IEC 61850 digital substations replace hardwired copper with Ethernet-based protocols - GOOSE, Sampled Values (SV) and MMS - that were engineered for speed and interoperability, not security. None of these protocols authenticate or encrypt traffic by default, which means an attacker who reaches the right network segment can sniff GOOSE messages to map breakers, inject forged trip commands, replay captured fault data, or flood the process bus to blind protection relays. The security layer designed to fix this - the IEC 62351 series - exists, but a 2026 peer-reviewed study confirms it is "rarely fully implemented in real-world systems," leaving most substations defended mainly by network engineering rather than protocol security. The practical answer is a layered, defense-in-depth architecture: strict IT/OT segmentation, unidirectional gateways, protocol-aware intrusion detection, IEC 62351-6 where devices support it, continuous GOOSE/SV anomaly monitoring, and rigorous vendor remote-access governance. 

Why Substations - and Why IEC 61850 Specifically Became Priority Targets 

Walk into any substation built in the last decade and you will find something that would have been unrecognizable twenty years ago: an Ethernet architecture where protective relays, merging units and bay controllers exchange trip signals in milliseconds over fiber, not copper. That architecture is defined by IEC 61850, and it has delivered genuine operational wins - interoperability between vendors, faster protection schemes, remote engineering access, and dramatically lower wiring costs. It has also quietly dissolved the physical isolation that once protected substations by default. 

"Electrical substation infrastructures were not originally connected to external grids, which means they were not designed with cybersecurity issues in mind." 

That observation - from Stormshield's analysis of IEC 61850's security posture - remains the industry's central problem. Every message that once traveled down a dedicated, air-gapped copper pair now rides a shared, routable network. And the protocols carrying those messages make three assumptions that no longer hold: 

1. The network is trusted. GOOSE and SV frames carry no sender authentication, no encryption and no integrity checksum by default. 

   
   

2. Subscribers are legitimate. Any device on the multicast domain can publish frames that subscriber IEDs will act on. 

   
   

3. Speed beats security. Protection messages must arrive in 3 milliseconds or less. Cryptography historically couldn't meet that budget, so it was left out. 

The consequence: once an adversary gains a foothold anywhere in the substation LAN, the technical barrier to causing physical impact - opening circuit breakers, triggering false trips, blocking legitimate protection - drops to near zero. 

The State of Play in 2026: What the Latest Research and Incidents Tell Us 

Before diving into the threat mechanics, it's worth grounding this in what's actually happening right now, because the threat landscape for IEC 61850 substations has moved from theoretical to operational. 

1. "Living off the land" attacks against MMS are now demonstrated, not hypothetical 

In July 2026, researchers published a peer-reviewed Software-in-the-Loop study proving that an attacker with only local network access can execute a full attack chain over the IEC 61850 MMS protocol - the client/server protocol used for control, monitoring and engineering: 

• Reconnaissance by sniffing: The attacker passively captures GOOSE multicast traffic to extract Application IDs, GoIDs, Logical Device and Logical Node names (such as CSWI for switch control and XCBR for circuit breakers), then cross-references MAC addresses with ARP traffic to identify target IEDs. 

• Valid-command injection: The attacker opens a TCP session to port 102 on the target IED, sends a SelectWithValue request followed immediately by an Operate command - all using perfectly legitimate MMS services. 

• Physical effect: The circuit breaker opens, and the attacker confirms it by watching the stVal change in the GOOSE stream. 

No malware, no exploits, no zero-days. Just valid protocol commands sent by an unauthorized device. This is the defining characteristic of modern OT attacks: the protocol itself becomes the weapon. 

2. The Bremanger dam attack changed the OT threat calculus 

In 2025, attackers manipulated OT controls at a dam in Bremanger, Norway, opening floodgates and causing downstream flooding - an act Norwegian police attributed to a pro-Russian hacker group. Danish Defence Intelligence's 2025 threat assessment explicitly warns that critical infrastructure networks remain high-priority targets for exactly this kind of hybrid-warfare operation. 

For substation operators, the lesson is blunt: OT manipulation attacks are no longer rare demonstrations. They are an established state capability, and electrical grids sit at the top of the target list. 

