Attacking the power grid with AI: what changed is not the way in, but who can afford the trip

In April 2025, a pro-Russian hacking group took control of the discharge valve at Norway's Lake Risevatnet dam and held it open for four hours. They installed no malware and left no backdoor on any PLC. Post-incident analysis found the way in was a weak password on an internet-facing admin interface. Discharge rose by roughly 500 litres per second — fortunately still around the dam's mandated minimum flow, so no damage followed.

Five months later, in September 2025, Anthropic detected and disclosed the GTG-1002 campaign — the first reported AI-orchestrated cyber-espionage operation. A group assessed as state-sponsored used an agentic framework to run reconnaissance, exploit vulnerabilities, move laterally and exfiltrate data across roughly 30 organisations. Anthropic estimates AI handled 80–90% of the hands-on intrusion work, with humans selecting targets and reviewing output. The campaign is now catalogued in MITRE ATT&CK.

At first glance the two events contradict each other: one is the frontier of attack automation, the other is a weak password. Placed side by side, they describe rather precisely what is happening to physical infrastructure — and it is not what most writing on this subject claims.

This article is threat analysis and defensive guidance for operators of industrial systems. It does not describe attack techniques against live systems, and deliberately stops at the architectural level.

What AI actually changed: not the capability ceiling, but the cost floor

The common question is "does AI let attackers do something they could not do before?". Framed that way the answer is mostly no — which is exactly why the framing hides the real problem.

What has protected most mid-sized operators for years was not their security architecture. It was the scarcity of skilled attacker time. An Industroyer-class campaign takes a highly specialised team working for months, and the number of such teams in the world is finite. They spend that capacity on the largest targets.

Put differently, "we are too small to be targeted" was never a control. It is a statement about the adversary's budget. And that is precisely the constraint AI relaxes. According to the Global Threat Report 2026, cited in this review of the year's attacks, adversary operations involving AI rose 89% year over year.

The part of the attack chain AI handles best is also the part that used to require a genuine ICS specialist: reading equipment documentation, recognising an industrial protocol from a handful of packets, writing scripts to speak to it. The distance between "scanned and found an exposed HMI" and "understanding what device this is and which commands matter" used to be years of domain knowledge. That gap is narrowing.

What AI has not changed: physics and domain engineering

This half matters just as much, and tends to get dropped from writing pitched at alarm.

GovAI's study assessing the risk of AI-enabled cyberattacks on the power grid argues that for AI to meaningfully raise the risk of a catastrophic attack — they use a $100 billion damage threshold — it would have to lower the barriers facing unsophisticated actors, meaning it would need to automate most of the work of a large team holding very different skills. Their conclusion is that this risk remains relatively small today.

The reason is that the hardest part of a wide-area blackout attack is not intrusion. It is power systems engineering: knowing which substations matter, how protective relays are configured, how the system reconfigures itself after part of it is cut, and what it takes to keep restoration from happening within minutes. Industroyer2 was tailored to the specific configuration of a specific substation — that is an electrical engineer's work, not a malware author's.

But this conclusion is very easy to read in a self-serving way. "Not yet catastrophic" does not mean "not a concern". The $100 billion threshold belongs to a study of national-scale risk. For an individual operator, losing control of a plant for four hours is already a serious incident — and that is exactly the magnitude the real recent incidents fall into.

Nine malware families in fifteen years, and one repeated lesson

Researchers currently count nine malware families built specifically for industrial control systems: Stuxnet, Havex, BlackEnergy2, CrashOverride (Industroyer), Trisis, Industroyer2, PipeDream, Fuxnet and FrostyGoop. Nine families in fifteen years is a very small number next to the IT malware landscape — which by itself says something about the domain barrier described above.

FrostyGoop is notable for a different reason. In January 2024 it was used against a municipal district energy company in Lviv, Ukraine, leaving residents of 600 apartment buildings without heating in midwinter. The technically interesting detail is that it exploited nothing. It simply spoke Modbus TCP — a standard, natively supported industrial protocol.

This is a foundational property of nearly every ICS protocol: they were designed for closed networks, at a time when "closed" was still a reasonable assumption, and so most of them carry no authentication. You do not exploit them. You just have to speak them correctly.

The defensive consequence is direct and uncomfortable: in OT, being on the network is close to equivalent to having control. That moves the centre of gravity of defence toward network boundaries and identity — and away from malware detection, where most security budget tends to go.

