There are a number of potential suspects, but my feeling is that if there are no arrests in 72 hours you can expect a bunch of copycat attacks. Substations are very poorly secured, and targeting them to cause power outages and provoke crises and riots in cities is a central plank of accelerationist guerrilla war fantasies. 'How it would go down' scenarios that hand-wave the details are widespread, and how-to instructions with varying degrees of specificity are eagerly circulated smaller extremist forums. These range from 'fun and profit' type onesheets that would would get a careless individual caught to quite professional ones suitable for (and probably derived from) military educational materials.
BTW it's 'ringer'.