Glossary term
Spear phishing
Spear phishing is phishing aimed at a chosen person or group instead of a large crowd.
Read more
Significant cyber incident
2015 Ukraine power grid attack
On 23 December 2015, remote intruders opened breakers at three regional electricity distribution companies in Ukraine.
In short
On 23 December 2015, remote intruders opened breakers at three regional electricity distribution companies in Ukraine. About 225,000 customers lost power, according to the US ICS-CERT alert. The attackers also wiped systems with KillDisk and disabled substation communication devices, which slowed recovery. The US Government attributes the activity to Russian nation-state cyber actors.
What happened
On 23 December 2015, Ukrainian power companies had unscheduled outages that hit a large number of customers. The US ICS-CERT alert says the outages came from remote intrusions at three regional electric power distribution companies, called Oblenergos, and affected about 225,000 customers. Three other organizations, some from other sectors, were also broken into but had no operational impact.
The Idaho National Laboratory, a US Department of Energy laboratory, names the three victims as Chernivistioblenergo, Kievoblenergo and Prykarpattyoblenergo (its spellings). It says the attackers were able to open breakers at over 50 electrical substations and that the outage lasted six hours.
The attackers did more than switch power off. They corrupted the firmware of Serial-to-Ethernet devices at substations, scheduled disconnects of server UPS units, and ran KillDisk to wipe systems at the end. The US team assesses these steps were meant to interfere with restoration. The Idaho report adds that a flood of automated calls kept one company from hearing where outages were.
Engineers restored power by going to substations and operating them by hand. The US alert says the companies still ran under constrained operations when it was written, and the Idaho report says breakers were still operated manually over two months after the attack.
Timeline
-
May 2014
Spearphishing likely gives the attackers initial access to the oblenergos' networks (Idaho National Laboratory assessment).
-
Before 23 December 2015
The companies believe the attackers obtained legitimate credentials ahead of the attack (ICS-CERT).
-
23 December 2015, about 3:30 PM
Operators at Chernivistioblenergo see cursors moving on their screens to open substation breakers (Idaho National Laboratory).
-
23 December 2015
At about the same time, commands are sent to the Distribution Management System at Kievoblenergo through a rogue client to open breakers.
-
23 December 2015, about 30 minutes later
Prykarpattyoblenergo has its substation breakers opened the same way as the first company.
-
23 December 2015
Substation Serial-to-Ethernet devices are corrupted, UPS disconnects are scheduled, and KillDisk wipes systems at the end of the attack.
-
23 December 2015
Automated calls flood the Kievoblenergo call center; engineers go to substations to restore power by hand. Power is back after about six hours.
-
About two months after the attack
DHS issues a formal report on the event; the Idaho National Laboratory says full understanding came then. A US interagency team had traveled to Ukraine to gather accounts.
-
20 July 2021
The ICS-CERT alert is updated to state the US Government attribution to Russian nation-state cyber actors.
-
23 February 2022
A joint US and UK advisory lists the 2015 BlackEnergy disruption among activity previously attributed to Sandworm.
-
30 June 2022
The Idaho National Laboratory publishes its precursor analysis of the attack.
How the attack worked
The US ICS-CERT alert is based on interviews with staff at six Ukrainian organizations. The US team could not review the technical evidence itself, so parts of the chain below are reported or assessed, not confirmed.
Step 1: Get in and learn the network
Each company reported BlackEnergy infections. The alert says the malware was reportedly delivered by spear phishing emails with malicious Microsoft Office attachments (Spearphishing Attachment, T0865 in ATT&CK for ICS). It adds that the US team did not know whether BlackEnergy played a role, and that any remote access Trojan could have been used. The attack was probably preceded by extensive reconnaissance. The Idaho National Laboratory assesses that spearphishing likely gave initial access as far back as May 2014.
Step 2: Obtain legitimate credentials
The companies believe the actors acquired legitimate credentials before the attack (Valid Accounts, T0859 in ATT&CK for ICS). BlackEnergy is suspected to have been used to get them, but this was still being evaluated.