Why this is an architecture problem, not a procurement problem

The air gap assumption — a control zone fully separated from the office network — has stopped being true at most facilities. It erodes gradually through things that were each reasonable at the time: a feed so production figures reach the ERP, a remote support channel for an equipment vendor, a dashboard so management can check output from a phone.

The OT control with the best effectiveness-to-cost ratio is still network segmentation. IEC 62443 models this as zones and conduits: group assets with homogeneous security requirements into a zone, and force every connection between zones through a defined, controlled and monitored conduit.

At the most important boundary there is an architectural option worth more consideration than a firewall: the unidirectional gateway, or data diode. This is hardware that permits data to flow in one direction only — typically out of the control zone — enforced physically by having a transmitter on one side and only a receiver on the other. There is no return path, so there is no inbound attack. Both NERC CIP-005 and IEC 62443-3-3 SR 5.1 recognise data diodes as a control for the highest security levels.

The underlying principle scales down to far smaller systems: telemetry flows out, commands do not flow in. If a dashboard needs data from the control zone, the connection must be initiated from inside and pushed outward — never called inward from outside. It is the same principle we apply when designing the ingestion layer for an industrial sensor monitoring system.

The fastest-growing front: hundreds of thousands of small devices

While most attention goes to large substations, the real front is shifting. A 2025 survey summarised here found roughly 35,000 internet-exposed solar devices from 42 vendors; follow-up analysis recorded 93 vulnerabilities across 17 manufacturers, about a third of them severe enough to permit full system takeover.

The problem is not only the vulnerability count but the governance gap. National-level security oversight concentrates on the transmission grid — few assets, each of them critical, already under strict regulation. Inverters and remote monitoring systems sit on the distribution side, belong to thousands of separate owners, and face far looser obligations. For a power system rapidly increasing its share of distributed generation, as Vietnam is, this is the fastest-expanding and least-inventoried part of the attack surface.

The Vietnamese context

To date Vietnam has recorded no case of attackers paralysing grid control systems in the way seen abroad, though there have been incidents. According to this overview of cybersecurity in the energy sector, EVN has invested in control system security and worked with international specialists to assess vulnerabilities, train staff and monitor for attacks against SCADA/DCS.

On the regulatory side, control systems in power plants fall under Decree 85/2016/NĐ-CP on information system security by classification level, detailed further in Circular 12/2022/TT-BTTTT. Systems proposed at level 4 or level 5 must submit their classification dossier for expert review by the information security unit of the system's governing body.

One thing is worth saying plainly: compliance level is not the same as resilience. The Norwegian dam was in all likelihood still "compliant" on paper on the day its valve control was taken. A classification dossier describes the system as it was when the dossier was written; the attacker meets the system as it is now — after many rounds of added connections, added contractors and added devices, no one of which was large enough to trigger a dossier update.

Four questions worth answering before buying anything else

• How many paths lead into the control zone, and who holds them? Count them all: contractor VPNs, maintenance engineers' laptops, 4G modems a vendor installed for remote support, HMIs on public IPs. Build this list from running network configuration, because most risky paths were added after the design diagram was finished.
• Which secrets can reach field equipment, and where do they live? Passwords embedded in handover documentation, API keys in a repository, shared shift accounts. Lake Risevatnet fell to exactly one of these.
• What still holds once the attacker is inside? This question separates *safety* from *security*. The last protective layer in OT should be physical and deterministic — protective relays, mechanical safety valves, hard limits — things that are not networked and do not depend on whether you detected the intruder. If every protective layer is reconfigurable over the network, there is no last layer.
• How does operation continue when the control signal is lost? The right exercise is not "detect an attack" but "lose SCADA entirely for eight hours". The first depends on what the adversary chooses to do; the second sits entirely within your control.

Conclusion

AI has not created a new way to break a power grid. Physics and power systems engineering remain real barriers, and the most serious assessment available still places catastrophic-level risk as relatively small. Anyone selling you a product built on the opposite fear is selling the wrong thing.

What AI has taken away is something else, discussed less often and much harder to replace: scarcity. For years, most operators were protected not by their architecture but by the fact that sufficiently skilled attackers were busy elsewhere. That was borrowed protection, and it is wearing thin.

The good news is that the list of things to do has not changed and holds no surprises: know how many ways in you have, know where your secrets live, keep one safety layer off the network, and rehearse for loss of control. None of it requires AI to solve. It only requires being done before it is needed.

If you operate connected industrial systems and want to review the boundary between your control zone and everything else, see KonexForge's IoT & Sensors capability or get in touch to discuss a specific system.