Adversary Simulation Scenarios for Energy & Utilities
The MITRE ATT&CK threat actors most relevant to Energy & Utilities organizations include APT28, Kimsuky, Sandworm Team. This page ranks documented actors by how closely their known targeting and tooling match a Energy & Utilities org, and shows which of each actor's techniques a TurboPentest pentest can exercise today. It is a relevance match, not a probability forecast.
Instead of a generic vulnerability checklist or a once-a-year manual red team, this is a focused, repeatable way to test the specific techniques the actors relevant to your industry actually use.
Methodology
Relevance is a match on your industry sector and technology stack against the MITRE ATT&CK v19.1 group graph (174 groups, 821 software families, 56 campaigns). It is computed deterministically from that data, with no language model in the request path. It is a relevance match, not threat-intelligence probability data: it tells you which documented actors and techniques are worth emulating for an org like yours, not a forecast that any specific group will act.
APT28 G0007
Relevance matchEnergy & UtilitiesAlso known as IRON TWILIGHT, SNAKEMACKEREL, Swallowtail, Group 74, Sednit.
TurboPentest can autonomously exercise 7 of 101 of this actor's documented techniques today (7%). 30 are out of scope for automated testing (social engineering, denial of service, physical).
+57 coming soonmore unlock with our internal pentesting agent, currently in private beta.
These counts are computed from the vendored MITRE ATT&CK graph and the published coverage map, and are reproducible from source.
In-scope techniques to emphasize
Emulate APT28. Audit-Ready pentest, $99.
Finds nothing? Your next pentest is free. If a pentest surfaces zero actionable findings, we credit you a free re-pentest. Once per target; does not apply to retests or Recon. You always walk away with real findings or a free redo.
Launch this pentestKimsuky G0094
Relevance matchEnergy & UtilitiesAlso known as Black Banshee, Velvet Chollima, Emerald Sleet, THALLIUM, APT43.
TurboPentest can autonomously exercise 9 of 130 of this actor's documented techniques today (7%). 39 are out of scope for automated testing (social engineering, denial of service, physical).
+73 coming soonmore unlock with our internal pentesting agent, currently in private beta.
These counts are computed from the vendored MITRE ATT&CK graph and the published coverage map, and are reproducible from source.
In-scope techniques to emphasize
Emulate Kimsuky. Audit-Ready pentest, $99.
Finds nothing? Your next pentest is free. If a pentest surfaces zero actionable findings, we credit you a free re-pentest. Once per target; does not apply to retests or Recon. You always walk away with real findings or a free redo.
Launch this pentestSandworm Team G0034
Relevance matchEnergy & UtilitiesAlso known as ELECTRUM, Telebots, IRON VIKING, BlackEnergy (Group), Quedagh.
TurboPentest can autonomously exercise 10 of 99 of this actor's documented techniques today (10%). 36 are out of scope for automated testing (social engineering, denial of service, physical).
+44 coming soonmore unlock with our internal pentesting agent, currently in private beta.
These counts are computed from the vendored MITRE ATT&CK graph and the published coverage map, and are reproducible from source.
In-scope techniques to emphasize
Emulate Sandworm Team. Audit-Ready pentest, $99.
Finds nothing? Your next pentest is free. If a pentest surfaces zero actionable findings, we credit you a free re-pentest. Once per target; does not apply to retests or Recon. You always walk away with real findings or a free redo.
Launch this pentestOilRig G0049
Relevance matchEnergy & UtilitiesAlso known as COBALT GYPSY, IRN2, APT34, Helix Kitten, Evasive Serpens.
TurboPentest can autonomously exercise 4 of 82 of this actor's documented techniques today (5%). 23 are out of scope for automated testing (social engineering, denial of service, physical).
+49 coming soonmore unlock with our internal pentesting agent, currently in private beta.
These counts are computed from the vendored MITRE ATT&CK graph and the published coverage map, and are reproducible from source.
