Bears in the Lines: Russian Critical Infrastructure Espionage in the Face of US Grid Resilience
summary
Claim: a Russian-nexus espionage group TEMP.Isotope (Dragonfly 2.0, Berserk Bear) has been probing U.S. electricity since ~2015 using spearphishing and watering holes, living‑off‑the‑land tooling and one bespoke backdoor to harvest ICS data from corporate networks and compromised contractors. NERC CIP significantly hardens the bulk electric system (generation + transmission), while an uneven landscape of ~2,500 distribution entities remains softer. Cites Sandworm’s 2015 Ukraine outage (230,000 customers) and the 2003 blackout (50 million) as context; disruptive Russian attacks are judged unlikely due to political risk.
AI-written summary · about
chapters (6)
- 0:00Start
- 0:11Disclaimer
- 4:15The Electrical Grid
- 5:32Bulk Electric System
- 7:37The Day Everything Changed
- 14:42Counterintelligence
related talks
47mBear Necessities: Ukraine's Experience Facing APTs, Building Resilience
39mThe Renaissance of Cyber Physical Offensive Capabilities
40mStrengthening Cyber Resiliency in a Time of Geopolitical Crises...
40mCyber’s Past, Present, and Future: The Truth is Stranger than Fiction
45mHiding in Plain Sight: Hunting Volt Typhoon Cyber Actors
29mCritical Infrastructure Network Attacks: Code Red, Alert Network Operators
25mGlobal Threat Brief: Hacks and Adversaries Unveiled
51mState of the Hack 2023