3. The "Industroyer lineage" has matured into protocol-native malware 

The attack family that began with Industroyer (2016, Ukraine transmission substation via IEC 104) and evolved into INCONTROLLER/Pipedream - modular malware with dedicated modules for OPC UA, Modbus and IEC 61850 GOOSE/SV - established the template: reusable, protocol-native tooling that can target substations across vendors and geographies. INCONTROLLER's 61850 modules could discover IEDs, enumerate logical nodes and issue control commands - the same LOTL pattern confirmed by 2026 research. Any utility assuming their substation is too obscure to be worth tooling development should reconsider.

4. IEC 62351 was updated in 2026 - but adoption, not specification, is the bottleneck 

The IEC 62351 series (data and communications security for power systems) received a 2026 edition, and IEC 62351-6 continues to specify HMAC-based message authentication for GOOSE and SV. The specification is not the problem. The problem, consistently documented across vendor whitepapers, CIGRE studies and academic literature, is that: 

• Vendors implement IEC 62351 differently or only partially, breaking interoperability. 

• MAC computation adds latency that historically conflicted with the 3 ms protection budget, so operators disable it. 

• Key management (distributing and rotating symmetric keys across hundreds of IEDs from multiple vendors) is operationally painful and often quietly abandoned. 

A CIGRE 2026 study on digital substation threats puts it plainly: IEC 61850 protocols "lack robust authentication and encryption, making them susceptible to attacks like spoofing, replay" - and this remains true in deployed fleets even where the standard technically covers the gap. 

5. Even IEC 62351-compliant GOOSE can be attacked 

Perhaps the most uncomfortable finding in the research base: a rigorous vulnerability analysis of GOOSE (Sensors, 2021) tested the protocol with and without IEC 62351's SHA-256 HMAC scheme, using automated security-claim verification and hardware-in-the-loop simulation. Result: implementing IEC 62351 reduced attack surface, but falsified trip command injection still succeeded - because GOOSE multicasts the same information repeatedly, and insider attackers on the LAN retain multiple viable attack traces. Hardening the standard is necessary. It is not sufficient.

6. Research is also arming the defenders 

The defensive research frontier is moving quickly too: 

• Hybrid digital-twin datasets (IEEE DataPort, 2026) now provide labeled GOOSE/SV packet captures from a simulated 14-bus substation under both normal and adversarial conditions - including an "adversarial-aware" attacker that spoofs legitimate MAC OUIs and adapts state-number increments to evade detection. This is fueling machine-learning intrusion detection for substations. 

• Real-time mitigation techniques for IEC 61850/IEC 62351 substations were presented at CIGRE's 2025 Grid of the Future symposium, focusing on detecting and blocking coordinated attacks before they reach the automation system. 

• Automated cybersecurity testers (HIL testbed research) demonstrate that most commercial IEDs fail to detect sparse SV injection and coordinated multi-IED attacks in testing - a strong argument for procurement-driven security acceptance testing. 

7. Time synchronization is an underrated attack surface 

Digital substations depend on IEEE 1588 PTP for sub-microsecond synchronization of SV streams. Peer-reviewed research on PTP attacks against IEC 61850 substations (Electronics, 2023) shows that manipulating the time domain can desynchronize merging units and protection relays - causing differential protection misoperation and false tripping without a single malicious GOOSE or SV frame. GPS spoofing or jamming achieves a similar effect from outside the substation fence. Time is a protection input; treat it as a security asset.

Anatomy of an IEC 61850 Attack: The Threats That Matter 

Threat 1: GOOSE Spoofing and False Data Injection 

GOOSE is a Layer 2 multicast publish-subscribe protocol. A relay detecting a fault publishes a trip GOOSE; every subscribed breaker acts on it within milliseconds. Because frames are unauthenticated, an attacker who clones the publisher's MAC address can inject a forged GOOSE with an incremented state number (stNum, with sqNum zeroed) - the exact signature of a legitimate new event. Subscriber IEDs accept it and trip. 

