Glossary term
Critical infrastructure
Critical infrastructure means the systems and assets, physical or virtual, that are so vital that losing them would seriously harm security, the economy, or public health and safety.
Read more
Significant cyber incident
Kyiv substation attack with Industroyer
On 17 December 2016, malware called Industroyer, also known as CrashOverride, disrupted a transmission substation outside Kyiv, Ukraine.
In short
On 17 December 2016, malware called Industroyer, also known as CrashOverride, disrupted a transmission substation outside Kyiv, Ukraine. A US Department of Energy laboratory report says the grid operator Ukrenergo lost control of the substation and power was out for over an hour in Kyiv city and region. The malware could send commands in substation protocols and wipe files. US and MITRE sources attribute it to Russia's GRU unit Sandworm.
What happened
Just before midnight on 17 December 2016, attackers launched Industroyer against the Pivnichna transmission substation outside Kyiv, according to a US Department of Energy laboratory report. By midnight, Ukrenergo had lost control of the targeted substation. Power was out for over an hour in the city of Kyiv and the Kyiv region. A US indictment says the supply of electricity to Kiev was disrupted for approximately one hour.
The malware was built to take control of substation switches and circuit breakers. It also had a wiper that deleted key system files, and a part aimed at Siemens protective relays. The laboratory report says the wiper made operators lose control over and view of the ICS environment.
The attackers had been inside for months. The laboratory report gives about 3 February 2016 as the likely first access, after spearphishing against electric power organizations. The US indictment says the network had been compromised since around April 2016. Sources differ on this date.
The malware was made public in June 2017. CISA issued alert TA17-163A on 12 June 2017. On 20 July 2021 CISA added that the US Government attributes the activity to Russian nation-state cyber actors. Ukrainian government pages could not be opened for this profile, so the account here rests on US and UK official sources and MITRE ATT&CK.
Timeline
-
December 2015
Per the US indictment, the conspirators deploy destructive malware against companies supporting Ukraine's power grid. This is the earlier attack.
-
About 3 February 2016
The US Department of Energy laboratory report gives this as the likely first access to Ukrenergo enterprise networks (sources differ; the indictment says around April 2016).
-
Around April 2016
The US indictment says the transmission company's network has been compromised since about now.
-
1 December 2016
The laboratory report says the attackers begin capturing credentials.
-
6 December 2016
Per the US indictment, destructive malware hits Ukraine's Ministry of Finance and State Treasury Service in a separate attack.
-
17 December 2016, just before midnight
The attackers deploy and launch Industroyer at the Pivnichna substation.
-
17 December 2016, midnight
Ukrenergo has lost control of a targeted substation; Kyiv city and region lose power.
-
Over an hour later
Power is restored. The laboratory report says the entire outage lasted just over an hour.
-
12 June 2017
CISA publishes alert TA17-163A on CrashOverride malware.
-
October 2020
The US indicts six GRU Unit 74455 officers, including over the 2015 and 2016 attacks on Ukrainian electrical companies (MITRE ATT&CK).
-
July 2021
On 20 July CISA updates the alert to say the US Government attributes the activity to Russian nation-state cyber actors.
-
May 2022
A US advisory (AA22-110A, last revised 9 May 2022) says GTsST actors ran the 2016 intrusion campaign against a Ukrainian transmission company.
How the attack worked
Getting in and moving
The laboratory report says the attackers likely got in through spearphishing with a malicious Office attachment that contained macros. They then used captured credentials to reach the Pivnichna substation environment through a device connected to both the IT and ICS networks. MITRE ATT&CK lists the steps it ties to this campaign: a script that tried RPC authentication against many hosts, Mimikatz to capture legitimate credentials, two created accounts named “admin” and “система” (System), valid accounts used over VPN connections and dual-homed systems, and MS-SQL access to a pivot machine that gave code execution across the ICS network. The attackers also disabled event logging on compromised systems.
The malware
Industroyer is a modular framework. The laboratory report says each impact module is tailored to one ICS protocol used in the power sector and is loaded through a custom launcher. CISA says the reported modules focus on IEC101, IEC104 and IEC61850. The UK NCSC adds OPC DA and IEC60870-5-104. MITRE ATT&CK says the malware toggles breakers to the open state using unauthorized command messages. A trojanized Windows Notepad gave extra persistence, and Tor nodes were used for command and control.
Wiper and relay attack
The wiper deleted configuration and system files to slow recovery of the SCADA systems and left operators without control or view. The laboratory report says it came with an attempted denial-of-service attack on four Siemens SIPROTEC protective relays. MITRE ATT&CK says that tool uses CVE-2015-5374. CISA notes that such a relay would need a manual reset.
