Stealing administrative credentials to carry out months-long spy campaigns is a top threat.

Link: https://threatpost.com/utilities-energy-sector-attacked-mainly-via-it-not-ics/138733/