Why it's dangerous: One frame can open a breaker. A burst of frames with manipulated Boolean data can trigger cascading misoperations across interlocking and breaker-failure schemes - with no exploit code required and tools as simple as Scapy and Wireshark. 

What most coverage misses: Semantic spoofing attacks that work within the protocol rules - e.g., manipulating tap-changer command sequences where individual GOOSE events are modified without violating timing windows - are stealthy precisely because they never break the letter of the protocol. 

Threat 2: Sampled Value (SV) Injection and Replay 

SV streams carry digitized current and voltage measurements from merging units to protection relays over the process bus at rates up to 4,800 samples/second. Inject manipulated SV frames containing fault-level currents, and overcurrent or differential protection trips on a fabricated fault. Replay a captured fault scenario, and protection re-operates on a non-existent event. 

Testing reality check: In hardware-in-the-loop studies using a 500 kV substation model, most commercial IEDs under test failed to detect sparsely injected fabricated SV packets and tripped their breakers anyway. Sparse injection - one malicious frame in thousands - is the pattern most likely to evade naive anomaly detection. 

Threat 3: MMS Control Command Abuse (the 2026 headline) 

As detailed above, rogue devices issuing legitimate Operate commands over MMS are the most operationally realistic threat today. MMS rides TCP/IP, so it crosses VLANs and can be reached from deeper in the network - including, via misconfigured gateways, from IT-side segments. This is the attack vector your CISO should be losing sleep over, because it requires no protocol exploitation at all. 

Threat 4: Denial of Service and Network Saturation 

GOOSE flooding at 40–85% of network capacity causes observable packet loss, missed retransmissions and desynchronized subscriber behavior. Because availability outranks confidentiality in substations (a blinded relay fails to trip on a real fault), DoS on the process bus is not an inconvenience - it's a protection failure with blackout potential. IEDs with limited compute are especially vulnerable to crafted high-volume traffic. 

Threat 5: Compromised Vendor Remote Access 

The most common real-world entry point isn't a firewall breach - it's a contractor laptop, a vendor maintenance session, or a temporary engineering connection left active after commissioning. Supply-chain compromise of a vendor with legitimate substation access collapses the entire kill chain: the attacker arrives already inside the OT subnet, skipping every perimeter control you paid for. 

Threat 6: Time Synchronization Attacks (PTP/GPS) 

Covered above - but worth repeating in any defense plan, because it is chronically underfunded relative to its impact. 

Threat 7: IT-to-OT Lateral Movement 

IEC 61850 substations are no longer islands. Engineering workstations, SCADA gateways, historian connections and asset-management systems create bridges from enterprise IT. Standard enterprise security assumptions (patch cadence, EDR coverage, identity hygiene) rarely hold in substation environments, and one phished engineering credential can become a process-bus foothold.

The Defense Blueprint: A Layered IEC 61850 Security Architecture 

No single control saves a digital substation. The answer is defense in depth, with each layer compensating for the others' blind spots. Here is the architecture we recommend, mapped to IEC 62443 zones and conduits and NERC CIP expectations. 

Layer 1: Architectural Segmentation (IEC 62443 Zones & Conduits) 

• Segment the substation into distinct security zones: station bus, process bus, engineering zone, and SCADA/gateway zone, with conduits enforcing least-privilege flows between them. 

  
  

• Deploy IEC 61850-3 certified industrial firewalls/gateways with deep packet inspection (DPI) that understands GOOSE EtherType (0x88B8), SV (0x88BA), MMS (TCP/102) and SNTP - not just port-based rules. 

  
  

• Use unidirectional gateways/data diodes for flows that should never return (e.g., historian export from OT to IT). Every bidirectional link is a lateral-movement bridge. 

Layer 2: Protocol-Level Hardening (IEC 62351, Applied Selectively) 

• Enable IEC 62351-6 HMAC message authentication for GOOSE and SV where IED hardware supports it within latency budgets - and validate end-to-end protection timing before enabling in production. 

  
  

• For MMS, enforce role-based access control, strong authentication and TLS where supported, and never allow anonymous associations. 

  
  

• Treat key management as a first-class operational process: centralized key distribution, rotation schedules, and documented ownership - most 62351 deployments die here, so plan for it explicitly. 