Why it was hard to catch
CISA says the malware is second stage and can run without its first command channel, so ordinary detection may miss it before it runs. It abuses the lack of authentication in common ICS protocols to issue commands that field devices accept.
- EntrySpearphishing with a macro attachment in early 2016, per the laboratory report
- CredentialsMimikatz and a login script used to capture and test credentialsTechnique T1003 (MITRE ATT&CK, opens in a new tab)
- Reach the substationValid accounts over VPN and a device on both IT and ICS networksTechnique T1078 (MITRE ATT&CK, opens in a new tab)
- SpreadMS-SQL pivot and network shares used to reach ICS hostsTechnique T1021 (MITRE ATT&CK, opens in a new tab)
- LaunchIndustroyer payloads loaded on 17 December, just before midnight
- ImpactBreakers opened, files wiped, relay attack tried; outage over an hourTechnique T1485 (MITRE ATT&CK, opens in a new tab)
ATT&CK techniques
- Technique Application Layer Protocol Application Layer Protocol is a technique where attackers talk to a system they control using ordinary network protocols, such as those used for web browsing, file transfer, email or DNS. T1071 · Command and Control
- Technique Command and Scripting Interpreter Command and Scripting Interpreter is a technique where an attacker uses the built-in shells and scripting languages of a system to run commands, scripts or programs. T1059 · Execution
- Technique Ingress Tool Transfer Ingress Tool Transfer is a technique where attackers bring tools or other files from outside into a network they have already broken into. T1105 · Command and Control
- Technique Masquerading Masquerading is when an attacker changes how a file, program, service or account looks so it seems legitimate. T1036 · Stealth
- Technique Obfuscated Files or Information Obfuscated Files or Information is a technique where an attacker hides the real content of a file, program or command by encrypting, encoding or packing it. T1027 · Stealth
- Technique OS Credential Dumping OS credential dumping is when an attacker pulls account login material out of a computer. T1003 · Credential Access
- Technique Remote Services Remote Services is when an attacker uses a valid account to log in to a service built for remote access, such as SSH, RDP or VNC. T1021 · Lateral Movement
- Technique Valid Accounts Valid Accounts means an attacker logs in with real credentials that were stolen or bought. T1078 · Stealth, Persistence, Privilege Escalation, Initial Access
Who says who was behind it
Who attributed it, and how firm it is
CISA, 20 July 2021 (update to alert TA17-163A): the US Government attributes the activity to Russian nation-state cyber actors, who deployed the malware in a cyberattack against Ukrainian critical infrastructure.
US advisory AA22-110A (last revised 9 May 2022): says activity "previously attributed to GTsST by the U.S. Government and the UK Government" includes a 2016 intrusion campaign against a Ukrainian electrical transmission company where CrashOverride (Industroyer) was deployed. It calls GTsST also Unit 74455.
MITRE ATT&CK: describes the 2016 Ukraine Electric Power Attack as a Sandworm Team campaign and says Sandworm Team has been attributed to Russia's GRU Main Center for Special Technologies, military unit 74455.
US indictment, October 2020 (Western District of Pennsylvania): says six GRU officers working for Military Unit 74455, known to researchers as Sandworm Team, conspired to deploy destructive malware, and says the conspirators carried out the 17 December 2016 intrusion. These are charges, not court findings.
Sources differ on the type of substation: MITRE ATT&CK says distribution substations; the indictment, the laboratory report and the UK NCSC say transmission. The two dates for first access also differ (February vs April 2016).
The UK NCSC page opened does not itself attribute the 2016 attack. Ukrainian government attribution statements could not be opened.
Malware and vulnerabilities used
- Malware Industroyer Industroyer, also called CrashOverride, is a malware framework built to disrupt industrial control systems, specifically parts used in electrical substations. Framework · Since 2016 · Windows
- Malware Mimikatz Mimikatz is a tool that pulls Windows account logins and passwords out of a computer. Legitimate tool abused · Since 2007 · Windows
Impact
Power was out for over an hour in the city of Kyiv and the Kyiv region, per the US Department of Energy laboratory report. The US indictment says the supply of electricity to Kiev was disrupted for approximately one hour. The laboratory report says the entire outage lasted just over an hour and affected a single transmission level substation.
The wiper deleted key system files and configuration files, which cost operators control over and view of the ICS environment and slowed recovery.
No figure for customers or megawatts affected was found in an opened official source, so none is given.
CISA said in 2017 it knew of no evidence that the malware had affected US critical infrastructure.
