Unified Kill Chain Model for Executing MITM Attacks in Microgrids with DERs

The increasing integration of networked Distributed Energy Resources (DERs) into microgrids is expanding the attack surface of modern power systems, particularly in decentralized environments. This paper explores the use of the Unified Kill Chain (UKC) framework to model and execute a Man-in-theMiddle (MITM) attack in a microgrid, focusing on the various stages of the attack, from reconnaissance to the final impact on the Microgrid Energy Management System (MEMS). By leveraging the UKC, the study demonstrates how sophisticated attackers can exploit vulnerabilities in communication protocols like Modbus to manipulate critical parameters, such as the battery state of charge (SoC), leading to erroneous decision-making and undermining the operational reliability of the microgrid. The paper underscores the need for targeted defensive actions at each stage of the attack chain to detect, mitigate, and neutralize the intent of advanced persistent threats (APTs) against DER systems.