In-scope techniques to emphasize
Emulate OilRig. Audit-Ready pentest, $99.
Finds nothing? Your next pentest is free. If a pentest surfaces zero actionable findings, we credit you a free re-pentest. Once per target; does not apply to retests or Recon. You always walk away with real findings or a free redo.
Launch this pentestFIN7 G0046
Relevance matchEnergy & UtilitiesAlso known as GOLD NIAGARA, ITG14, Carbon Spider, ELBRUS, Sangria Tempest.
TurboPentest can autonomously exercise 5 of 67 of this actor's documented techniques today (7%). 22 are out of scope for automated testing (social engineering, denial of service, physical).
+31 coming soonmore unlock with our internal pentesting agent, currently in private beta.
These counts are computed from the vendored MITRE ATT&CK graph and the published coverage map, and are reproducible from source.
In-scope techniques to emphasize
Emulate FIN7. Audit-Ready pentest, $99.
Finds nothing? Your next pentest is free. If a pentest surfaces zero actionable findings, we credit you a free re-pentest. Once per target; does not apply to retests or Recon. You always walk away with real findings or a free redo.
Launch this pentestUNC3886 G1048
Relevance matchEnergy & UtilitiesTurboPentest can autonomously exercise 4 of 62 of this actor's documented techniques today (6%). 15 are out of scope for automated testing (social engineering, denial of service, physical).
+35 coming soonmore unlock with our internal pentesting agent, currently in private beta.
These counts are computed from the vendored MITRE ATT&CK graph and the published coverage map, and are reproducible from source.
In-scope techniques to emphasize
Emulate UNC3886. Audit-Ready pentest, $99.
Finds nothing? Your next pentest is free. If a pentest surfaces zero actionable findings, we credit you a free re-pentest. Once per target; does not apply to retests or Recon. You always walk away with real findings or a free redo.
Launch this pentestThreat Group-3390 G0027
Relevance matchEnergy & UtilitiesAlso known as Earth Smilodon, TG-3390, Emissary Panda, BRONZE UNION, APT27.
TurboPentest can autonomously exercise 4 of 57 of this actor's documented techniques today (7%). 14 are out of scope for automated testing (social engineering, denial of service, physical).
+34 coming soonmore unlock with our internal pentesting agent, currently in private beta.
These counts are computed from the vendored MITRE ATT&CK graph and the published coverage map, and are reproducible from source.
In-scope techniques to emphasize
Emulate Threat Group-3390. Audit-Ready pentest, $99.
Finds nothing? Your next pentest is free. If a pentest surfaces zero actionable findings, we credit you a free re-pentest. Once per target; does not apply to retests or Recon. You always walk away with real findings or a free redo.
Launch this pentestmenuPass G0045
Relevance matchEnergy & UtilitiesAlso known as Cicada, POTASSIUM, Stone Panda, APT10, Red Apollo.
TurboPentest can autonomously exercise 3 of 46 of this actor's documented techniques today (7%). 7 are out of scope for automated testing (social engineering, denial of service, physical).
+31 coming soonmore unlock with our internal pentesting agent, currently in private beta.
These counts are computed from the vendored MITRE ATT&CK graph and the published coverage map, and are reproducible from source.
In-scope techniques to emphasize
Emulate menuPass. Audit-Ready pentest, $99.
Finds nothing? Your next pentest is free. If a pentest surfaces zero actionable findings, we credit you a free re-pentest. Once per target; does not apply to retests or Recon. You always walk away with real findings or a free redo.
Launch this pentestLAPSUS$ G1004
Relevance matchEnergy & UtilitiesAlso known as DEV-0537, Strawberry Tempest.
TurboPentest can autonomously exercise 6 of 43 of this actor's documented techniques today (14%). 11 are out of scope for automated testing (social engineering, denial of service, physical).
+21 coming soonmore unlock with our internal pentesting agent, currently in private beta.
These counts are computed from the vendored MITRE ATT&CK graph and the published coverage map, and are reproducible from source.