Layer 3: Network Engineering Controls 

• VLAN segmentation of traffic classes; unused switch ports disabled; port security and MAC limiting on IED-facing ports. 

  
  

• Rate limiting and storm control tuned to legitimate GOOSE/SV profiles so a flood attack degrades gracefully instead of catastrophically. 

  
  

• PRP/HSR redundancy considered for availability - but note redundant paths must be secured with the same rigor; redundancy you don't monitor is two attack surfaces. 

  
  

• Engineering access via jump hosts with MFA, session recording and time-boxed just-in-time credentials - never direct vendor laptops to IED subnets. 

Layer 4: Continuous OT Monitoring and Anomaly Detection 

This is where most utilities are weakest, and where 2026 research gives defenders new tools: 

• Baseline, then detect deviation. Profile every GOOSE publisher (APPID, dataset, stNum/sqNum cadence, retransmission curve) and every SV stream (sampling rate, smpCnt behavior). Deviations - spoofed OUI, impossible sequence jumps, unexpected publisher MACs, timing anomalies - are high-fidelity alerts in an environment as deterministic as a substation. 

  
  

• Deploy ML-assisted intrusion detection trained on digital-twin datasets that include adversarial-aware attack patterns; naive detectors are demonstrably evadable. 

  
  

• Monitor the time domain: PTP grandmaster health, holdover alarms, and GPS integrity alongside network telemetry. 

  
  

• Feed detections into incident-response playbooks that include physical operating procedures - because a confirmed GOOSE spoof during a storm is simultaneously a cyber event and a grid-reliability event. 

Layer 5: Asset, Vendor and Supply Chain Governance 

• Maintain a live inventory of IEDs, firmware versions and protocol capabilities - you cannot secure or patch what you haven't enumerated. IEC 61850 SCL files (ICD/CID) are a free asset inventory if you parse them systematically. 

  
  

• Contractually require security acceptance testing of IEDs before energization - including SV injection, GOOSE spoofing and coordinated attack scenarios (the testing methodology exists; make it a procurement deliverable). 

  
  

• Govern vendor remote access as a standing program: named accounts, session approval, full recording, and automatic expiry. The Bremanger lesson is that the adversary often arrives wearing a legitimate badge. 

Layer 6: Compliance Alignment - Without Compliance Theater 

• Map controls to NERC CIP (for North American entities), IEC 62443, and national equivalents (EU NIS2 increasingly covers energy OT). 

  
  

• Treat compliance as the floor, not the ceiling: CIP compliance alone would not have detected the LOTL MMS attack chain described above - behavioral monitoring would have. 

Latest developments (2025 to October 2026) 

Grid attacks have moved from IT disruption to device destruction. The Poland incident above is the clearest recent example. Alongside the 2015 Ukraine attack, where attackers used stolen credentials and VPNs to remotely open breakers at substations (Hitachi Energy's recent summary counts 30 substations offline and roughly 225,000 customers affected), it shows two different playbooks: operate the grid, or break the devices that operate it. Defenders need plans for both. 

Substation protection relays are a steady stream of advisories. 

• In September 2026, Siemens published advisory SSA-142885 and CISA republished it as ICSA-26-258-05 for Reyrolle 7SR5 protection relays. The most severe flaw, CVE-2026-62645 (CVSS 9.8), is an authentication bypass in the web interface that lets an attacker derive valid session identifiers. The fix is firmware V2.70 or later. Reports indicated no known exploitation at publication, but the attack path is network-based and needs no credentials. 

  
  

• CISA also published ICSA-26-169-07 covering a vulnerability across Schneider Electric Easergy, EcoStruxure and PowerLogic products, including Easergy MiCOM protection relays and substation controllers. Pull the vendor's CSAF file and compare it to your asset inventory instead of reading PDFs by hand. 

The common thread is the management plane. Web interfaces, engineering ports and gateways on relays are often forgotten when teams think about 61850 traffic.

Regulation is catching up with the station bus. 

• NERC CIP-015-1 introduces enforceable internal network security monitoring (INSM) inside electronic security perimeters, covering east-west traffic. Dragos reports an effective date of October 1, 2028, with CIP-015-2 expected to extend coverage to systems such as EACMS and PACS outside the ESP. 

