveness with a comparative analysis of summer and winter 2027 in the New Zealand North Island power system
-
Figure 6.
Roadmap toward cyber-resilient power systems