In-scope techniques to emphasize
Emulate LAPSUS$. Audit-Ready pentest, $99.
Finds nothing? Your next pentest is free. If a pentest surfaces zero actionable findings, we credit you a free re-pentest. Once per target; does not apply to retests or Recon. You always walk away with real findings or a free redo.
Launch this pentestFox Kitten G0117
Relevance matchEnergy & UtilitiesAlso known as UNC757, Parisite, Pioneer Kitten, RUBIDIUM, Lemon Sandstorm.
TurboPentest can autonomously exercise 3 of 41 of this actor's documented techniques today (7%). 6 are out of scope for automated testing (social engineering, denial of service, physical).
+29 coming soonmore unlock with our internal pentesting agent, currently in private beta.
These counts are computed from the vendored MITRE ATT&CK graph and the published coverage map, and are reproducible from source.
In-scope techniques to emphasize
Emulate Fox Kitten. Audit-Ready pentest, $99.
Finds nothing? Your next pentest is free. If a pentest surfaces zero actionable findings, we credit you a free re-pentest. Once per target; does not apply to retests or Recon. You always walk away with real findings or a free redo.
Launch this pentestAPT-C-36 G0099
Relevance matchEnergy & UtilitiesAlso known as Blind Eagle, TAG-144, AguilaCiega, APT-Q-98.
TurboPentest can autonomously exercise 2 of 38 of this actor's documented techniques today (5%). 20 are out of scope for automated testing (social engineering, denial of service, physical).
+12 coming soonmore unlock with our internal pentesting agent, currently in private beta.
These counts are computed from the vendored MITRE ATT&CK graph and the published coverage map, and are reproducible from source.
In-scope techniques to emphasize
Emulate APT-C-36. Audit-Ready pentest, $99.
Finds nothing? Your next pentest is free. If a pentest surfaces zero actionable findings, we credit you a free re-pentest. Once per target; does not apply to retests or Recon. You always walk away with real findings or a free redo.
Launch this pentestAPT33 G0064
Relevance matchEnergy & UtilitiesAlso known as HOLMIUM, Elfin, Peach Sandstorm.
TurboPentest can autonomously exercise 2 of 31 of this actor's documented techniques today (6%). 11 are out of scope for automated testing (social engineering, denial of service, physical).
+15 coming soonmore unlock with our internal pentesting agent, currently in private beta.
These counts are computed from the vendored MITRE ATT&CK graph and the published coverage map, and are reproducible from source.
In-scope techniques to emphasize
Emulate APT33. Audit-Ready pentest, $99.
Finds nothing? Your next pentest is free. If a pentest surfaces zero actionable findings, we credit you a free re-pentest. Once per target; does not apply to retests or Recon. You always walk away with real findings or a free redo.
Launch this pentestFrequently asked questions
Which threat actors are most relevant to Energy & Utilities organizations?
Based on MITRE ATT&CK sector relevance, the closest matches include APT28, Kimsuky, Sandworm Team. Relevance reflects documented targeting and tooling overlap, not a forecast that any specific group will act.
Is this a prediction that these groups will attack me?
No. This is a relevance match on your industry and technology stack against the MITRE ATT&CK group graph. It is computed deterministically from that data with no language model, and it is not threat-intelligence probability.
How does TurboPentest test for these actors?
It autonomously exercises the in-scope techniques these actors use (for example public-facing application exploitation, exposed remote services, and non-destructive credential testing), and it shows honestly how many of each actor's techniques are covered today versus which need the Adversarial-Depth tier or are out of scope.
What does it cost to test for Energy & Utilities threats?
An Audit-Ready pentest starts at $99 per target. If it surfaces zero actionable findings, your next pentest is free.
Reviewed by
Michel Chamberland, Founder & CEO of IntegSec. CISSP, OSCP, OSCE, with 20+ years in offensive security, alumni of IBM X-Force Red and Trustwave SpiderLabs.
Last reviewed July 30, 2026.