###### Abstract  
This study examines the cybersecurity vulnerabilities of energy IT infrastructure in the context of rapid digital transformation and network expansion. While these advancements have improved efficiency, they have also increased susceptibility to cyber threats, particularly from malware such as Industryeer, Triton, NotPetya, and BlackEnergy3. By analyzing these malware threats, this research identifies key weaknesses in energy systems and highlights the need for enhanced anomaly detection, network segmentation, and system integrity checks. To address these vulnerabilities, this study proposes a layered security architecture in which each layer--physical, control, network, application, and security--provides independent protection while integrating into a unified defense strategy. This research emphasizes the necessity of combining technical-, organizational-, and policy-based responses to bolster cybersecurity across all levels of energy infrastructure. Key recommendations include immediate vulnerability patching, improved international cooperation, stronger legal frameworks, enhanced cybersecurity education, and the establishment of a unified command structure. This study provides practical insights and strategies for strengthening the cybersecurity of energy systems through a comprehensive, integrated approach. energy infrastructure; cybersecurity vulnerabilities; malware analysis; cyberattack mitigation; strategic response measures +
Footnote †: journal: Applied sciences  
0000-0001-9300-0000-0000-0000-0000-0000-0000-00000-00000-0000-00000-00000-00000-00000-00000-00000-00000-00000-00000-000000-00000-000000-00000-000000-00000-000000-000000  
real-time monitoring via Intrusion Detection Systems (IDSs), and layered protection mechanisms. Given that energy systems are primary targets of cyberattacks, robust cybersecurity measures are essential [13; 14]. According to the Threat Intelligence Index, the energy sector ranked as the fourth most targeted industry in cyberattacks in 2022, accounting for 10.7% of all attacks. Notably, energy companies in North America experienced 20% of these attacks, demonstrating significant vulnerability to cyber threats [15; 16; 17]. In the energy sector, a significant proportion of cyberattacks target public applications, such as spear-phishing and attacks exploiting vulnerabilities in external remote services, which account for 20% of total security threats [18]. These attacks include severe cybersecurity breaches such as data theft, extortion, ransomware, business email compromise (BEC), credential harvesting, and botnet infections [19]. This evolving cyber threat environment poses major risks to the reliability and safety of energy systems, underscoring the need for comprehensive investigations and effective response strategies [20]. To address these challenges, this study proposes a multi-layered security architecture to enhance protection from physical assets to application software. Physical layer defenses enforce strict access controls, mitigating insider risks, while network layer protections feature segmentation and real-time IDSs. At the control layer, SCADA/SIS systems employ digital signatures to ensure command integrity. Application layer defenses include patch management and active monitoring, addressing software vulnerability [21]. The goal of this study is to thoroughly investigate cybersecurity vulnerabilities within energy infrastructure and propose feasible and effective response strategies to mitigate these risks. By addressing the immediate need for a response to these cybersecurity challenges, this research aims to enhance the security and resilience of energy systems. This study emphasizes the importance of a layered security structure that protects systems from sophisticated cyber threats by enabling key components such as Supervisory Control and Data Acquisition (SCADA) systems, Safety Instrumented Systems (SISs), firewalls, and IDSs to interact seamlessly and form a cohesive defense strategy [22; 23].