Enhancing cyber resilience of high-renewable power systems: Threat pathways and targeted countermeasures
High integration of Renewable Generation Units (RGUs), such as photovoltaic panels and wind turbines, is transforming modern power systems while also creating new cyber-attack surfaces due to the widespread adoption of Internet of Things (IoT) technologies. Understanding this emerging threat and its underlying impact mechanisms is essential for developing effective cyber-defense methods. This study presents MRGIoT (Manipulation of Renewable Generation via IoT botnet), a framework designed to evaluate which RGUs are most significant to the supply-demand balance and potentially capable of causing grid disruption. The framework focuses on the manipulation of RGU active power and leverages publicly available topology and operational data to identify high-value targets based on node degree and regional load density. Extensive simulations on the Texas grid model and the North Island power system (NIPS) of New Zealand show that RGUs located at high-degree nodes or in regions with high load density can trigger notable demand loss, especially during peak-load periods. These areas therefore represent priority targets for security reinforcement, infrastructure concealment, and operational safeguards. In contrast, RGUs with active power generation below certain thresholds, specifically 20 MW on the Texas model and 4 MW on the NIPS, exhibit limited system-scale impact even when placed at highly vulnerable grid locations. As renewable penetration rises and IoT adoption deepens, these findings provide clear and actionable guidance for strengthening the security and resilience of future net-zero power systems.