Cybersecurity for renewable energy: Best practices to protect critical infrastructure

Developments around renewable energy are moving fast. How can the sector ensure that cybersecurity keeps up in face of destructive attacks?

he world is going electric. Transportation, heating & cooling, and energy distribution are increasingly being supplied via fossil-fuel-free methods. Regulations are being introduced in parallel, with mandates in some regions seeking a reduction of emissions by as much as 55% by 2030. 

Across the world, businesses of all sizes are driving innovation that is powering the transition to clean energy, from solar start-ups to community and large-scale wind developers, and on to Smart Grid innovators. But, in the race to scale, many of these firms are leaving themselves and their inventions dangerously exposed — which APTs like Sandworm are banking on to facilitate their destructive cyber-attacks.

Key points of this article:

• Proprietary malware designed to cripple specific operational components and instances of existing attacks against the renewables sector paint a bleak security picture.

  
  

• Start-ups and SMBs are leading innovation in clean energy, but often lack robust cybersecurity measures, and frequently hesitate to adopt cybersecurity tools, despite growing threats to overlapping IT/OT systems.

  
  

• Inherent complexities of renewable infrastructure (specifically related to IT), where operators must often oversee scattered and remote generating and power transfer facilities, get more complicated by third-party suppliers and customer relationships.

  
  

• Accounting for security requires a secure-by-design approach focused on prevention, deliberately placing cybersecurity as a major pillar of innovation alongside novel energy tech.

Dynamic threats and shocking vulnerabilities

For years, cybersecurity concerns in the energy sector have revolved around large utilities and have primarily focused on operational technology (OT) risks. That’s understandable: A breach at the grid level causes chaos, as witnessed via several documented malware attacks designed to disrupt electrical grids, as was the case in Ukraine in 2015 (Black Energy), followed by Industroyer (deployed iteratively over a span of six years). These were specifically written to infect the industrial control systems involved. Similar examples include Triton, designed to attack safety instrumented systems, or Stuxnet, targeting SCADA systems.

However, who’s to say that it’s strictly the big boys being targeted? By volume it’s mainly start-ups and SMBs leading the charge in creating novel energy solutions, and investing in establishing modern supply chains fit for a cleaner remainder of the 21st century. A cleaner energy system doesn’t necessarily mean a more secure one, though.

How vulnerable are renewable systems, really?

It’s understandable why older Industrial Control System protocols such as the ones abused by Industroyer are vulnerable, but, as the renewable sector’s moving fast, there’s a chance to implement secure-by-design principles right before it fully blasts off; there’s really no reason now to tolerate security gaps.

And yet, in Spain, the April 2025 power outage prompted national authorities to perform a security audit at dozens of small renewable power plants, noting that many may have lacked adequate cybersecurity protection. In Spain, which is at the forefront of renewable energy, there are as many as 4,000 one megawatt (MW) capacity (or greater) installations — according to grid operator Red Electrica. If power grids become increasingly dependent on renewables, as they have in Spain, leaving them vulnerable would be grossly irresponsible.

Case in point: wind farms and satellites

So, just how vulnerable are these systems, then? Ukraine provides another example. The onset of Russia’s armed invasion in 2022 marched in tandem with cyberattacks targeting global satellite systems — causing a widespread outage of wind turbines in Central Europe. As many as 5,800 turbines were affected as a result of having their remote monitoring and controls disrupted via lost satellite connections.

Research by the Centre for Emerging Technology and Security estimates that, due to a lack of cybersecurity focus/skills, and a mix of technical complexities related to the remote nature of cyber-physical infrastructure, offshore wind farms, especially their control centers, are particularly vulnerable. 

Despite being physically remote, these farms require digital communication between the turbines and onshore facilities, which can expose various vulnerabilities — be they direct ones in the software or IT/OT tech used (like ICS switches, database and SCADA servers), or indirect ones, such as those stemming from the supply chain — like satellites providing crucial digital connectivity. The result is a highly potent mix, which is difficult to secure, even for enterprise-sized operations.

The Polish energy attack of 2025

Putting our theory of vulnerable critical infrastructure to the test was a recent case where Poland avoided a large-scale power outage by deflecting a major attack against its energy infrastructure.

In what was described by the government as the “most serious attack in years,” the reported disruption occurred in late December 2025, when hackers (likely from Russia, more below) hacked communications between renewable energy installations (solar farms, wind turbines, and power distributors) across the country. 

ESET Research: Sandworm was the culprit

As part of the ongoing investigations into the attack, ESET Research has found that the attack was the work of the notorious Russia-aligned Sandworm APT group. The attackers deployed a wiper, which ESET analyzed and named DynoWiper, with ESET security solutions detecting DynoWiper as Win32/KillFiles.NMO.

While continue to be investigated, ESET researchers have highlighted the fact that the coordinated attack occurred on the 10th anniversary of the Sandworm-orchestrated attack against the Ukrainian power grid, resulting in the first ever malware-facilitated blackout. Back in 2015, Sandworm used the BlackEnergy malware to gain access to critical systems at several electrical substations, leaving around 230,000 people without electricity for several hours.

