Texas Electric Cooperative Ransomware: Why Co-ops Are in the 2026 Crosshairs

Why TX Electric Co-ops Are Now in the Ransomware Crosshairs

Five forces converged in 2025–2026 to make Texas electric cooperatives a priority ransomware target — not by coincidence, but by structural design. If you manage cybersecurity for a TX co-op and haven't mapped these five forces to your own exposure, you are operating blind.

1. Nation-state pre-positioning is confirmed and ongoing

Volt Typhoon — a PRC state-sponsored APT — has been inside U.S. critical infrastructure networks since at least 2021 using Living-off-the-Land (LOTL) techniques that generate no malware signatures. The FBI disrupted its KV botnet in December 2023 via court-authorized operation, but eradication is incomplete. CybelAngel confirmed in June 2026 that Volt Typhoon nodes have been revived and re-leveraged by mid-2024. CybelAngel, June 2026.

FBI Director Christopher Wray told the House Select Committee on Strategic Competition in January 2024: Volt Typhoon is "the defining threat of our generation." Congress.gov CRS IF12798. CISA's CI Fortify Initiative (2025–2026) was launched specifically to enable critical infrastructure to "operate offline during cyberattacks" — the scenario Volt Typhoon is designed to enable.

Sandworm — Russian GRU Unit 74455 — has been attributed by Mandiant to an April 2024 OT attack on a Texas water facility that caused a tank overflow. The same unit executed the 2015 and 2016 Ukraine blackouts (1.4M and 700K customer outages respectively). Cyber Defense Review, Army War College.

2. Co-op OT/IT exposure is structurally different from IOU exposure

Unlike an IOU with dedicated OT security teams and segmented network architecture, a typical TX distribution co-op operates with:

• The same control center for IT and OT functions
• 2–5 IT staff managing both corporate systems and SCADA environments
• The same corporate internet connection used for billing, email, and SCADA vendor support
• The same Active Directory forest for authentication across both IT and OT

Dragos Q2 2025 reported 101 ICS/OT ransomware incidents — Qilin was the most active group. The SimpleHelp RMM exploitation chain used by Qilin directly targets the consultant/PSA supply chain that co-ops depend on. Dragos Q2 2025. This is not theoretical: Karnes EC and San Bernard EC are confirmed victims.

3. Ransomware economics have shifted to co-op scale

Dragos Q1 2025 reported 80% of ICS/OT-targeting ransomware incidents targeted organizations with fewer than 1,500 employees. Resecurity / Dragos Q1 2025. A 30,000-member distribution co-op fits this profile perfectly: enough member PII to generate high-value extortion leverage, enough IT/OT convergence to create a credible grid-disruption threat, and typically enough security underinvestment to make initial access relatively easy.

4. NERC CIP-015-1 has created a compliance cliff with enforcement teeth

CIP-015-1 (Internal Network Security Monitoring) became effective September 2, 2025 for High/Medium Impact BES Cyber Systems. The standard mandates east-west traffic monitoring — detecting lateral movement inside the network, not just perimeter traffic. This is specifically designed to counter Volt Typhoon-style LOTL attacks. NERC 2025 enforcement is up 20% year-over-year; maximum penalty per day per violation reached $1.54M. ThinkPower Solutions.

5. TDPSA exemption is being confused with protection

TDPSA (effective July 1, 2024) explicitly exempts electric utilities. Bracewell TDPSA analysis. This exemption removes TDPSA breach notification obligations — but does not remove Texas Business & Commerce Code Chapter 521 obligations, NERC CIP-003 BCSI obligations, or the fundamental risk that member PII exfiltration creates. The exemption is a compliance simplification, not a threat reduction.

The 2023–2025 Utility-Sector Wave: Named Incidents and Dollar Impact

Volt Typhoon — Persistent Access Confirmed, 2021–2026

CISA AA24-038A confirmed Volt Typhoon compromised IT environments of multiple critical infrastructure organizations, primarily in Communications, Energy, Transportation Systems, and Water sectors. CISA AA24-038A. Early 2024: Littleton Electric Light & Water Departments (Massachusetts, small public utility) confirmed as first named Volt Typhoon OT network compromise — attackers maintained access for nearly a year via FortiGate CVE-2022-42475. Unit 42 Threat Brief.

"Volt Typhoon is the defining threat of our generation."

— FBI Director Christopher Wray, House Select Committee on Strategic Competition, January 2024

Delta-Montrose Electric Association (Colorado) — November 7, 2021

DMEA discovered breach on internal network; 90% of enterprise network functions lost. Lost 25 years of historical data (saved documents, spreadsheets, forms). Phone, email, payment processing, billing, and member account management systems down for weeks. Utility Dive | ZDNet. DMEA CEO: "a large percentage of smaller distribution-level electric co-ops are immune from cyber-attack since they don't use automation for their operational technology." This assumption is now demonstrably false — Karnes EC and San Bernard EC show it.

