## 3 Results
### Cyberattacks in Smart Grids: Challenges and Implications of Cybersecurity
#### 3.1.2 Exploring the Landscape of Cyberattacks in Smart Grids
The number of unique malware variants continues to grow rapidly. According to AV-TEST [172], an independent antivirus testing organization, more than 1 billion new malware variants were detected in 2020 alone. * **Phishing Attacks**: phishing attacks involve the use of deceptive techniques to trick individuals or organizations into revealing sensitive information, such as login credentials, financial details, or personal data, or performing malicious actions. These attacks often come in the form of fraudulent emails, text messages, or websites that mimic trusted entities or institutions [173]. Phishing attacks continue to be a prevalent threat. In the 2021 Verizon Data Breach Investigations Report [174], phishing attacks accounted for 36% of all data breaches analyzed. * **Insider Threats**: insider threats refer to attacks perpetrated by individuals who have authorized access to the smart grid's systems and misuse their privileges. These insiders may intentionally or inadvertently compromise the grid's security, privacy, or operational integrity [175, 176]. Insider threats pose a significant risk to smart grids. The U.S. Industrial Control Systems Cyber Emergency Response Team (ICSCERT) [177] reported that insider threats accounted for approximately 20% of the cybersecurity incidents in the energy sector. * **Man-in-the-Middle (MitM) Attacks**: in MitM attacks, attackers can exploit insecure or unencrypted Wi-Fi networks to position themselves between the sender and the recipient, allowing them to eavesdrop on the communication, manipulate the data exchanged, or even impersonate one or both parties without their knowledge [178, 179]. * **Advanced Persistent Threats (APTs)**: APTs are sophisticated, long-term cyberattacks aimed at gaining stealthy and persistent unauthorized access to the smart grid's systems (i.e., login credentials, financial details, or other confidential data being transmitted). APTs involve multiple stages and often target specific entities or organizations with the goal of gathering valuable information or sabotaging critical operations [179, 180]. * **Data Manipulation Attacks**: these attacks involve the unauthorized modification or manipulation of data within the smart grid. Attackers may alter meter readings, billing information, or control signals, leading to inaccurate billing, load balancing, or compromised grid stability [181]. * **Supply Chain Attacks**: supply chain attacks exploit vulnerabilities in the software or hardware components used in smart-grid infrastructure. The attackers compromise these components during the manufacturing or distribution process, allowing them to introduce backdoors or malicious functionalities into the grid's systems [182]. * **Physical Attacks with Cyber Components**, also known as cyber-physical attacks, refer to instances where physical systems or infrastructures are targeted through cyber means. These attacks exploit vulnerabilities in both the physical and cyber domains to cause disruptions, damage, or safety risks [183, 184]. * **SQL Injection Attacks**: while smart grids primarily focus on power generation, transmission, and distribution, there are web-based applications and databases that support various functions and services within the grid. SQL injection attacks are a type of cyberattack that targets a vulnerability in a web application's database layer. It occurs when an attacker is able to manipulate or inject malicious SQL statements into the application's input fields that are later executed by the database. The objective of an SQL injection attack is to exploit poorly sanitized input data and gain unauthorized access to the database or perform malicious actions [185]. * **Zero-Day Exploits**: zero-day exploits are cyberattacks that target previously unknown vulnerabilities in software or systems, exploiting them before the vendor has a chance to develop and release a patch or fix. In the context of smart grids, zero-day exploits can have severe consequences due to the critical nature of the infrastructure [186].