The energy sector plays a crucial role in national security by ensuring the delivery of essential infrastructure services and supporting transportation systems. Acknowledging the need to safeguard this vital industry, Trustwave SpiderLabs has published the highly detailed 2025 Trustwave Risk Radar Report: Energy and Utilities Sector.
The primary report is joined by two specialized supporting pieces of research focusing on these critical areas of concern:
The primary report analyzes the threats facing the energy and utilities sector. It identifies significant trends shaping the industry, including the rise of ransomware attacks, the convergence of operational technology (OT) and information technology (IT), and increasing regulatory pressures.
Some of the report's key findings include:
- 80% year-over-year increase in ransomware activity
- 47% of ransomware attacks were in the United States
- 19% of ransomware attacks were conducted by Hunters International in H2 2024
- 84% of attacks originated from phishing
- 96% of attackers relied on remote services to move laterally
- 67% of credential access techniques were brute force
Additionally, the report delves into the growing sophistication of threat actors, providing a detailed analysis of their tactics, techniques, and procedures (TTPs) organized by attack stage. This intelligence equips the energy and utilities organizations with actionable insights to enhance their ability to anticipate, detect, and mitigate potential attacks.
For this report, Trustwave SpiderLabs defined the energy and utilities sector to encompass the production, distribution, and storage of oil and gas, renewable energy, and nuclear energy, as well as the generation and delivery of electricity, gas, and water. This comprehensive approach reflects the energy and utility sector’s complexity and the interconnected nature of its diverse systems, each presenting distinct security challenges.
Drilling Down on Ransomware
Why the white and black hats focus on energy is simple. Respectively, it is important to have an uninterrupted energy supply to the people and the potential to make money through a criminal venture.
There is already evidence of what can transpire from a ransomware attack on a single entity. In the case of Colonial Pipeline, the result was the secession of oil deliveries, shut down pipelines, and panicky customers who lined up to buy gasoline even in unaffected areas.
While the report goes into greater detail, here are a few reasons why the energy and utilities sector is often targeted:
- It consists of prosperous organizations with considerable revenues, making them lucrative targets
- The interconnected nature of SCADA systems, including IoT devices and remote access points, provides multiple entry points for cyber attackers
- Recovery time is longer compared to other sectors
- Disruption has high operational costs
The Energy and Utilities Sector’s Unique Threat Landscape
The sector faces unique challenges that heighten its vulnerability to diverse threats, ranging from ransomware attacks targeting critical infrastructure to spear-phishing campaigns exploiting human weaknesses.
Some of the key vulnerabilities discussed include aging infrastructure, reliance on legacy systems, and the inherent complexity of OT environments. When combined with the sector's geopolitical significance and the potential for widespread societal disruption, these factors make energy and utilities a prime target for malicious actors.
The sector's increasing reliance on digital technologies, remote operations, and cloud-based systems has significantly expanded the attack surface, introducing new vulnerabilities that demand robust cybersecurity measures.
For example, the North American Electric Reliability Corporation (NERC) recently warned that US power grids are becoming more susceptible to cyberattacks, with the number of vulnerable points in electrical networks increasing by approximately 60 per day. This alarming trend emphasizes the critical need for energy providers to strengthen their cybersecurity defenses.
The Trustwave SpiderLabs report covers the immense geopolitical significance held by the energy and utilities sector. Disrupting or sabotaging energy systems can destabilize a country's economy, hinder military operations, and disrupt the functioning of key sectors like healthcare, transportation, and communications.
Download the Report
While the report focuses on the energy and utilities sector, we encourage those in other sectors to download the report as many of the findings are pertinent to a wider audience.
All three reports and their accompanying webinars can be found and downloaded from this page.