  
  

• India's Central Electricity Authority (Cyber Security in Power Sector) Regulations, 2026 were published in the Gazette on July 31, 2026, take full effect on April 1, 2027, and replace the 2021 guidelines. They require a CISO and a 24/7 information security division, strict segregation of OT from IT and the internet, remote access to critical assets only for emergency troubleshooting with MFA and logging, and reporting of incidents to CSIRT-Power and CERT-In within six hours (24 hours for cyber sabotage of critical systems). Vendors face obligations too, including digitally signed patches and a bill of materials. 

  
  

• Recent reporting also notes that small utilities and distributed generation often fall outside the strictest rules while still being targeted, which is relevant if you operate sites below regulatory thresholds. 

A defense architecture that holds up in a real substation 

No single control secures an IEC 61850 substation. The pattern that works is layered, and it maps well to the NIST CSF functions. 

The CISO's 90-Day Action Plan 

If you run substations today, prioritize in this order: 

1. Days 1–30 - Visibility: Passive asset discovery and GOOSE/SV baseline capture across all substations. No agents, no risk to protection - just listen. 

   
   

2. Days 30–60 - Access: Lock down vendor remote access (JIT, MFA, recording). Audit every standing account and firewall rule between IT and OT. 

   
   

3. Days 60–90 - Detection: Deploy protocol-aware anomaly detection against your baselines; run a tabletop exercise using the MMS LOTL scenario in this article as the inject. 

   
   

4. Quarter 2 - Validation: Commission independent attack-simulation testing (SV injection, GOOSE spoofing, PTP manipulation) against representative IED fleets before attackers do it for you. 

Frequently Asked Questions 

Is IEC 61850 secure by design? No. IEC 61850 was designed for interoperability and deterministic real-time performance. Security mechanisms were intentionally deferred to the companion IEC 62351 series, which remains incompletely and inconsistently deployed in real fleets. 

What is the difference between GOOSE and MMS attacks? GOOSE/SV attacks happen at Layer 2 (Ethernet multicast, within the substation LAN, sub-millisecond timing, no TCP/IP) and directly target protection behavior. MMS attacks ride TCP/IP and target control, monitoring and engineering functions - making them reachable from deeper network segments and, in practice, easier for attackers to reach. 

Does implementing IEC 62351 make my substation safe? It materially reduces risk for spoofing and replay, and you should implement it where device support and latency budgets allow. But peer-reviewed testing shows IEC 62351-compliant GOOSE remains vulnerable to certain injection patterns, so 62351 must sit inside a layered architecture - segmentation, monitoring, access governance - rather than serve as the whole defense. 

What happened at the Bremanger dam in 2025? Attackers manipulated OT controls to open floodgates, causing downstream flooding. Norwegian authorities attributed the attack to a pro-Russian group. It is widely cited as the watershed incident proving that OT manipulation is now an operational capability of state-aligned actors, not a theoretical risk. 

Are digital substations more vulnerable than conventional ones? They have a larger cyber attack surface - more networked devices, routable protocols and remote access paths. The compensating advantage is full network visibility: every trip decision leaves a packet trace, which a properly instrumented substation can use to detect attacks that would be invisible in hardwired yards. 

Final Word 

IEC 61850 made substations smarter, faster and interoperable. It did not make them secure - and the events of 2025–2026, from demonstrated living-off-the-land MMS attacks to physical OT sabotage at the Bremanger dam, have removed any remaining ambiguity about who is interested in this attack surface and what they can do with it. The utilities that fare best in the next decade won't be the ones with the most certificates of compliance; they'll be the ones treating every GOOSE stream, every vendor session and every PTP packet as a security signal worth watching. 

At Shieldworkz, we build end-to-end OT cybersecurity for exactly this reality - asset visibility, protocol-aware monitoring, IEC 62443-aligned architecture, attack simulation, and managed detection tuned to IEC 61850 substations, SCADA and industrial IoT environments. Because the breaker doesn't care whether the command that opened it was legitimate - and your defenses have to catch the difference.