2015ICS / OTWiper / destructive
Ukraine power grid attack
23 December 2015
Attackers remotely operated circuit breakers at three Ukrainian electricity distribution companies, cutting power to customers. They used legitimate credentials over remote access, corrupted firmware on substation serial-to-Ethernet devices so operators could not easily reverse the outage, and wiped systems with KillDisk. BlackEnergy malware was found on the companies' networks.
- Victim
- Three Ukrainian regional electricity distribution companies
- Sector
- Energy
- Public attribution
- CISA's alert states that the US Government attributes this activity to Russian nation-state cyber actors; in 2020 the US Department of Justice charged GRU officers over attacks that included Ukraine's grid.Sandworm Team profile
- Malware
- BlackEnergy
Impact
CISA reported that approximately 225,000 customers lost power.
Root cause
Phishing and stolen credentials gave access to IT networks, and remote access paths into OT allowed attackers to operate the grid directly.
Lessons learned: the controls it teaches
- Require MFA on all remote access into OT, and remove paths that are not needed.
- Segment IT from OT using a zone and conduit model.
- Keep manual operation capability and spare firmware for field devices.