2016ICS / OT
Kyiv transmission substation attack (Industroyer)
17 December 2016
A year after the 2015 attack, a substation near Kyiv was hit by malware later named Industroyer or CrashOverride. Unlike in 2015, the attackers did not operate breakers by hand: the malware spoke the grid's own industrial protocols to open them automatically, and included a wiper to slow recovery.
- Victim
- A transmission substation in Ukraine's power grid
- Sector
- Energy
- Public attribution
- In 2020 the US Department of Justice charged GRU officers over attacks that included the December 2016 attack on Ukraine's power grid.Sandworm Team profile
- Malware
- Industroyer
Impact
Part of Kyiv lost power for about an hour, according to ESET's analysis.
Root cause
Attackers with access to the utility's control network could send legitimate-looking protocol commands, because grid protocols such as IEC 104 have no built-in authentication.
Lessons learned: the controls it teaches
- Monitor OT networks for control commands from unexpected sources.
- Restrict and authenticate which systems may send commands to field devices.
- Rehearse manual operation and recovery of substations.