Cybersecurity Policy Report, ‘Coordinated’ Attacks on Electric Grid Prompt Proposal for Stronger Cyber Defenses, (Sep 23, 2025)

By Tom Leithauser

Increasing cyber attacks on the electric grid have prompted the Federal Energy Regulatory Commission (FERC) to propose new mandates that would require large generators and distributors of electricity to do more to defend their “low impact” systems.

FERC’s existing critical infrastructure protection (CIP) reliability standards for operators of bulk electric systems (BES) apply mainly to higher-impact cyber systems, FERC explained in a notice of proposed rulemaking (NOPR) published in today’s Federal Register (90 FR 45685 (Sept. 23, 2025)).

“Individual low impact BES Cyber Systems have less of an impact on bulk electric system reliability than medium or high impact BES Cyber Systems and thus, have fewer CIP Reliability Standard requirements,” FERC noted.

“Nevertheless, low impact BES Cyber Systems may still introduce reliability risks of a higher impact when distributed low impact BES Cyber Systems are subjected to a coordinated cyber-attack,” it said.

FERC cited the need to address “evolving threats that could potentially compromise low impact BES Cyber Systems and serve as a launch point to compromise other external BES Cyber Systems, including high and medium impact BES Cyber Systems.”

“In 2023 and 2024, the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) reported that Volt Typhoon, an advanced persistent threat group linked to China, maintained unauthorized access to the operational technology network of a small public power utility,” it said.

“In the continental United States, Volt Typhoon has exploited weak security controls, existing remote administration tools, and VPN connections. These cyber-attackers leveraged the trust of less protected systems to move laterally and pivot, compromising externally connected, higher criticality targets,” it said.

“Although Volt Typhoon is a more recent example, cyber attackers have used malware in the past to cause power outages,” it added.

FERC proposed approving a recommendation from the North American Electric Reliability Corp. (NERC), an industry-led group that develops CIP standards, regarding ways to “(1) authenticate remote users, (2) protect the authentication information in transit, and (3) detect malicious communications to or between assets containing low impact BES Cyber Systems with external routable connectivity.”

“In light of the above discussion, we seek comment on the continuing evolution of threat of compromise to low impact BES Cyber Systems posed by Volt Typhoon and similar cyberattacks that initially impact low impact BES Cyber Systems and then move laterally and pivot to higher impact BES Cyber Systems to effectuate a broader campaign,” it said.

“We seek comment from NERC, electric industry stakeholders, and other interested persons regarding the potential risk of the cyber threat discussed above, as well as electric industry stakeholders’ activities to mitigate the described cyber threat,” it said.

Comments on the NOPR are due Nov. 24 in docket RM25-8-000.

MainStory: TopStory FederalLegislation DataSecurity