Sandworm, Mustang Panda & Lazarus Now Target Energy Grids in 66% of APT Campaigns — Trellix SecondSight September 2026

A new threat hunting intelligence report from Trellix has landed a stark warning on every CISO’s desk: energy and utilities is now the single most targeted sector by Advanced Persistent Threat groups, appearing in 66.6% of all observed APT campaigns in the latest quarter. The September 2026 edition of Trellix’s SecondSight Threat Hunting Report documents Sandworm, Mustang Panda, and Lazarus Group operating simultaneously across 18 countries — and, in a first for the industry, captures an AI-assisted attack attempt against operational technology (OT) infrastructure. For Indian enterprises and government agencies relying on critical infrastructure, this is not an abstract threat: it is arriving at the perimeter right now.

The Trellix SecondSight Report: What Was Found and Why It Matters

Trellix’s SecondSight programme deploys human threat hunters alongside AI-augmented telemetry to identify attacker activity that automated tools miss. The September 2026 report synthesises hunting data across Trellix’s global managed detection and response (MDR) customer base, covering energy utilities, financial services, healthcare, and government sectors across North America, Europe, the Middle East, and the Asia-Pacific.

The headline statistic — that energy and utilities appear in two-thirds of all APT campaign observations — is jarring even against a backdrop of well-documented grid-targeting campaigns. The sector’s exposure is not accidental. Power grids, water treatment plants, and oil & gas pipelines share three qualities that make them irresistible to state-sponsored actors: they are difficult to offline quickly without catastrophic civilian consequences, they often run legacy OT systems with long patch cycles, and they are deeply interconnected with government and defence networks.

What makes this report’s data distinct is Trellix’s confirmation that the targeting is not theoretical planning but active, in-network hunting — meaning threat actors are already inside some of these environments conducting reconnaissance, not merely scanning from outside.

Sandworm: From Ukraine’s Power Grid to Global OT Infrastructure

Sandworm, the GRU-linked threat group responsible for the 2015 and 2016 Ukrainian power grid attacks and the NotPetya ransomware campaign, continues to expand its operational footprint. Trellix’s hunters detected Sandworm activity in the energy sector across multiple countries in Q3 2026, consistent with the group’s previously documented behaviour of using Cyclops Blink and its derivatives to establish persistent access in network management appliances and then pivot to OT-adjacent systems.

Sandworm’s recent campaigns — including its exploitation of CVE-2026-20079 in Cisco Secure Firewall Management Center, documented on this site — demonstrate the group’s tactical preference for targeting the management plane of enterprise infrastructure. Compromising the tool that manages firewalls is more valuable than compromising a single endpoint: it delivers visibility into the entire protected environment and the ability to silently modify security policy.

For Indian defenders, Sandworm’s expansion of geographic scope beyond Eastern Europe is the most significant escalation. India’s power utilities are already documented targets of Russian-linked activity, and the integration of management-plane exploitation into Sandworm’s playbook makes network security appliances — FortiGate, Cisco ASA, Palo Alto — the front line of this campaign.

Mustang Panda and Lazarus: A Two-Front Intelligence Threat

Mustang Panda (also tracked as TA416 and Bronze President), the Chinese Ministry of State Security-linked group, has historically focused on government, NGO, and telecommunications targets in South and Southeast Asia. The Trellix report documents a meaningful expansion into energy and utilities as the group appears to conduct strategic pre-positioning — gaining access now to infrastructure it may wish to disrupt or surveil during a future geopolitical flashpoint.

India occupies a particularly sensitive position: its ongoing border and maritime disputes with China, combined with its status as one of Asia’s fastest-growing energy importers, make its grid and pipeline networks high-value intelligence targets. Mustang Panda’s documented tool: PlugX and its successor implants, delivered via spear-phishing — remain viable against organisations that have not implemented strict application allowlisting and email security.

Lazarus Group (North Korea’s RGB-linked actor) rounds out the triad. While Lazarus is best known for financially motivated attacks — the 2016 Bangladesh Bank heist, cryptocurrency exchange raids — Trellix’s hunters documented the group targeting energy sector networks in this report cycle. The dual motivation (intelligence collection and revenue generation via ransomware or cryptojacking) makes Lazarus campaigns especially hard to categorise and triage. An initial access that looks like commodity malware may be Lazarus reconnaissance; a Lazarus network intrusion may pivot to ransomware if geopolitical windows close.

The AI-Assisted OT Attack: A Historical First

Perhaps the most consequential finding in the September 2026 SecondSight report is the first-ever confirmed observation of an AI-assisted attack attempt targeting operational technology infrastructure. The incident, detected against an energy operator in Mexico, was unsuccessful — Trellix’s hunters identified and contained it before it reached the OT layer — but its significance lies in what it demonstrates about nation-state capability development.

The attack used an AI-assisted tool to autonomously enumerate OT network topology, identify Modbus and DNP3 protocol endpoints, and generate candidate attack sequences against programmable logic controllers (PLCs) and distributed control systems (DCS). The human operators of the attacking team appear to have used the AI layer to accelerate the reconnaissance and payload-selection phases, dramatically compressing the time from initial access to OT-layer targeting.

This is the scenario that OT security researchers have warned about for years: AI does not introduce new attack categories, but it removes the specialist knowledge barrier. An actor that previously required an ICS/SCADA expert to navigate OT networks now needs only an AI-equipped attacker to automate that expertise. The gap between IT and OT security maturity — still wide in most Indian organisations — becomes more dangerous in this environment.

