## 5 Cybersecurity in MGs
### Threats to Microgrid Cybersecurity
_Load Manipulation Attacks_: These attacks aim to modify power usage of targeted loads or even to overload them. For instance, the method of load manipulation can be employed indirectly by publishing incorrect price information to customers in terms of demand response management techniques. Power loads must be protected to prevent overloading and to manage them cost-effectively [222]. _Malicious Command Injection Attack_: In power grids, phase shifting transformers or phase shifters are used to control the flow of electricity. Phase shifters are used to prevent the accumulation of electrical density in transmission lines and to apply contract-based regulations. In an automatic power grid system, phase shifting commands are transmitted through the SCADA system. This situation can make the system vulnerable to cyberattacks in terms of both harmless and malicious commands being sent from the phase shifters. Malicious commands can cause serious damage, power outages, and disrupt cross-network interactions [223]. _Load Redistribution Attacks_: These attacks are related to the distribution or routing of energy sources on a microgrid. This type of attack is carried out when a device with low security levels changes the flow of energy on the grid by sending fake data packets or using a predetermined strategy [224; 225]. Attackers can artificially increase energy consumption in a specific area of the grid, causing energy sources in that area to rapidly deplete. This can create a balancing issue across the entire grid, requiring other areas to be fed from different energy sources [226]. Load redistribution attacks also allow individuals with access to energy sources to manipulate energy consumption by redirecting energy sources from one area to another. This can cause power outages in specific areas of the grid and harm electricity consumers in the affected region. The best way to counter these types of attacks is to implement appropriate mechanisms for controlling the distribution and routing of energy sources on the grid and monitoring them securely. Additionally, it is important to take appropriate security measures on each device to ensure the security of each component of the grid [102]. _Coordinated Cyberphysical Topology Attacks_: Coordinated cyberphysical topology attacks (CCPT) are more dangerous for MGs than either physical topology attacks or cybertopology attacks alone [227; 228]. CCPT attacks are divided into two categories: physical topology attacks and cybertopology attacks. In a physical topology attack, the attacker cuts the transmission line, while in a cybertopology attack, the attacker deceives the control center, hides the outage signal in the cyberlayer, and creates a false outage signal for another transmission line [229]. As a result, the most important goal of a coordinated topology attack is to overload the critical line by deceiving the control center into making incorrect dispatches [230]. _Replay Attack_: A replay attack can be carried out by intercepting information in a communication network and then mimicking a legitimate sender by distributing the intercepted information to reproduce the original information [231; 232]. This type of attack relies on past data and makes it difficult for the control center to detect the attack. As a result, the attack can cause disruption in the power flow and lead to time delays at different frequencies. From the attacker's point of view, a replay attack can intentionally disrupt the system and various processes completely [233]. _Malware Attacks_: Malware is software designed to harm or disrupt computer systems, and it can be introduced into a microgrid's system through email attachments, software updates, or infected USB drives. Once installed, malware can spread throughout the system, causing significant damage [234; 235]. Some types of malwares, such as ransomware, can encrypt the microgrid's data and demand payment for their release, causing significant financial losses.