AI-driven malware threatens energy grid security

An opinion piece warns that AI-based malware like IBM's DeepLocker proof-of-concept could soon be weaponized against energy infrastructure.

This is a policy and trend analysis piece discussing the theoretical future risk of AI-driven malware to the energy sector, rather than reporting on an active campaign. It references historical incidents—the 2015 BlackEnergy/KillDisk attack on Ukraine's grid and the 2017 Triton malware incident targeting Saudi Aramco's industrial control systems—as evidence of the energy industry's vulnerability to cyberattacks. The author uses these precedents to argue that conventional malware already poses serious risks to critical infrastructure.

The core discussion centers on IBM's DeepLocker, a 2018 proof-of-concept demonstrating how AI/deep learning could be combined with malware to create highly evasive, targeted threats that remain dormant until specific biometric or contextual triggers are met, complicating detection and attribution. The article argues that since DeepLocker was built from open-source AI models, state and non-state actors could eventually replicate similar techniques against energy infrastructure. The piece concludes with policy recommendations: improving cyber hygiene, developing AI-driven defensive security systems, and fostering public-private partnerships between the energy industry and government to address emerging AI-enabled threats.

No active exploitation, specific IOCs, or named threat actors are presented; this is forward-looking commentary rather than an incident report.

Source reporting: https://www.atlanticcouncil.org/blogs/new-atlanticist/the-threat-of-ai-to-energy-security