S16/Z-Pentest — TX SCADA Attack January 2025

Resecurity documented a confirmed cyber attack targeting SCADA systems at a Texas utility in January 2025, attributed to threat actors designated S16/Z-Pentest, with confirmed operational technology impact. Resecurity. Resecurity also documented an 80% year-over-year increase in energy sector cyber threats driven by geopolitical tensions.

Sandworm — Texas Water Facility OT Attack, April 2024

Mandiant confirmed Russian GRU cyber activity targeting a Texas water facility, causing system malfunction and a water tank overflow. This was not an IT system compromise — it was a direct OT attack using ICS/SCADA interaction. Cyber Defense Review, Army War College. The same GRU unit that executed the Ukraine blackouts.

Halliburton / RansomHub — August 2024

RansomHub ransomware at Halliburton caused $35M in losses (SEC 8-K confirmed). While Halliburton is upstream O&G rather than a distribution co-op, the attack chain — compromise of IT systems → attempt to pivot to OT → SEC disclosure of financial impact — is the template that ransomware groups are now attempting against smaller utilities.

Pedernales, CoServ, and Bluebonnet: Scale and the OT/IT Convergence Problem

Understanding the co-op landscape matters because scale creates specific attack surface patterns that generic MSSPs do not see.

SCADA and the Co-op OT Surface

Co-ops typically operate SCADA (Supervisory Control and Data Acquisition) systems for real-time grid monitoring, switching, and load management. Key attack vectors:

• Legacy SCADA protocols: DNP3, Modbus, and IEC 61850 were designed for reliability, not security — no encryption, no authentication on some legacy implementations. Discovery Alert.
• Remote access paths: Co-ops frequently rely on vendor-installed remote access paths for SCADA maintenance — dial-up legacy circuits still active, VPN tunnels maintained by third-party integrators. These are the primary Volt Typhoon and Sandworm entry vectors. CISA AA24-038A.
• IT/OT segmentation failures: FERC's 2025 Lessons Learned from CIP audits found entities operating DERs and transmission-connected BES generation from the same control center using the same personnel — violating CIP-002-5.1a physical segmentation principles. Industrial Cyber FERC 2025.
• Internet-connected PLCs: Iranian APT actors have directly targeted internet-connected PLCs (Rockwell Automation Allen-Bradley CompactLogix, Micro850) with intent to cause disruptions through project file manipulation and HMI display data manipulation. Industrial Cyber.

AMI Head-End Systems

Advanced Metering Infrastructure (AMI) head-end systems are the command-and-control center for smart meters, distribution automation, and prepay systems. Providers include Itron, Landis+Gyr, Honeywell, Oracle Utilities, and Tantalus. AMI attack vectors include head-end server compromise (remote disconnect/reconnect commands, interval data harvesting, firmware manipulation), mesh network infiltration (RF-based 900MHz FHSS vulnerable to replay attacks), and the billing system chain (AMI data flows to NISC/SEDC/Milsoft — a compromise chain from head-end to billing equals member PII exfiltration).

Member Portal Supply Chain

Co-op member portals are high-yield PII targets. Key providers:

• NISC SmartHub: Bluebonnet Electric Cooperative operates SmartHub (bluebonnet.smarthub.coop). NISC provides billing, CIS, member portal, and meter data management for hundreds of rural co-ops.
• SEDC / Milsoft: Provides billing, member portal, and outage management. Gulf Coast and South Texas co-ops. Daffron & Associates (now Milsoft) systems still in use at smaller co-ops — patched infrequently due to billing system stability requirements.
• Prepay metering: Co-ops offering prepay metering have additional attack surface — the prepaid balance system can be disrupted to cause service termination for thousands of members simultaneously.

NERC CIP, ERCOT, and TDPSA: The Regulatory Triple-Stack

NERC CIP-015-1: The New Standard That Changes Everything

Effective September 2, 2025, CIP-015-1 requires registered entities to implement Internal Network Security Monitoring (INSM) for High Impact and Medium Impact BES Cyber Systems with External Routable Connectivity (ERC). The standard mandates east-west traffic monitoring — detecting lateral movement inside the network, not just north-south perimeter traffic. Federal Register.

CIP-015-1 is specifically designed to counter Volt Typhoon-style LOTL attacks. The standard's requirements — flow collection, analysis, anomaly detection, incident response — require OT-aware technology that most co-ops do not have. Generic MSSPs cannot package compliance evidence for CIP-015 because they do not have OT-specific traffic capture. Darktrace INSM.

Why TX Co-ops Face a Triple-Stack

• NERC CIP: Applies to co-ops registered as Balancing Authority, Transmission Operator, or Distribution Provider with BES impact. For G&T co-ops (Brazos, Golden Spread, ETEC), CIP applies across the full chain.
• ERCOT context: ERCOT has no FERC jurisdiction over wholesale rates, but NERC registration still applies via TRE (Texas Reliability Entity). FERC ERCOT Overview.
• TDPSA: Exempts electric utilities — but Texas Business & Commerce Code Chapter 521 still applies. Mandatly TDPSA guide.
• RUS/USDA covenants: RUS loan agreements include cybersecurity covenants requiring documented programs, risk assessments, incident reporting, and business continuity planning. RUS Bulletin 1730-1.

