# Centrii: Nation-State Pre-Positioning (Volt Typhoon, IRGC-Affiliated PLC Exploitation) and Renewable Supply-Chain Risk Raise Energy Sector Exposure

> Centrii analysis (2026-10-01, reported by Industrial Cyber 2026-10-06) describes converging energy-sector threats: Volt Typhoon living-off-the-land footholds in U.S. critical infrastructure, Iranian-affiliated exploitation of internet-facing PLCs (CISA AA26-097A), Russian-attributed physical sabotage in Europe, and supply-chain risk from grid-connected inverters and batteries. Utility ransomware incidents rose sharply in Q1 2026.

- **Published:** 2026-10-11T16:08:50Z
- **Last reviewed:** 2026-10-11T16:08:50Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3319
- **ID:** TL-2026-3319
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Volt Typhoon - G1017 (China, Iran)
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This record is strategic context built from a secondary analysis (Centrii, covered by Industrial Cyber on 2026-10-06) and anchored to two primary government advisories that the analysis relies on. The article itself states no CVEs, malware, or IOCs; the technical content below comes from the primary advisories.

China-linked Volt Typhoon: CISA/NSA/FBI advisory AA24-038A (2024-02-07) assesses with high confidence that Volt Typhoon is pre-positioning on IT networks of Communications, Energy, Transportation Systems and Water/Wastewater organizations to enable lateral movement to OT assets and disruption. Access has persisted for at least five years in some victims. The actor relies on living-off-the-land tooling (PowerShell, WMI, netsh portproxy, ntdsutil, vssadmin, wevtutil) with valid credentials, extracts NTDS.dit repeatedly, uses Fast Reverse Proxy (FRP) clients (UPX-packed), and routes C2 through compromised end-of-life Cisco and NETGEAR SOHO routers (KV botnet) and multi-hop proxies. Centrii assesses the intent as enabling disruption rather than intelligence gathering.

Iranian-affiliated PLC exploitation: joint advisory AA26-097A (published 2026-04-07, updated 2026-07-22) by FBI, CISA, NSA, EPA, DOE and U.S. Cyber Command reports Iranian-affiliated APT actors, previously associated with the IRGC Cyber Electronic Command and the CyberAv3ngers persona, exploiting internet-facing PLCs (Rockwell CompactLogix and Micro850, Schneider Modicon M340/BMX P34, Siemens S7-1200) in Government Services, Water/Wastewater and Energy sectors. Operators connected from leased VPS infrastructure using vendor engineering software (Rockwell Studio 5000 Logix Designer, Schneider EcoStruxure Control Expert, Siemens TIA Portal), modified project files, manipulated HMI/SCADA display data, and caused operational disruption and financial loss. Targeted ports: 44818, 2222, 102, 502, 22 (Dropbear SSH observed).

Supply chain and other drivers cited by Centrii: Chinese-manufactured solar inverters dominate European installations; researchers found remote-shutdown weaknesses and undocumented cellular hardware in inverters and batteries that can bypass utility firewalls; Centrii's GRIDLOCK model (September 2026) estimates a 92% probability of a major coordinated attack on UK battery storage by 2031 (61% with mandatory IEC 62443 certification). Russian-attributed physical sabotage in Europe (undersea cable plots, drone attacks) and Q1 2026 utility-sector ransomware across more than a dozen countries are also cited. Regulatory context: NIS2 enforcement, CER Directive, NERC CIP-015, TSA pipeline directives, and a U.S. executive order restricting foreign-linked grid equipment.

Severity is an analyst judgment. The source is secondary; IOCs here derive from AA26-097A and AA24-038A. BeaconBeagle returned HTTP 404 (no record) for the sampled IP 185.82.73.175.

## MITRE ATT&CK

- T1219 Remote Access Tools
- T1565 Data Manipulation
- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059.001 PowerShell
- T1047 Windows Management Instrumentation
- T1003.003 NTDS
- T1685.005 Clear Windows Event Logs
- T1027.002 Software Packing
- T1046 Network Service Discovery
- T1082 System Information Discovery
- T1021.001 Remote Desktop Protocol
- T1090.003 Multi-hop Proxy

## Sources

- [Centrii warns nation-state access and renewable supply-chain risks raise energy sector financial exposure](https://industrialcyber.co/utilities-energy-power-water-waste/centrii-warns-nation-state-access-and-renewable-supply-chain-risks-raise-energy-sector-financial-exposure/)
- [Centrii: Cyber risk, financial event, grid security and geopolitics](https://centrii.com/en/cyber-risk-financial-event-grid-security-geopolitics/)
- [CISA AA26-097A: Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-097a)
- [CISA AA24-038A: PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a)
- [CISA AA23-335A: IRGC-Affiliated Cyber Actors Exploit PLCs in Multiple Sectors, Including U.S. Water and Wastewater Systems Facilities](https://cisa.gov/news-events/cybersecurity-advisories/aa23-335a)
- [AA24-038A advisory PDF (NSA/DoD mirror)](https://media.defense.gov/2024/Feb/07/2003389935/-1/-1/0/CSA-PRC-COMPROMISE-US-CRITICAL-INFRASTRUCTURE.PDF)
- [U.S. agencies alert: Iran-linked actors target critical infrastructure PLCs](https://securityaffairs.com/190485/apt/u-s-agencies-alert-iran-linked-actors-target-critical-infrastructure-plcs.html)
- [What to Know About CyberAv3ngers: The IRGC-Linked Group Targeting Critical Infrastructure](https://www.tenable.com/blog/what-to-know-about-cyberav3ngers-the-irgc-linked-group-targeting-critical-infrastructure)
- [ICS at multiple US water facilities targeted by hackers affiliated with Iranian government](https://www.securityweek.com/ics-at-multiple-us-water-facilities-targeted-by-hackers-affiliated-with-iranian-government/amp/)
- [Australian Cyber Security Centre: PRC state-sponsored actors compromise US critical infrastructure (Volt Typhoon)](https://cyber.gov.au/node/2418)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3319