## 5 Cybersecurity in MGs
### Threats to Microgrid Cybersecurity
Cyberattacks on microgrid systems can be carried out through the use of malicious software such as BlackEnergy, Stuxnet Trojan horses, or WannaCry ransomware. In December 2015, a cyberattack targeted the electricity grid in Ivano-Frankivsk, Ukraine, resulting in a power outage and directly affecting 80,000 people. It was determined that this cyberattack was created using phishing emails and the BlackEnergy Trojan horse [236]. This attack method was observed to have the ability to delete certain types of data, damage hard disks, and control systems. _Insider Attacks_: This could involve a rogue employee, contractor, or supplier who has access to the microgrid's systems and deliberately causes harm [27]. Such an attack could be motivated by financial gain, personal animosity, or ideological beliefs. Insider attacks can be challenging to detect, as the attacker may already have authorized access to the system. _Phishing Attacks_: Phishing is another major threat to microgrid cybersecurity. Phishing is a type of social engineering attack that uses deceptive emails or other means to trick users into divulging sensitive information, such as passwords or other login credentials. Once attackers have this information, they can use it to gain unauthorized access to the microgrid system. To protect against phishing, microgrid operators should train employees to recognize and avoid phishing scams, and should implement multifactor authentication to prevent unauthorized access to critical systems [27]. _Ransomware Attacks_: Ransomware is a type of malware that prevents users from accessing their own data or computer systems until a ransom is paid to the attacker [237]. In recent years, ransomware has become a significant threat to the security of MGs. MGs are small-scale power grids that can operate independently or in conjunction with the main power grid. They typically use DERs such as solar panels and battery storage to generate and manage power. Ransomware attacks on MGs can cause significant disruptions to power supply and create safety hazards [238; 239], and they can take various forms, including locking access to control systems or preventing the delivery of electricity to customers. Attackers may also demand payment in cryptocurrency, making it difficult to track the flow of funds and apprehend the perpetrators. The consequences of a successful ransomware attack can be severe, with potential risks to human life and property. For example, an attacker could disrupt the supply of power to critical infrastructure, such as hospitals or emergency services, causing life-threatening situations. In addition, an attack on a microgrid could lead to a wider power outage affecting a larger population. _Advanced Persistent Threats_: Advanced persistent threats (APTs) are a significant concern in the context of MGs as these critical infrastructures are vulnerable to cyberattacks due to their interconnected nature and the increased use of digital technologies in microgrid management systems [112]. APTs are sophisticated and stealthy cyberattacks that are often orchestrated by state-sponsored actors, organized criminal groups, or hacker collectives [240]. Unlike traditional cyberattacks that are aimed at exploiting vulnerabilities in software or hardware systems, APTs are designed to remain undetected for extended periods to collect sensitive data, steal intellectual property, or disrupt critical infrastructure. In the context of MGs, APTs can be devastating as they can compromise the integrity of the system, disrupt operations, and cause physical damage to the infrastructure [241; 242]. For example, an APT targeting the control system of a microgrid can lead to unauthorized access, data theft, and even physical damage to the equipment. Moreover, an APT can also be used to launch a ransomware attack, where the attacker encrypts the critical data and demands a ransom payment in exchange for the decryption key. _SQL Injection Attacks_: These attacks can pose a significant threat to the cybersecurity of the system.