R2D2 tools and activities: updated by HEDNO

R2D2 tools and activities: updated by HEDNO

HEDNO recently participated in an insightful workshop held in Ljubljana, focusing on the critical issue of grid resilience against extreme weather events. This event marked a significant collaboration between HEDNO and its partners, ETRA, ICCS and UCY.

ETRA is leading the development of the EMMA – GIMAN tool, an innovative solution that contributes to the reliability of the physical assets and to expedite a faster grid recovery. Meanwhile, ICCS and UCY play a key role in developing the C3POtool, which is crucial for simulating the cascading effects of extreme weather events on the grid infrastructure.

The workshop focused on the synergistic communication between these two innovative tools, showcasing their potential in mitigating the impacts of weather-induced disruptions. HEDNO’s role was crucial, as the organization provided vital insights into the data requirements necessary for the effective operation of both EMMA – GIMAN and C3PO tools.

HEDNO also participated in another critical workshop with S2 partner regarding the potential deployment of CARMEN tool in HEDNO’s premises. CARMEN is a threat hunting tool specialised in analysing traffic, detection of anomalies, fighting Advanced Persistent Threats (APT) and zero-day vulnerabilities by using machine learning.

While the discussion was in its early stages, the outcome was very fruitful, mostly involving potential VM requirements for the host of the CARMEN tool, server and hypervisor specs, the established communication protocols specialised in traffic analysis , the data volume and frequency that will be made available for analysis, the use of syslog for information displayed,  as well as potential challenges to be aware of for the effective use of the tools.

HEDNO has already proceeded with equipment installation on the pilot site infrastructure for the scope of the R2D2 Project. Technologies, which have already been installed on the pilot, are the following ones:

Surveillance cameras at HV/MV substation for protection against physical attack

HEDNO has already successfully proceeded with the procurement and installation of 4 CCTV cameras, which have been installed on Magiko HV/MV substation. All CCTVs have been presented to partners during the 2nd R2D2 plenary meeting, which was held in Xanthi in June 2023. CCTVs are expected to contribute to physical substation security, by providing real time images to EMMA product, which will conduct image analysis, followed by possible alerts to the DSO.

Thermal camera at HV/MV substation

A thermal camera has already been procured by the local department of HEDNO, which will be used for both infrastructure inspection in parts of the aerial distribution network, as well as for inspection in certain parts of Magiko HV/MV infrastructure.

Re-usability of past EU Projects’ equipment

9 SLAM metering devices installed on HEDNO Xanthi premises during X-FLEX Project, will also be part of R2D2 Project, as data from those high-frequency metering devices are expected to contribute to C3PO algorithms and energy data tokenization on the edge.

5 AMI devices installed on certain MV/LV substations in the pilot site during X-FLEX Project, are expected to share data to C3PO algorithms during the R2D2 Project.

HEDNO successfully organized the 2nd R2D2 Project plenary meeting, which was held in Xanthi city during 07-08 June 2023. The purpose of the meeting was twofold:

The first day was dedicated to partners’ presentations around the Project progress, where all pending issues were successfully discussed.

Another day was dedicated to the Xanthi pilot visit, so as all participants could be informed about the technologies and infrastructure utilized from HEDNO, for the scope of the Project.

Firstly, a visit to the local department of HEDNO took place, where the basic HW infrastructure, such as SCADA system was presented, followed by an on-site demonstration of assets that were installed in the pilot, such as SLAM metering devices and AMI in a secondary underground substation.

Furthermore, an on-site visit to Magiko HV/MV substation was scheduled, where the basic infrastructure of the primary substation of the pilot was shown, followed by a demonstration of the 4 CCTVs installed in the perimeter of the substation building.

Further information:


This project has received funding from the  European Union’s Horizon Europe research and innovation programme under grant agreement No 101075714.

Unlocking the Power of Threat Hunting in OT Environments

Unlocking the Power of Threat Hunting in OT Environments

In today’s ever-evolving digital landscape, industrial systems and critical infrastructures are more exposed than ever to cyber threats. Since the arrival of the Industry 4.0 paradigm, both Information Technologies and Operational Technologies (IT and OT) coexist, and APT groups and cybercriminals take advantage of vulnerabilities in either of these two technologies to cause damage to these industrial infrastructures or to the society itself, which relies on them.


Threat hunting is a complex process carried out by cybersecurity experts to detect the presence of the above-mentioned Advanced Persistent Threats (APTs). This process usually entails inspecting network traffic, analyzing user and application logs, and correlating all that heterogeneous information in search of indications of the presence of any threat or potential vulnerability in the system.

CARMEN, the tool developed by S2 Grupo in collaboration with Spain’s National Cryptologic Centre to identify compromises by APTs, is one of the tools cybersecurity experts can use in the threat-hunting process. CARMEN covers both IT and OT traffic, providing comprehensive threat visibility that enables early detection of vulnerabilities and anomalies in industrial control systems. Proactive threat detection in OT environments enhances overall security, improves incident response, and minimizes operational disruptions. Furthermore, it enhances asset visibility, inventory management, compliance adherence, and cost reduction. Ultimately, this adaptation future-proofs security measures, ensuring the safeguarding of critical infrastructure in our ever-evolving digital landscape.


As part of the R2D2 project, S2 Grupo has begun expanding CARMENs capabilities for analyzing OT traffic by developing new capabilities for data ingestion and threat detection. These developments will include the creation of new specific protocol dissectors for CARMEN, such as MQTT, ICCP 60870-6/TASE.2, IEC 60870-5-104, or Modbus, as well as new pre-processing and aggregation capabilities to reduce the amount of information to be processed and its inner variability. These developments will enhance CARMEN’s ability to carry out a more in-depth analysis of network traffic at different levels and to improve its detection capabilities, including both signature-based and anomaly-detection-based methods.

Additionally, new capabilities aimed at APT and zero-day threat detection using Machine Learning techniques are being developed for CARMEN within the scope of R2D2. This approach is based on modeling and characterizing tactical and operational intelligence, allowing for the comparison of suspicious actions. This way, APT groups can be clustered based on the tactical and operational intelligence they employ when attacking a system. As a result, when anomalous behavior is observed and detected, it’s possible to match this behavior against each APT group cluster, assess the possibility of being under an attack carried out by one of the APT groups in these clusters, and raise an alert. Furthermore, this approach allows for alerting cybersecurity analysts about other actions typically associated with these APT groups so that they can search for any of these actions if they haven’t been noticed before or be prepared for the next stages of the attack.

This developmental milestone and new feature have received substantial acclaim, especially at events like the Navaja Negra Conference, held in Spain in October 2023. The enthusiastic approval from both attendees and experts underscores the significance of this advancement in threat-hunting technology.

Further information:

Ugo Stecchi (Project coordinator)

This project has received funding from the  European Union’s Horizon Europe research and innovation programme under grant agreement No 101075714.