Dynamic Load Altering Attacks on IoT-Enabled EV Chargers: A Real-Time HIL Co-Simulation Study

Modern Electric Vehicles (EVs) and their charging points (CPs) function as Internet of Things (IoT) nodes embedded in the distribution grid: they continuously sense local electrical conditions, exchange real-time data with the Charging Station Management System (CSMS) via the Open Charge Point Protocol (OCPP), and adjust their power consumption in response to remote commands. This dual role as both a controllable load and a networked sensor makes EV charging infrastructure a high-value target for cyber–physical attacks. This paper investigates the impact of open-loop multi-point Dynamic Load Altering Attacks (D-LAAs) carried out by exploiting this IoT interface on a modified IEEE 13-node distribution feeder hosting twenty CPs at one node. A high-fidelity cyber–physical co-simulation testbed is proposed, coupling a real-time Hardware-in-the-Loop (HIL) power grid model implemented in MATLAB/Simulink and deployed on an OPAL-RT OP4512 platform via RT-LAB, with an emulated ICT network running in Mininet on Ubuntu 22.04. OCPP 1.6 over WebSockets governs CP-CSMS communication, while a TCP/IP interface links the two simulation domains. Two attack scenarios are studied: a coordinated step attack, in which all CP setpoints are first driven to zero and then forced to maximum power (120 kW), and a periodic modulation attack, in which setpoints are rapidly alternated between zero and maximum. Voltages are evaluated at three nodes with varying topological distances from the attack point. In both scenarios, voltage drops reach up to 3.74%. This violates standard voltage-quality margins, demonstrating that corrupting the IoT sensing-and-actuation layer of EV fleets is sufficient to threaten distribution grid stability and underscoring the need for dedicated anomaly-detection and mitigation strategies.