IRS 501(c)(12) adds a fifth layer: a major uninsured loss not recovered through rates could degrade reserves, risk the 85% member income test, and trigger corporate tax liability — an underappreciated breach consequence.

Attack Vectors Specific to Co-ops: SCADA, AMI, Member Portals, Contractor VPN

The Co-op Attack Chain (Dragos-documented)

Compromise a co-op IT consultant's PSA tool (ConnectWise, Halo) → use legitimate RMM access to deploy payload inside co-op network → pivot to SCADA from inside the corporate LAN. This is the attack chain Dragos documented in Q2 2025. Dragos Q2 2025. KPMG 2024 analysis: nearly half of cyber breaches in the energy sector come from third-party platforms. Cooperative.com / KPMG 2024.

FERC 2025 Lessons Learned: Third-Party Cloud Compliance Risk

FERC's 2025 Lessons Learned document identified inadequate third-party vendor due diligence (CIP-003-8, CIP-006-6, CIP-010-4) and compliance risks associated with cloud services as top audit findings. Industrial Cyber FERC 2025.

The Voltage Typhoon Co-op Attack Path

1. Phish co-op CEO email → harvest cached credentials
2. Move laterally into corporate domain using LOTL tools (WMI, PowerShell, netsh)
3. Use same VPN credentials to access SCADA environment
4. Establish persistent OT foothold — no custom malware deployed, EDR sees nothing
5. Wait for grid stress event (storm, heat wave, ERCOT market anomaly)
6. Execute disruptive or destructive cyber activity

The Texas-specific signal: Volt Typhoon targeting included Texas and Guam specifically as pre-positioning for military/logistics disruption scenarios. CybelAngel.

Why a Generalist MSP Can't Cover a Co-op's Threat Surface

The IT/OT Gap

Generic MSSPs — including the major national providers co-op IT directors find when searching "managed security" — operate SOCs staffed primarily with IT security analysts. These analysts have no training on DNP3, Modbus, or IEC 61850 protocols, no tools for SCADA-specific traffic analysis, and no experience reviewing CIP-010 change management evidence or CIP-007 patch logs for control systems. An MSSP SOC that sees SCADA traffic in its SIEM will typically alert on it as anomalous or block it as suspicious — not recognize it as legitimate OT traffic.

The NERC CIP Evidence Gap

NERC CIP compliance is demonstrated through documentation: asset identification, change logs, incident response plans, security awareness training records, personnel risk assessments. Generic MSSPs do not know how to generate CIP-010-4 vulnerability assessment evidence from OT environments, package CIP-007 patch management documentation for SCADA systems (which cannot be patched on standard schedules due to operational constraints), document remote access controls for CIP-005 compliance, or prepare evidence for a TRE CMEP audit.

The 30-Minute SLA Gap

MSSP service level agreements typically specify 15–60 minute response times during business hours and 2–4 hour response times after hours. For a co-op in hurricane season or winter storm conditions, this is functionally useless. Grid events happen at 2am on a Sunday in December. An MSSP that cannot staff an analyst to respond until 8am the next business day has provided no protection during the window when damage is most likely to occur.

Pricing Benchmark

A 40,000-member distribution co-op with 200 endpoints (servers, workstations, OT interfaces) pays $17,800–$25,800/month for CoreRecon vs. $250,000+/year for a Big-4 NERC retainer alone.

What 30-Minute SOC Response Looks Like During an OT Incident

CoreRecon's 30-minute SLA is specifically designed for the co-op threat environment where incidents occur during weather events, after hours, and on weekends. The conditions that create the highest probability of attack (grid stress, staff distraction, communication disruption) are exactly the conditions under which most MSSPs cannot provide timely response.

The 30-Minute Window

The contrast: a generic MSSP with a 6-hour response SLA means the attacker has a 5.5-hour head start before the co-op even gets an analyst on the phone. For a co-op with a single IT staff member managing both billing systems and SCADA during a storm event, that gap is the difference between recovery in days and recovery in months.

The 5-Step Posture Assessment for TX Electric Co-ops

CoreRecon offers a no-cost 2-week posture assessment for qualifying TX electric cooperatives — delivered by SDVOSB team with ERCOT-native operational context. Here is what the assessment covers:

What You'll Receive

• OT asset inventory gap analysis against NERC CIP baseline
• AMI head-end and member portal exposure scan (external perspective)
• SCADA remote access path audit
• CIP-003/007/010/015 evidence readiness score
• Ransomware resilience score (backup integrity, RTO analysis)
• Written findings report with remediation priority ranking

CoreRecon is a Service-Disabled Veteran-Owned Small Business (SDVOSB). OT-aware SOC coverage for electric cooperatives and critical infrastructure. TX residency. 30-minute SLA. Contact corerecon@polsia.app or (800) 955-2596.