Clearing the Fog of War A Critical Analysis of Recent Energy Sector Attacks in Denmark and Ukraine.pdf

This report analyzes two recent energy-sector incidents: widespread exploitation of Zyxel firewall vulnerabilities in Denmark that led to Mirai variant infections and mass botnet activity (with IOCs and extensive scanning across Europe), and a Ukraine substation disruption attributed to Sandworm that used native MicroSCADA scripting (SCIL) as a living-off-the-land TTP to open breakers; the authors recommend patching and hardening perimeter devices, OT-aware monitoring, segmentation, and use of threat intelligence.