CoreRecon Threat Intelligence  •  Texas Multi-Utility Operators  •  August 2026 V53

TX Utilities (Multi-Utility):
NERC CIP / AWIA RRA / TX PUC §25.367 / CIRCIA / Volt Typhoon

Volt Typhoon has pre-positioned inside U.S. energy + water infrastructure since 2021 (CISA/NSA Joint Advisory AA24-038A). Muleshoe TX water tank overflow (Jan 2024, CyberArmyofRussia, exposed Unitronics PLC). Halliburton TX $35M RansomHub (Aug 2024). Brazos Electric $2.1B Ch.11 (2021+ cascade). City of Dumas TX ransomware (Nov 2024) hit SCADA water + electric. Texas multi-utility operators face NERC CIP-002–014, AWIA §2013 RRA / ERP (5-yr cycle), TX PUC §25.367 96-hr, and CIRCIA 72-hr reporting simultaneously — with Volt Typhoon's AMI / SCADA / GIS / customer-portal attack surface.

Download the Full Threat Brief — Free
August 2026 CoreRecon Intelligence Report V53 NERC CIP + AWIA + TX PUC §25.367 + CIRCIA + TDPSA 60+ Verified Sources
96hr
TX PUC §25.367
cyber-incident clock
PUCT notice required
$35M
Halliburton TX
RansomHub recovery
Q4 2024 10-K
5/5
Panhandle TX
water-tank Unitronics
PLCs compromised
3,300+
AWIA §2013
RRA / ERP trigger
population served
30min
CoreRecon IR SLA
CIP-008 clock-work
SDVOSB certified
What This Brief Covers

TX Multi-Utility Operators
Cyber Threat Brief

Full intelligence report on the attack surface facing Texas multi-utility operators — from the Muleshoe TX water-tank overflow (CyberArmyofRussia Unitronics PLC, Jan 2024), Halliburton TX $35M RansomHub (Aug 2024), Brazos Electric $2.1B Ch.11 (cascade baseline), and City of Dumas TX ransomware (Nov 2024, SCADA water + electric) to the CISA/NSA-confirmed Volt Typhoon IT/OT pre-positioning (AA24-038A), the NERC CIP-002 through CIP-014 stack (CIP-008 IR plan + CIP-014 physical security + CIP-013 supply-chain), AWIA §2013 RRA + ERP 5-yr cycle, TX PUC Substantive Rule §25.367 (96-hr), CIRCIA 72-hr reporting, TSA SD-Pipeline-2021-01D (gas LDCs + LNG), 49 CFR Part 192/195 (gas distribution + transmission), TDPSA §541 (utility customer PI), and the AMI headend / SCADA recloser / GIS / customer-portal BEC / shared-MSP attack surface. Coverage built for MUDs, special utility districts, gas local distribution companies (LDCs), small electric IOUs, multi-utility OES firms, water utilities serving 3,300+ (AWIA scope), and NERC-registered entities across TX.

60+ Verified Sources Including:

  • Volt Typhoon — CISA/NSA Joint Advisory AA24-038A (Feb 2024) on U.S. energy + water IT/OT pre-positioning since 2021
  • Muleshoe TX — Jan 2024 water-tank overflow, CyberArmyofRussia Unitronics PLC; same actor hit Lockney/Tulia/Abernathy/Hale Center
  • Halliburton TX — $35M RansomHub (Aug 2024), Q4 SEC 10-K; OT/IT convergence risk validated; shared-MSP cascade pattern
  • Brazos Electric — $2.1B Ch.11 (2021 + aftermath cascade); baseline for NERC CIP-008 IR plan + TX PUC §25.367 narrative
  • City of Dumas TX — ransomware (Nov 2024) hit SCADA water + electric; SCADA-fallback + customer-portal-credential playbook
  • TX Rio Grande Valley gas LDC — phishing + ACH wire diversion (2024); customer-portal BEC pattern baseline (Anchor 5)
  • NERC CIP-002 through CIP-014 — CIP-008 IR plan + CIP-014 physical security + CIP-013 supply-chain + CIP-005 ESP
  • AWIA §2013 (42 USC §300i-2) — RRA + ERP 5-year cycle; water systems serving >3,300; EPA RRAN-aligned
  • TX PUC §25.367 — 96-hour cyber-incident clock to PUCT; concurrent with CIRCIA 72-hr CISA clock for NERC-registered entities
  • TSA SD-Pipeline-2021-01D — top 100+ gas LDCs + LNG; smaller TX LDCs exempt but 49 CFR Part 192/195 still applies
  • TDPSA §541 — utility customer billing + usage data enumeration; §521.053 breach-notification trigger
  • 8 multi-utility-specific controls + 30/60/90-day CIP-008 / AWIA RRA / TDPSA roadmap + Sentinel/Fortress/Command tier fit for 25–500 endpoints

Access the Full Brief

We email it as a PDF attachment. No newsletter. No spam. One delivery.

We use the contact details you provide to deliver this brief and respond to your request. Please do not include patient, client, account, case, or other sensitive information in this form.

Submission failed — please try again or email john@corerecon.com

Brief Sent.

Check your inbox — the PDF is on its way. If it lands in spam, drag it to your inbox so you find it later.

Want it immediately? Download below — we already emailed a copy.

Download PDF Now → Book Free Assessment →

Questions before then? Call (800) 955-2596 — live TX SOC, not a call center.

SDVOSB Certified • TX-Based SOC • No offshore data routing
Questions? (800) 955-2596
✅ 60+ verified sources
✅ NERC CIP-002–014 + AWIA + TX PUC §25.367 + CIRCIA + TDPSA covered
✅ 8-control multi-utility-mapped coverage
✅ 5 named multi-utility anchors: Muleshoe, Halliburton, Brazos, Dumas, TX Rio Grande Valley LDC
✅ 30/60/90-day triple-clock parallel-narrative roadmap