What happens when malware hits PV systems – SPE

March 19, 2026
Emiliano Bellini

This article, originally published in 2024, is being republished as part of our ongoing series on cybersecurity

A random malware variant targeted around 800 remote monitoring devices at ground-mounted PV installations in Japan in May, according to Japanese PV cybersecurity specialist Girasol Energy.

Although the incident caused no financial or technical damage to the solar installations, the malware used the systems as a springboard for fraudulent actions.

“The random malware installed a backdoor and illegally used online banking to steal funds. Once a backdoor is installed, a hacker can easily gain repeated unauthorized access without going through the normal authentication process,” Hiroyuki Ikegami, CTO of Girasol Energy, told reporters. pv magazinenoting that such incidents are more common than generally believed.

Ikegami explained that online cybercriminals often make random or automated attempts to turn vulnerable computers into members of botnets.

“Based on known vulnerabilities, attackers attempt to break into vulnerable computers and, if successful, install malware to create a backdoor on the computer,” he says. “Computers with backdoors are shared by attackers around the world – this is a botnet.”

He explained that once computers become part of a botnet, they are at the disposal of attackers. They can use compromised devices for a range of malicious activities, such as sending fraudulent emails or overloading servers with traffic to disrupt service in distributed denial-of-service (DDoS) attacks.

Ikegami said the malware targeted SolarView Compact SV-CPT-MC310 remote monitoring devices developed by Japan-based Contec. The company has since released an updated version of the product, which addresses all vulnerabilities involved in the incident. It has also told users to update their software.

Contec said in a press release that it found 19 vulnerabilities in SolarView between 2021 and 2023 and has issued patches since 2021 to address these issues. Japanese media reported that in the May 1, 2024 incident, the attackers used about 800 SolarView devices to conduct scams and steal money.

“This means that in about two to three years, 800 vulnerable SolarViews will no longer be maintained from a cybersecurity perspective,” Ikegami said. “Users did not apply these patches to SolarView and continued to deploy vulnerable SolarView directly to the Internet. This negligence led to the entire incident.”

Ikegami said details of how the incident was discovered remain unclear. However, based on reports linking it to money transfer scams, he believes the incident was likely uncovered during police investigations into the victims of the scam.

He warned that all remote monitoring devices connected to the internet are exposed to these risks if they are not properly protected by specialist cyber security companies.

“There is no assurance of protection if no one inspects the system and attacks like the one we saw in May could have legal consequences for PV plant owners, although the performance of the plants is not affected,” Ikegami said.

There have been no reported cases in Japan where unwitting botnet participants have been sued for damages related to such issues.

“However, there is a risk, and it is important for companies to respond appropriately, especially if the system needs to work with cybersecurity,” Ikegami said, noting that in this case it is more profitable for the attacker if the PV owner does not know about it. “It’s like using an empty house for illegal activities.”

Ransomware also poses a significant threat to production facilities and IT systems. As PV systems become a more important energy source, such attacks may become more common.

“The importance of PV systems will increase in the coming years, so system integrators must be particularly careful about ransomware and unknown future attacks,” said Ikegami.