Electric operators, pipeline companies, and other utilities depend on remote access and on contractors who reach the same systems. DarkThreat watches external sources for stolen credentials and leaked files so the security team can act while operations are still up.
The valuable object is often a login that reaches operations, or a file that describes how operations are run. Three patterns cover most of what shows up outside the company.
A control room, a substation gateway, a compressor station, and a generation site are not reached only from a desk inside the fence. Engineers, operators, and vendors connect through a VPN, a jump host, or a support tool. Those passwords live on laptops that also browse the web and open email. When a stealer log captures the password, the login can be replayed by someone who has never visited the site.
Getting onto the corporate network is not the same thing as rewriting a controller. It is still enough to matter. Scheduling, outage coordination, historian access, and the engineering workstation used to reach the process can sit on the path behind that remote-access account.
A stolen VPN password is therefore an operations problem and an IT problem at the same time. Leaked VPN credentials and stolen remote-desktop logins are the trade that feeds this path.
DarkThreat helps by flagging usernames and passwords tied to domains and remote-access names you register, when those values appear in stealer logs, credential lists, or posts. It does not sit on the control network. Relay settings, safety systems, and pipeline controllers remain the responsibility of the operations team. Use an external alert as a prompt to disable the account and to review remote-access logs on systems the operator already runs.
Utilities and pipeline operators run with other companies in the room. A relay technician, a turbine vendor, a SCADA integrator, a leak-detection supplier, or a construction contractor may hold an account the operator issued, or may bring a laptop that has already been used on another customer network. The password stolen on that laptop can be the operator remote-access password if the contractor reused it, or it can be the contractor email account, which is then used to phish the operator.
Supply-chain expectations already exist for part of this sector. NERC CIP-013, Supply Chain Risk Management, is the standard registered responsible entities use for supply-chain cyber security risk on applicable bulk electric system cyber systems. TSA Security Directive Pipeline-2021-02 series, for designated pipeline and LNG operators, covers cybersecurity measures that include access control.
Neither document is a license to watch a vendor internal network. The practical watch is the accounts you issued and the names that would identify your facilities in a public post. Check NERC and TSA for the versions currently in force before you map a control.
DarkThreat helps with that external watch. See supply-chain credential leaks and vendor credential monitoring. Asking a critical contractor which email domain its technicians use is a procurement step. Pretending to see inside the contractor office network is not.
Stopping billing, scheduling, or the IT systems that operators use to coordinate work creates pressure to pay, even when the physical process is still running. Crews often start with a stolen VPN or remote-desktop password, then look for file servers and the workstations engineers use. Encrypting those systems can idle customer service, outage dispatch, and the business side of a control center.
Copying files first, then posting a diagram or an operating procedure on a leak site, adds a second form of pressure. Credential leaks are a step in that chain.
DarkThreat helps by flagging company credentials and posts that name the operator on ransomware leak sites. It does not restore a control center and it does not decide whether a process should be run manually. Those decisions stay with operations. For how leak sites are used, see monitoring ransomware leak sites.
Six exposure types an electric, pipeline, or utility security team can investigate from an external alert.
VPN, jump-host, and vendor-support passwords that open a path from the corporate network toward engineering workstations and operations systems.
Accounts issued to maintenance firms, integrators, and suppliers, including passwords stolen on a contractor laptop and replayed against a utility portal.
Leak-site posts and stolen logins used to stall billing, scheduling, and the IT systems operators rely on, even when a controller is never rewritten.
Network diagrams, operating procedures, and outage plans copied from file servers and described on a leak site under the utility name.
Pages that imitate a utility VPN or a vendor portal in order to collect another round of operator and contractor passwords.
Vendor support logins that several contractors know, so one stolen password can reach more than one site or pipeline console session.
This watch is external. DarkThreat looks for identifiers you provide in places stolen data is posted or sold: stealer-log collections, credential lists, forums, paste sites, and ransomware leak sites. It is a fit for questions about logins and files, not for questions about the live state of a breaker or a compressor.
Did an operator, engineer, or contractor password for your domain show up in a stealer log? Is a VPN, jump-host, or vendor-support username being passed around? Did an account you issued to a maintenance firm appear in a credential list?
Is the company, a plant, a control center, or a pipeline system named on a ransomware leak site, with diagrams or procedures described? Is someone offering access to the network in a forum post? Are lookalike domains imitating a remote access page?
The same watch will not show traffic on the process network, ladder logic, or the state of a safety system. Those belong in the operational technology program. For bulk electric registered entities, electronic access into BES cyber systems is addressed in the NERC CIP standards discussed below.
For operators covered by the TSA Security Directive Pipeline-2021-01 and Pipeline-2021-02 series, external connections to operational technology sit inside the cybersecurity measures in the current directive. An external credential finding is a reason to check remote-access logs. It does not replace either program.
Not every utility is in both regimes. NERC CIP applies to responsible entities registered for the bulk electric system, under the applicability in each standard. The TSA pipeline directives apply to owners and operators TSA has notified.
