Power grid cyberattack in Ukraine (2015)
Jump to navigation Jump to search
|Date||23 December 2015|
|Suspected actor||The Sandworm Group. The Ukrainian state security service (SBU) blamed Russia for the attack.|
|Target||Ukrainian Energy Company substations. In the case of the Prykarpattyaoblenergo substation, hackers successfully brought the network offline.|
|Target systems||Microsoft Windows-based systems|
|Method||The first part of the attack is believed to be conducted by an updated version of the BlackEnergy malware. The malicious code has been sent through emails with malicious attachments, targeting specific individuals within the different energy companies in order to retrieve the administrator credentials and get access within the energy substation networks. During the second part of the attack, the actors activated a KillDisk destructive malware, able to wipe parts of computers’ hard drive and preventing the system from rebooting, ultimately leading to the power outages. Eventually, the hackers launched a TDoS attack (telephony denial of service) directed to the customers call center preventing the callers from reporting the outage.|
|Purpose||Unknown. Most likely, the hackers intended to test a remote cyber operations directed to Ukraine’s critical energy infrastructures.|
|Result||The attack resulted in power outages for nearly 225,000 consumers in Western Ukraine. The malware disconnected electrical substation, causing the blackout. To restore the normal activity of the substation it has been necessary a manual intervention by on-site operators, switching the dispatch control center from “automatic to manual mode”, as the hackers infected the SCADA’s manufacturer firmware. However, once restored, the impacted infrastructures kept on functioning under constrained operations.|
|Aftermath||The Ukrainian incident is the first publicly acknowledged attack that used a digital weapon hitting a power grid and causing power outages. This is also the first time that a cyber attack causing electrical energy disruptions has been conducted totally remotely.|
|Analysed in||Scenario 03: Cyber attack against the power grid|
Collected by: Samuele De Tomas Colatin
- Symantec Security Response Team, “Destructive Disakil malware linked to Ukraine power outages also used against media organizations”, (5 January 2016), Symantec Corporation.
- J Titcomb, “Ukrainian blackout blamed on cyber-attack”, (5 January 2016), The Telegraph.
- K Zetter, “Inside the Cunning, unprecedented hack of Ukraine's power grid”, (3 March 2016), Wired.
- Kaspersky Lab, “Newly discovered BlackEnergy spear-phishing campaign targets Ukrainian entities”, (28 January 2016), Kaspersky.
- J Cox, “The Malware That Led to the Ukrainian Blackout”, (26 January 2016), Motherboard.
- L Hausermann, P Bock, R Francoise, A Nervaux, “Threat Intelligence Report, Cyberattacks against Ukrainian ICS”, (18 July 2017), Sentryo.
- D Goodin, “First known hacker-caused power outage signals troubling escalation”, (4 January 2016), Ars Technica.
- R M Lee, “Confirmation of a Coordinated Attack on the Ukrainian Power Grid”, (9 January 2016), SANS Industrial Control System Security Blog.
- ICS-CERT, “Cyber-Attack Against Ukrainian Critical Infrastructure”, (25 February 2016), United States Department of Homeland Security.
- P Polityuk, “Hackers have infiltrated Ukraine’s power grid — and they could take down other infrastructure at any time”, (27 January 2016), Business Insider.
- C McLellan, “How hackers attacked Ukraine's power grid: Implications for Industrial IoT security”, (4 March 2016), ZDNet.