Federated learning (FL) enables collaborative local training of forecasting models for distributed energy resources (DERs), thereby safeguarding the original energy data from exposure, which may contain user privacy or business secrets. However, traditional FL for DERs forecasting faces two significant challenges: (1) DERs data is typically non-independent and identically distributed (non-IID), leading to poor forecasting performance. To address this issue, recent research has explored clustering FL. However, existing approaches often require clients to submit data for centralized clustering, ignoring privacy protection of clustering data. (2) DERs clients are vulnerable to Byzantines attacks. We propose a novel FL framework for DERs forecasting, named Clustered Federated Learning with an Intra-cluster Cross-validation mechanism (CFL-ICCV), to enhance both accuracy and security while preserving the data privacy of DERs clients. Within CFL-ICCV, DERs clients engage in distributed clustering by secret sharing, eliminating the need to submit original data. The ICCV mechanism ensures that local updates are validated by clients not participating in the current training round, allowing the identification and removal of malicious local models. Additionally, we design a parallel mode for ICCV, significantly reducing its associated overhead. Experimental results on the real-world dataset BDG2 demonstrate that, compared to baselines, CFL-ICCV reduces prediction error by 12.90% while protecting data privacy, and shows greater robustness against various Byzantine attacks by reducing prediction error at most 86.45% under attacks.