A municipal water system, or a gas distribution operator that TSA has not designated, can still use the same external watch for its own domains and remote-access accounts. That use is a security practice. It does not create a NERC or TSA obligation that the statute or directive does not already impose.
Employee and operator logins for domains you register, including accounts reused from a laptop onto a remote-access gateway.
VPN, jump-host, and support-tool usernames you choose to register, which are a practical route onto the network that supports operations.
Portal and remote-access accounts the utility or pipeline operator controls. A hostname that belongs only to the contractor is outside that watch.
Posts that name the company, a plant, a control center, or a pipeline system, including descriptions of diagrams or operating files.
Underground posts offering network access or files that match facility or system names you asked DarkThreat to watch.
Published plans include email notifications and web UI access, so a finding can be read without a separate integration project.
Someone names the identifiers, someone reads the alert, someone resets the account on systems the operator already runs, and someone keeps the record.
Start with identifiers you can share without opening the process network to a new tool. That list usually includes corporate domains, the email domains employees and contractors use when you issued the account, remote-access hostnames you are willing to disclose, and plant, control-center, or pipeline names that would be meaningful in a leak. A vendor engineering server you do not control is a contract topic.
When a match appears, published plans include email notifications and web UI access, so the security contact can read the finding directly. Triage by role. A password for an engineer who can reach a jump host is a different hour of work from a password for a recruiting alias.
Operations and IT reset the account, check whether that identity was used on remote access, and look for a second account from the same person or the same contractor firm. DarkThreat helps by putting the external finding in front of that team. Isolation of a workstation and any change to how a site is operated happen inside the operator environment.
Keep the alert, the time, the account, and the action you took. Stolen logs are copied, so leave the same identifiers on the watch list. For a NERC registered entity, the record can support incident handling the entity already runs under its CIP program.
For an operator covered by the TSA Security Directive Pipeline-2021-01 and Pipeline-2021-02 series, it can support the incident response work in the directive TSA currently has in force. The record helps the people who own those programs. DarkThreat does not make the organization compliant with NERC CIP or with a TSA security directive.
Corporate domains, remote-access hostnames you are willing to disclose, contractor accounts you issue, and facility names that would matter in a leak.
A security contact reviews the finding in the web UI or from the email notification included on published plans.
Operations and IT reset the account on their own systems and check whether that identity was used on remote access.
Save the alert, the account, and the action taken so it can support incident handling. The record helps. It is not a NERC or TSA finding.
These requirements apply to defined registered entities and to operators TSA has designated. DarkThreat supports external exposure awareness inside the program the operator already runs. Using DarkThreat does not make an operator compliant.
NERC Critical Infrastructure Protection standards apply to responsible entities subject to each standard, for the bulk electric system cyber assets in that standard scope. The standards that matter for the exposures on this page are CIP-004, Personnel & Training; CIP-005, Electronic Security Perimeters; and CIP-013, Supply Chain Risk Management. Check NERC for the versions currently subject to enforcement: NERC CIP reliability standards.
CIP-004, Personnel & Training, is where access authorization and revocation for applicable BES cyber systems are handled. CIP-005, Electronic Security Perimeters, is where electronic access, including interactive remote access, is handled. CIP-013, Supply Chain Risk Management, is where supply-chain cyber security risk management plans for applicable BES cyber systems are handled. The requirement text depends on the version NERC currently enforces.
Dark web monitoring does not implement an electronic security perimeter and does not approve vendor risk. It helps when a stolen remote-access credential or a leaked file is the indicator the entity uses inside the access-revocation and incident process it already runs. That is support. It is not a completed CIP requirement, and it is not a finding of compliance.
Pipeline cybersecurity directives that apply here are the TSA Security Directive Pipeline-2021-01 and Pipeline-2021-02 series. They apply to owners and operators of hazardous liquid and natural gas pipelines, or liquefied natural gas facilities, that TSA has designated. A directive served on a designated pipeline or LNG operator does not, by itself, apply to an electric distribution utility. TSA updates these directives regularly; check https://www.tsa.gov/sd-and-ea for the current versions.
The Pipeline-2021-02 series is the mitigation, contingency-planning, and testing series. Measures in the current version include access control and awareness of external connections to operational technology, along with incident response. DarkThreat helps a designated operator notice when remote-access credentials or company files show up outside the operation, which can support that incident response work. It does not approve a cybersecurity implementation plan, and it does not make an operator compliant with the directive.
Many energy and utility companies also map corporate IT to the NIST Cybersecurity Framework and operate an ISO/IEC 27001 information security management system beside the OT program. DarkThreat helps those efforts with external credential and file-exposure evidence the security team can attach to its own risk record. The guides below describe each framework. They are not a statement that DarkThreat satisfies NERC CIP, a TSA security directive, or a certified management system.
Plans start at $288/mo. A 7-day free trial is available, and no credit card is required to start. Tell us which domains, remote-access names, and contractor accounts you need watched.
