## 3 Results
### Cyberattacks in Smart Grids: Challenges and Implications of Cybersecurity
#### 3.1.2 Exploring the Landscape of Cyberattacks in Smart Grids  
Smart grids are susceptible to various types of cyberattacks (Figure 4) that target their interconnected systems and infrastructure [154]. Here are some common types of cyberattacks in smart grids [155, 156]:  
Figure 3: A schematic representation of the smart grid. Source: Own Elaboration. * **Denial-of-Service (DoS) Attacks**: These attacks aim to temporarily make the targeted system inaccessible to legitimate users by overwhelming the smart grid's resources, such as communication networks or control systems, with an excessive volume of requests and flooding them with a high volume of traffic, launched from a single device. This disrupts the grid's operations and may result in service outages [157]. * **Distributed Denial-of-Service (DDoS) Attacks**: Similar to DoS attacks, DDoS attacks involve multiple compromised devices, located worldwide, forming a botnet that collectively overwhelms the grid's resources. DDoS attacks are more challenging to mitigate due to their distributed nature [158, 159]. * **Malware Attacks**: Malware attacks in the context of smart grids refer to the infiltration of malicious software into the grid's systems, devices, or networks. Malware infects the smart grid's control systems, or human machine interfaces (HMIs), disrupts operations, compromises data integrity, and potentially gains unauthorized control over critical infrastructure. Here are some common types of malware attacks in smart grids [160, 161]:
* **Viruses**: viruses are self-replicating programs that attach themselves to legitimate files or programs and spread across the grid's systems. Once activated, viruses can cause system malfunctions, data corruption, or unauthorized access. * **Worms**: worms are standalone programs that replicate and spread across computer networks without requiring a host file. Worms can rapidly infect multiple devices within the smart grid, causing network congestion, system crashes, or unauthorized activities [162, 163]. * **Ransomware**: ransomware is a type of malware that encrypts files or locks users out of their systems, demanding a ransom payment in exchange for restoring access. Ransomware attacks can disrupt smart-grid operations, leading to service interruptions or financial losses [164, 165]. Ransomware attacks have been on  
Figure 4: A visual representation depicting the interconnected relationship between production plants, transmission and distribution lines, consumption, and the integration of information, control, and communication technologies. Source: Own Elaboration. the rise in recent years. According to a report by SonicWall [166], there were 304.7 million ransomware attacks globally in 2020, representing a 62% increase compared to the previous year. The financial impact of ransomware attacks is substantial. Cybersecurity Ventures [167] estimated that ransomware costs will reach 20 billion dollars in 2021, with a ransomware attack occurring every 11 s. * **Trojan Horses**: Trojans disguise themselves as legitimate software or files and trick users into executing them. Once activated, Trojans can perform various malicious activities, such as data theft, system control, or backdoor creation for remote access [168, 169]. * **Botnets**: botnets are networks of compromised devices that are controlled by a central command and control (C&C) server. Smart-grid devices infected with botnet malware can be used for coordinated attacks, such as DDoS attacks or spreading other forms of malware [170, 171]. * **Keyloggers**: keyloggers capture keystrokes on infected devices, including passwords, login credentials, or other sensitive information. These data can be used to gain unauthorized access to smart-grid systems or compromise user accounts. * **Spyware**: spyware is designed to collect information about a user's activities without their knowledge or consent. In the context of smart grids, spyware can monitor system operations, gather sensitive data, or capture user behavior, potentially compromising grid security.