DNP3 — Cyber Threats, Attacks & Incidents

Threat entity extracted from intelligence sources

Frequency
9
occurrences
First Seen
November 3, 2025
Last Seen
July 9, 2026

DNP3 is a technology platform tracked across 11 threat clusters and 9 intelligence report mentions on ThreatCluster. First observed November 3, 2025; most recent activity July 9, 2026.

Overview

DNP3 is a widely used OT communication protocol stack for SCADA/ICS, enabling master-outstation telemetry and control over serial or IP networks, commonly found in electric utilities and manufacturing. Its cybersecurity significance stems from its prevalence in critical infrastructure and historically limited default security features (e.g., limited authentication/encryption in legacy deployments), making it a notable attack surface for disrupting power grids and industrial operations.

Related Threat Clusters

  • Exposed Modbus ICS Devices Heighten Risks to Critical Infrastructure

    A report reveals that 179 internet-exposed industrial control systems (ICS) using the Modbus protocol are vulnerable across 20 countries, with the majority located in the U.S., Sweden, and Turkey. The Modbus protocol…

    4 articles · Updated April 9, 2026
  • Command-Level Security Gaps in Industrial Protocols Exploited

    PacketViper has highlighted significant vulnerabilities in industrial protocols like Modbus, which lack authentication and authorization, making them susceptible to unauthorized commands. These protocols are widely used…

    2 articles · Updated July 8, 2026
  • Cyber Threats Target Solar Infrastructure Beyond Inverters

    In late December 2025, a cyber attack impacted 30 solar plants in Poland, primarily targeting substation equipment with wiper malware, while inverters remained unaffected. The attack highlighted vulnerabilities in the…

    2 articles · Updated June 4, 2026
  • Cybersecurity Threats in Renewable Energy Plants: A Growing Concern

    As renewable energy plants increasingly rely on digital technologies, they face significant cybersecurity threats. Attackers are targeting operational disruptions rather than just data theft, complicating traditional…

    2 articles · Updated July 9, 2026
  • East-West Traffic Visibility Crucial for Electric Grid Security

    Electric power infrastructure is increasingly interconnected, integrating operational technology (OT) and enterprise IT systems, which raises cybersecurity risks. Attackers often exploit these connections to move…

    3 articles · Updated March 18, 2026
  • Massive Power Outage Affects Spain, Portugal, and France

    In late April, a significant power outage impacted Spain, Portugal, and parts of southwestern France, leaving tens of millions without electricity for hours. The outage caused widespread disruptions, including halted…

    2 articles · Updated November 3, 2025
  • Panasonic Initiates Cybersecurity Monitoring Trial for Grid-Scale BESS

    On March 19, 2026, Panasonic announced a cybersecurity monitoring trial for a grid-scale Battery Energy Storage System (BESS) facility in Japan, in collaboration with ITOCHU Corporation. The trial aims to evaluate the…

    2 articles · Updated March 19, 2026
  • Manufacturing Sector Faces Surge in Operational Technology Attacks

    A report by Trellix indicates that operational technology (OT) attacks have significantly increased, with the manufacturing sector experiencing 42% of these incidents. The report, covering data from April to September…

    2 articles · Updated November 19, 2025
  • Dragos Reports Rise of OT Threat Groups Targeting Industrial Systems

    Dragos has identified three new operational technology (OT) threat groups—Azurite, Pyroxene, and Sylvanite—marking a shift from reconnaissance to real-world disruption of industrial processes. The report indicates that…

    4 articles · Updated February 17, 2026
  • Massive Power Outage Affects Spain, Portugal, and France

    In late April, a significant power outage occurred across Spain, Portugal, and parts of southwestern France, impacting tens of millions of residents. The outage resulted in cities losing electricity for hours, halting…

    2 articles · Updated November 3, 2025

Recent Intelligence Reports

  • Proactive Cybersecurity: Continuous defense and anticipation for your critical renewable ... — Isotrol · July 9, 2026
  • Ot Protocol Command Control — packetviper.com · July 8, 2026
  • Solar Cyber Threats Expand But Inverters Still Stay In The Crosshairs — www.pv-magazine.com · June 4, 2026
  • Internet — Industrialcyber.Co · April 10, 2026
  • Panasonic claims world's first trial of cybersecurity monitoring for grid-scale BESS — Ess-News · March 19, 2026
  • Why East-West Visibility Matters for Grid Security | Trend Micro (UK) — Trendmicro · March 18, 2026
  • OT cyber threats shift from spying to disruption in 2025 — Securitybrief · February 18, 2026
  • Hackers increasingly target operational technology, with manufacturing sector bearing the brunt — Cybersecuritydive · November 18, 2025

CVSS v3.1 Breakdown