# Toward Secure Smart Grid Systems: Risks, Threats, Challenges, and Future Directions
## 5 Smart Grid Attacks
### Attack Source  
The attack source refers to the origin of the entity responsible for coordinating attacks on the infrastructure of the smart grid. This covers the origin of hostile activity, such as unauthorized access, directed against the smart grid system, data manipulation, and disruption of services [132]. The attack source can be an individual, a group, an organization, a nation state, or a malicious actor, as shown in Figure 5. Therefore, it is essential to identify, mitigate, and prevent cyber-physical attacks on smart grids. Common attack sources are as follows:  
**Terrorists and Inserteps:** Terrorist groups aim to target smart grid critical infrastructure through methods like suicide bombings (HBIED, VBIED, and motorbike VBIED) [133; 134; 135] and hit-and-run attacks [136] to destroy or damage civilian and military infrastructures [132]. **Malicious Agents:** Terrorist organizations use cyber asymmetric warfare, cyberattacks, terrorism [137], and industrial espionage to interfere with smart grids, topple governments, and weaken authority [138]. This causes power outages and other economic disruptions that have a big impact on the region [139]. By attacking or undermining infrastructure, they want to take control of smart grids and use the resulting publicity to draw in new members and media attention [140]. Disrupting smart grids can provide a military tactical advantage by allowing operations to occur in silence, causing confusion, and rerouting security troops to restore order. **Criminal Groups:** Cybercriminals use compromised infrastructure to conduct fraud-related operations and launch DDoS or ransomware attacks in an attempt to profit from vulnerabilities in smart grid systems [141]. To cause extensive outages and cascade failures, their attacks target substations by jamming electrical power transmissions [142], manipulating energy usage, tampering with smart meters, and stealing confidential data (e.g., customer information, energy consumption trends, and system configurations). These activities frequently assist illegal activities, including drug trafficking, money laundering, and selling private information to malicious parties [143]. **Spies:** Foreign intelligence agency spies frequently use sabotage or espionage attacks to disrupt services by targeting smart grid systems. For espionage and counterintelligence reasons, this could involve larger cyber operations to create backdoor access, install malware, and make use of zero-day vulnerabilities (e.g., Titan Rain (2003), Operation Olympic Games (2006), Shadow Network, and GhostNet (2009) [144; 145]). Attacks may also be used to achieve geopolitical and strategic goals, such as obtaining an advantage over competitors in the energy security and safety domains. **Hacktivists:** As a sort of online political protest, hacktivists try to interfere with smart grid services to voice their disapproval or bring attention to particular issues [146]. They employ strategies that include Distributed Denial-of-Service (DDoS) attacks on control systems, energy distribution manipulation, unauthorized access, and the disclosure of private data. They utilize smart grids as a platform to disseminate their ideology or message, garner media attention, and elicit reactions from the general public. **Military Operations:** Military operations can be divided into three main types, including combat operations (mostly overt), cyber operations (mostly covert), and psychological operations (mostly clandestine). * **Combat Operations:** CombatOps (CoOps) involve military showcasing of offensive cyber capabilities to conduct both defensive and offensive operations against smart grids, aiming to disrupt enemy infrastructure and hinder recovery processes. This illustrates targeted attacks on smart grids by compromising control systems and exploiting communication vulnerabilities to achieve strategic objectives, such as impacting morale, disrupting economies, gaining tactical control of infrastructure, masking military operations, and mobilizing forces.