The republic came close to a blackout, according to the Polish Digital Affairs Minister. Worryingly, the perpetrators targeted smaller power providers instead of larger networks, emphasizing how it’s not only the large state-backed enterprises, but also nascent innovators who could become victims.

IT’s not about energy

While cyber threats to both renewable technology companies and 1MW-plus installations (including solar PV, solar thermal and wind farms) may vector from rapid digital innovation and both heavily interconnected IT/OT infrastructure and  decentralized power generation, these threats remain largely emergent.

However, businesses in the renewable energy sector can’t afford to ignore the complexities of managing new tech, power generation, or associated grids, including their associated unique cyber threats. These innovators should also be wary of being distracted from the need to have a strong cybersecurity posture focused on their standard IT business systems.

And here lies the paradox: While many firms, especially SMBs in the renewable sector, focus on innovation when rushing to meet local or regional net-zero targets, most hesitate to adopt scaled modern cybersecurity tools and apply them to core business processes. Some fear costs; others worry about complicating their existing operations. But the risk of inaction is far greater. 

Repercussions from inaction could include phishing scams that trick employees into handing over credentials, malware that spreads silently, ransomware attacks that bring projects to a halt, or even the possibility that cyber attackers could infect the supply chain of products and services a company provides to its customers. 

Even simple misconfigurations or accidental data leaks can trigger outsized consequences when investors, partners, and regulators are watching closely, expecting clean energy firms to demonstrate not just sustainability, but also excellent cybersecurity postures. 

Renewing cybersecurity

There are multiple steps CISOs can take to secure their operations. While we can’t list all of them, we can, at least, provide a preventive approach to landing continued resilience by:

First, implementing all the basic standards, frameworks, and regulations that the industry requires. In the EU, these would be NIS2 as a baseline, then, perhaps, Electricity Regulation (EU/2019/943) for the electricity sector, which lays down sector-specific rules for cybersecurity, including crisis management. There’s also the Regulation on Risk Preparedness (EU/2019/941), which requires malicious attacks to be considered as part of basic electricity crisis scenarios. 

For US-based businesses, the Department of Energy’s Cybersecurity Strategy outlines various steps for securing the sector, with more specific initiatives like Securing Solar for the Grid (S2G) or DER Cybersecurity Harmonization, which aligns standards across solar, wind, and battery systems. For OT, there’s also ISA/IEC 62443, adopted for ICS in the energy sector. Above all, try to discontinue or replace legacy protocols — they’re not fit for the modern threat landscape.

Second, carefully auditing the supply chain periodically, as vulnerabilities can often stem from third parties. By building a risk profile and inventory of all contracted providers, it’s easier to monitor for potential future incidents. Sure, while you can’t reboot those satellites, knowing that there’s a possibility of their failure, you can implement fallback systems in case you need them

Third — and it’s simple as this — hiring or training cyber professionals. Due to the complex nature of renewable infrastructure (and sparseness of facilities) and the growing need of continuity, ensuring top-shelf security via trained eyes should lower the likelihood of invisible digital attacks considerably. Early detection is about knowledge, visibility, and quick decision-making, all of which can be provided by expert security analysts on the lookout for threats daily. If that’s impossible in-house (due to budgetary considerations, perhaps), opt for a managed service in the form of an MSSP or MDR.

Fourth — and this closely follows the previous point — testing the resilience of your infrastructure. Penetration testing should reveal any hidden security holes in your environments, while red/blue teaming various attack scenarios could support the overall preparedness and risk mitigation strategy. If in doubt, concerning your operation’s ability to do this, there are also various cyber advisory services giving strategic advisory and risk assessments to make this part easier.

Fifth, securing operational technology (OT) environments. This includes segmenting networks between IT and OT, hardening SCADA systems with access controls and deeper monitoring plus patching, and applying IEC 62443 standards to industrial control components.

There’s also something to be said for proprietary corporate solutions that are designed with specific environments in mind. ESET Corporate Solutions are here to help assess and devise security tailored to one’s scope, size, and assets in need of protection, even for complex critical renewable energy infrastructure

Closing the circuit

Whether you’re an SMB supplying solar farms with collectors or an enterprise managing offshore wind farms, the risks are real, and the stakes are rising.

An incident can begin with as little as a short email. Or, perhaps, by having your monitoring systems knocked offline by a satellite outage. All in all, the renewable sector must embrace a prevention-first mindset. That means securing both the business layer and the operational core, which includes the control centers, corporate networks, and various integrations, with external partners and customer systems.

By adopting secure-by-design principles, auditing their supply chains, investing in cyber talent, and testing infrastructure regularly, renewable energy firms can innovate beyond their strategic intents — creating best practices and serving as role models for what it means, not just to be a renewable energy provider, but also a secure energy provider.

Find out how ESET Threat Intelligence can help make better security decisions in the energy industry by reading our factsheet linked below.