What You Should Do: An Indian CISO’s Playbook

Sanjay Seth’s thirty-year view from inside enterprise network security — across banking, government, manufacturing, and critical infrastructure in India — points to five immediate priorities:

1. Audit the IT/OT boundary. If your OT network connects to your corporate IT network through a flat or insufficiently segmented firewall, you are one lateral movement away from an APT reaching your SCADA layer. Use FortiGate’s NGFW with dedicated OT inspection profiles and Purdue Model segmentation to enforce strict zone boundaries.
2. Treat management-plane appliances as the highest-risk targets. Network management centres, SIEM platforms, and firewall management consoles are the first things sophisticated actors target. Apply zero-trust principles to administrative access: no direct internet exposure, MFA on every admin session, immutable audit logging of configuration changes.
3. Conduct tabletop exercises for AI-assisted attack scenarios. Your incident response playbooks were written when attackers required specialist OT knowledge. Update them to account for compressed attack timelines enabled by AI-assisted reconnaissance tools.
4. Harden email security and endpoint detection against Mustang Panda’s spear-phishing tradecraft. PlugX and its variants are typically delivered via macro-enabled Office documents or LNK-based loaders. Disable macros by policy, enforce DMARC/DKIM/SPF, and ensure EDR signatures are current for PlugX and its successors.
5. Enrol in a threat intelligence sharing programme. The CISA critical infrastructure threat sharing framework and India’s CERT-In have active channels for energy sector indicators of compromise. If your SOC is not consuming these feeds, start today.

Threat Actor	Sponsor	Primary Sectors Targeted	Typical Initial Access	Key India Relevance
Sandworm	Russia (GRU)	Energy, government, defence	Network appliance exploitation (FMC, FortiOS, VPN)	Grid pre-positioning; geopolitical espionage
Mustang Panda	China (MSS)	Government, energy, telecoms	Spear-phishing → PlugX	South/Southeast Asia focus; India-China border tensions
Lazarus Group	North Korea (RGB)	Energy, finance, crypto	Watering hole, supply chain, social engineering	Dual espionage + ransomware motivation; BFSI + energy

Zero-Trust Is Not Optional for Critical Infrastructure

The Trellix report’s findings reinforce what has been apparent to practitioners for several years: perimeter security alone cannot contain nation-state actors who have the patience to wait, the resources to acquire zero-days, and now the AI tooling to accelerate OT reconnaissance. Zero-trust — the principle of verifying every access request regardless of network location, and applying least-privilege to every user, device, and workload — is the architectural response.

For Indian energy and utilities operators, zero-trust implementation typically requires:

• Identity-centric access control replacing implicit trust from network zone
• Microsegmentation of OT networks using next-generation firewalls with OT protocol inspection
• Continuous monitoring and behavioural analytics across IT/OT convergence points
• Privileged access workstations (PAWs) for all OT administrative access

This is not a 90-day project. But the alternative — waiting until a Sandworm or Mustang Panda operator has completed their reconnaissance — leaves you responding to an incident rather than preventing one.

Frequently Asked Questions

Why are energy and utilities the most targeted sector by APT groups?

Energy infrastructure offers nation-state actors three strategic advantages: it is politically sensitive (disruption causes civilian hardship and political pressure), it runs legacy OT systems with long patch lifecycles, and it is interconnected with government and defence networks. Compromising it can serve either espionage objectives (learning about a country’s grid resilience) or destructive ones (triggering blackouts during a geopolitical crisis).

What does “AI-assisted OT attack” actually mean in practice?

In the Trellix-documented incident, AI was used to automate OT network reconnaissance — identifying industrial protocol endpoints (Modbus, DNP3), enumerating PLC and DCS devices, and generating candidate attack paths — faster than a human specialist could. The AI layer compresses the time from initial network access to OT targeting, making attacks achievable for actors without dedicated ICS/SCADA expertise on their team.

How should Indian CISOs prioritise given simultaneous threats from Sandworm, Mustang Panda, and Lazarus?

Prioritise by attack vector, not by actor. All three groups rely on the same fundamental weaknesses: unpatched network appliances, weak IT/OT segmentation, insufficient email security, and inadequate privileged access management. Closing these structural gaps defends against all three simultaneously. Threat intelligence feeds (CERT-In, CISA) help identify actor-specific IOCs for detection.

Is CERT-In providing specific guidance on these APT campaigns for Indian critical infrastructure operators?

CERT-In issues advisories under its Critical Infrastructure Protection (CIP) mandate and has active information-sharing channels with sector-specific ISAC bodies (power, banking, telecoms). Indian critical infrastructure operators should be registered subscribers to CERT-In’s automated alert feeds. For sector-specific threat hunting support, engaging a managed detection and response provider with OT experience is strongly recommended.

Act Before the Adversary Completes Their Reconnaissance

The September 2026 Trellix SecondSight report is a field intelligence document, not a theoretical risk assessment. The threat actors it describes — Sandworm, Mustang Panda, Lazarus Group — are active right now, inside some networks, moving toward OT layers. The AI-assisted OT attack that was detected and stopped in Mexico was a proof of concept that will be refined and redeployed.

If your organisation operates critical infrastructure in India — power generation, oil & gas, water utilities, or the IT networks that support them — now is the time to assess your zero-trust maturity, your IT/OT boundary security, and your threat detection capabilities before an adversary completes their reconnaissance.

Ready to assess your organisation’s exposure to APT-grade threats? Contact Sanjay Seth for a no-obligation security assessment. With thirty years of network security experience across Indian enterprise and government, including FortiGate and zero-trust architecture, Sanjay’s team at P J Networks can map your risk and build a prioritised remediation roadmap — before an attacker does it for you.

Sources: Industrial Cyber — Trellix SecondSight September 2026 | Trellix SecondSight Threat Hunting Report | Darktrace State of AI Cybersecurity 2026 | CISA Critical Infrastructure Security | WEF Global Cybersecurity Outlook 2026