Government and regulator response
- 12 June 2017: CISA published alert TA17-163A with detection and mitigation advice, including application whitelisting, authentication of commands at field devices, multi-factor authentication, backups of configurations and a restoration plan.
- October 2020: A US grand jury indictment charged six GRU officers of Military Unit 74455 over a series of destructive attacks, including the 17 December 2016 intrusion.
- 20 July 2021: CISA updated its alert to attribute the activity to Russian nation-state cyber actors.
- Ukrenergo’s own response: Ukrenergo, SSSCIP and CERT-UA statements could not be opened, so no response by them is described here.
Lessons
-
Keep IT and OT apart
The attackers reached the substation environment through a device connected to both IT and ICS networks. A dual-homed host is a bridge for an intruder.
-
Control commands need authentication
CISA says the malware exploits the lack of authentication in common ICS protocols. Where old equipment cannot check commands, use ICS firewalls or upgrade the field devices.
-
Credentials are the real way in
The attackers used captured credentials and valid accounts over VPN. CISA advises multi-factor authentication, least privilege and separate credentials for corporate and control networks.
-
Long dwell time gives many chances to detect
The laboratory report puts first access months before the outage. It assesses that observables from the steps could have been noticed earlier.
-
Plan for destructive malware
The wiper deleted configuration files. CISA advises backups of configurations and a tested restoration plan with gold images.
-
Detection must look for precursors
CISA says the malware can run without its first command channel, so defenders should use behavior-based detection of activity that comes before it.
What to check in your own organization
-
Dual-homed hosts
List every machine with a network connection to both corporate IT and the control network. Remove or tightly lock down each one.
-
Control network credentials
Confirm that control network accounts are separate from corporate accounts, use multi-factor authentication, and are not shared through one directory.
-
Remote access paths
Review VPN and vendor access into the control zone. Make access time limited and monitored, and remove old paths.
-
Protocol exposure
Find where IEC 60870-5-101/104, IEC 61850 or OPC traffic can be sent from a Windows host. Allow only expected sources and watch for new senders.
-
Backups and rebuild
Check that configuration backups of RTUs, relays, engineering workstations and SCADA servers exist offline, and that restoring them has been tested.
-
Application control
Enable application whitelisting on static systems such as HMI and engineering workstations, as CISA advises.
-
Logging
Check that event logging cannot be turned off quietly on control-zone systems, and that alerts fire on new accounts, MS-SQL command use and odd file copies.
Where it happened
- Industry Energy and utilities Exposed network devices, destructive attacks, ransomware and state-backed groups that target energy and utility operators, and the rules that apply.
- Country Ukraine Ukraine is the country where Russian state cyber operations have been most destructive, from the 2015 power grid attack to wiper malware in 2022. Europe
Questions
What was Industroyer?
A modular malware framework built to affect industrial control systems in electrical substations. MITRE ATT&CK calls it the first publicly known malware specifically designed to affect the electric grid. CrashOverride is another name for it.
When did the Kyiv attack happen?
Just before midnight on 17 December 2016, according to the US Department of Energy laboratory report. Power was out for just over an hour.
Who was behind it?
The US Government attributes it to Russian nation-state cyber actors (CISA, 20 July 2021). MITRE ATT&CK and a US indictment tie it to Sandworm Team, the GRU unit 74455. The indictment contains charges, not a court verdict.
Was it the same as the 2015 attack?
No. The 2015 attack used BlackEnergy and KillDisk against distribution companies. The 2016 attack used Industroyer and hit a transmission substation, per the sources opened. The indictment links both to the same unit.
Could it happen in the US?
CISA said in 2017 there was no evidence it had affected US critical infrastructure, but that the techniques could be changed to target US systems.
Which substation was hit?
The US Department of Energy laboratory report names the Pivnichna transmission substation outside Kyiv. MITRE ATT&CK says distribution substations, so sources differ on the type.
Sources
- CrashOverride Malware (Alert TA17-163A) CISA
- Precursor Analysis Report: Industroyer Targeting Ukraine Electric Power Transport Utility (Ukrenergo) 2016 Idaho National Laboratory, US Department of Energy (CyOTE)
- United States v. Andrienko et al., indictment (W.D. Pennsylvania) US Department of Justice
- Industroyer (S0604) MITRE ATT&CK
- 2016 Ukraine Electric Power Attack (C0025) MITRE ATT&CK
- Sandworm Team (G0034) MITRE ATT&CK
- Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure (AA22-110A) CISA
- What is OT malware? UK National Cyber Security Centre
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.