SUBJECT PROFILE
New CYFIRMA research published June 10, 2026 revealed that the energy and utilities sector appeared in 66.6% of all observed APT campaigns over the preceding three months — with Chinese actor Mustang Panda, North Korea's Lazarus Group, and Russia's Sandworm (APT44) identified as the most active adversaries across attacks spanning 18 countries. The China-aligned MISSION2074 cluster recorded the highest campaign count of any single actor across all sectors in the most recent reporting period, with Volt Typhoon, Salt Typhoon, Earth Estries, and Hafnium providing additional Chinese representation. Sandworm was separately linked to a destructive DynoWiper malware campaign targeting Poland's energy sector in late 2025.
Strategic pre-positioning, critical infrastructure espionage, and disruption readiness targeting energy and utilities sectors across 18+ countries
OPERATIONAL HISTORY
Living-off-the-land (LOTL) techniques, ICS/SCADA reconnaissance, web application exploitation, credential abuse, DLL sideloading (Mustang Panda COOLCLIENT backdoor), supply chain compromise, long-haul persistence, destructive wiper deployment (Sandworm DynoWiper), cryptocurrency theft (Lazarus), IaaS/cloud infrastructure compromise
KNOWN INFRASTRUCTURE
Mustang Panda: COOLCLIENT backdoor variants, DLL sideloading chains; Lazarus: custom implants, cryptocurrency theft tooling; Sandworm: DynoWiper (Windows wiper targeting Polish energy), C2 infrastructure spanning 18+ target countries; MISSION2074: China-aligned cluster C2