The project finance team of an energy generation company received a progress-payment request from the EPC contractor of an ongoing solar (SPP) investment: "Pay this month's progress payment to the updated account attached — our consortium structure has changed, payments now run through this account." The project reference, the progress line item, the amount — all matched the contract. Consortium and SPV (special-purpose vehicle) structures changing is ordinary in energy projects; the team prepared the payment. A seven-figure sum went not to the real contractor but to the attacker's account.
Energy is both a high-yield and a multi-layered target for email attackers: project-based, seven-to-eight-figure progress and equipment payments; a complex payment chain of EPC contractor, consortium, SPV, and suppliers; a critical-infrastructure structure where OT (operational technology) and IT cross; and regulatory (EMRA) obligations. In this article we cover the sector's threat vectors and defense.
1. Why Does the Energy Workflow Produce a High-Risk Surface?
- High-value project payments: Solar (SPP), wind (WPP), hydro, and gas plant projects; equipment purchases like turbines, panels, transformers. A single progress or equipment payment can be seven-to-eight figures — a large one-shot return for the attacker.
- Complex payment chain: EPC contractor, subcontractors, consortium partners, SPVs, international equipment suppliers. This many-link structure makes "our structure/account has changed" stories natural.
- OT/IT crossover and critical infrastructure: Energy is national critical infrastructure. Compromising an office email account can be not just financial; it can be a bridge to SCADA/OT networks, the first step for targeted espionage or sabotage.
- Regulatory framework (EMRA) and long-term contracts: High visibility, long project timelines, and many official communications; both intelligence and impersonation opportunity for the attacker.
2. The Four Threat Vectors We See in the Sector
2.1 Progress-Payment Redirection
The opening scenario and most expensive vector. An EPC contractor or consortium partner is impersonated/compromised; at the moment of a progress payment, a "our consortium/SPV structure changed, new account" request is dropped into the genuine conversation. Because structural changes really are frequent in energy projects, this story is especially believable. The size of the amounts makes a single successful attack very profitable.
2.2 Equipment Supply Fraud
Bank changes on international supplier proformas for high-value equipment like turbines, solar panels, transformers, cables. Foreign currency, cross-border, hard to recall. Project-deadline pressure ("if the equipment doesn't arrive, the site stops, penalties apply") melts verification — the mechanism from our machinery and aluminum articles, at energy scale.
2.3 Critical-Infrastructure Espionage and the OT Bridge
The energy-specific and most dangerous dimension. An office account compromised via targeted phishing/ATO can provide access to critical data like project plans, grid connection details, SCADA documentation, or a bridge for lateral movement into the OT network. Here the goal may be not money but intelligence or sabotage — it's a known fact that state-sponsored actors target critical infrastructure. DLP on outbound traffic and internal-traffic visibility are the antidote to this vector.
2.4 Official-Authority / EMRA Impersonation
Emails impersonating the regulatory authority, the grid operator, or an official body, themed "license update," "urgent notice," or "penalty notification." Official-looking urgency directs the employee to a malicious attachment or a fake portal; credentials are harvested.
3. Field Note: The "Structure Change" Normality and the Dual-Purpose Risk
Two patterns stand out in the energy field. First: consortium/SPV/shareholder structure changes are so ordinary that a "our payment account has changed" request goes almost entirely unquestioned — structural complexity is the attacker's greatest ally. Second and more serious: an email incident in energy is a dual-purpose risk — the same compromised account can both steal a seven-figure payment and serve as an intelligence bridge to critical infrastructure. That's why email security in energy carries not just a financial but a national-security dimension.
4. Defense: Three Layers Worthy of Critical Infrastructure
Process
For progress, equipment, and project payments, an account/structure change — whatever the justification (consortium, SPV, shareholder change included) — is not processed without confirmation with the authorized person recorded in the contract, via a call-back to a registered number. A dual-authorization mechanism is added for high-value payments. These rules are written into the project finance procedure and EPC contract riders.
Technology
Check Point Harmony Email & Collaboration provides the following in energy scenarios:
- Look-alike and newly registered domain detection — flags EPC contractor, consortium partner, supplier, and official-authority impersonation.
- Correspondence-pattern learning — contextually catches the "structure/account change" combination in the progress-payment window.
- Attachment analysis (sandboxing), click-time URL protection, and advanced threat prevention on targeted phishing/espionage emails.
- Account-takeover protection and internal-traffic visibility — catches early the account compromises that could bridge to critical infrastructure.
- DLP — blocks project/grid/SCADA documentation from leaving policy-out in outbound traffic (see our DLP article).
People
Sector-specific simulations for project finance, procurement, and operations teams: a fake progress-payment account change (with a structure-change story), an equipment proforma, EMRA/official-authority impersonation. The rule to embed: "Structural complexity is not a reason to skip payment confirmation — on the contrary, it's the reason that makes it mandatory."
Frequently Asked Questions
Our consortium/SPV structure really does change often — how do we confirm each time?
Confirm not the change itself but the payment account: even if the structure changes, the new payment account is verified with the authorized person recorded in the contract, through a registered channel. A real structural change withstands this confirmation; only the fake one depends on the information in the email.
Our real concern is OT/SCADA security — why is email a priority?
Because most targeted attacks on critical infrastructure start not directly through OT but through IT — usually with a phishing email or a compromised office account. The email layer is the first and weakest link of the bridge to OT; strengthening it is part of OT defense.
We already have dual authorization on high-value payments — isn't that enough?
Dual authorization is a strong control, but if both approvers see the same fake email, both can fall into the same error. The technical layer (look-alike detection, behavioral analysis) and confirming the account change through a separate channel complement dual authorization; one doesn't replace the other.
Can we measure what our current protection misses in these scenarios?
Yes. In a 14-day monitor-mode trial, we report what's missed — progress-payment redirection, supplier/authority impersonation, and targeted phishing included — without touching your existing protection.
What Should You Do Now?
If you manage high-value project payments and operate critical infrastructure, one question: "Would a fake progress-payment account change in an EPC contractor's name, or a targeted espionage email, be caught by our system and our process?"
- Free Field Audit: Your own impersonability (DMARC), look-alike domain risks, and targeted-phishing surface — reported.
- 14-Day Check Point Trial (monitor mode): Missed threats in inbound and outbound traffic, reported.
About this article: The eleventh article of our Sector Series. Kinetik Bilişim is the Türkiye partner of Check Point Software Technologies at the Advanced Partner 2026 level, holding Email, Endpoint & Browser, Mobile, and SASE Solution Specialization accreditations. The author, Kemal Özleyen, is a cybersecurity engineer certified as a Check Point Workspace Security Expert. Field scenarios are shared in anonymized form.