Step 3: Open the breakers by hand
Several people outside the companies operated the breakers remotely. They used either existing remote administration tools at operating system level, or remote ICS client software over VPN connections (External Remote Services, T0822). The attacks at the three companies happened within 30 minutes of each other. At one company operators watched their cursors move by themselves. At another, commands went through a rogue client to the Distribution Management System.
Step 4: Slow the recovery
The actors corrupted the firmware of Serial-to-Ethernet devices at substations (System Firmware, T0857), scheduled UPS disconnects through the UPS management interface, and wiped systems with KillDisk (Data Destruction, T0809). The Idaho report adds a flood of automated calls to one call center. The US team assesses these actions were meant to interfere with restoration.
- PhishingSpear phishing emails with Office attachments reportedly carried BlackEnergyTechnique T0865 (MITRE ATT&CK, opens in a new tab)
- CredentialsLegitimate credentials acquired before the attackTechnique T0859 (MITRE ATT&CK, opens in a new tab)
- Remote accessRemote admin tools or ICS client software over VPNTechnique T0822 (MITRE ATT&CK, opens in a new tab)
- Breakers openedOutside operators opened breakers at three companies within 30 minutesTechnique T0831 (MITRE ATT&CK, opens in a new tab)
- FirmwareSerial-to-Ethernet devices corrupted at substationsTechnique T0857 (MITRE ATT&CK, opens in a new tab)
- WipeKillDisk run on systems at the endTechnique T0809 (MITRE ATT&CK, opens in a new tab)
Who says who was behind it
Who attributed it, and how firm it is
CISA ICS-CERT, alert updated 20 July 2021: "The U.S. Government attributes this activity to Russian nation-state cyber actors." The original alert, based on interviews, did not name an actor.
CISA, joint advisory with the UK NCSC, 23 February 2022: lists the BlackEnergy disruption of Ukrainian electricity in 2015 among activity previously attributed to Sandworm, which the UK NCSC, CISA and the FBI have attributed to the Russian GRU Main Centre for Special Technologies (GTsST).
CISA advisory last revised 9 May 2022: says GTsST actors conducted the December 2015 cyberattack on Ukrainian energy distribution companies, and that the US and UK Governments previously attributed this activity to GTsST.
No Ukrainian government page was opened for this profile, so no Ukrainian attribution is given here. The US team's account rests on interviews, and it could not review the technical evidence itself.
Malware and vulnerabilities used
Impact
About 225,000 customers lost power across three regional distribution companies (ICS-CERT). The Idaho National Laboratory says breakers were opened at over 50 substations and the outage lasted six hours.
The attackers corrupted substation Serial-to-Ethernet devices, scheduled UPS disconnects and wiped systems with KillDisk. The Idaho report says one call center was flooded with automated calls from foreign numbers.
Power returned through manual operation at substations. The Idaho report says the oblenergos were still operating breakers manually over two months later, and the Idaho report notes the attack did not cause catastrophic damage to the grid infrastructure itself. No cost figures were found in the pages opened.
Government and regulator response
- 23 December 2015: Engineers restored power in about six hours by operating substations manually (Idaho National Laboratory).
- About two months later: A US interagency team from ICS-CERT, US-CERT, the Department of Energy, the FBI and NERC traveled to Ukraine, interviewed staff at six Ukrainian organizations and issued the ICS-CERT alert. The alert says the Ukrainian government worked closely and openly with the US team.
- ICS-CERT advice: contingency plans for safe operation or shutdown, application whitelisting, isolating ICS networks from untrusted networks, limiting remote access with strong multi-factor authentication, and reporting suspected activity.
- 20 July 2021: The alert was updated with the US attribution to Russian nation-state cyber actors.
Statements by the Ukrainian government (SSSCIP, CERT-UA) were not opened for this profile.
Lessons
-
Remote access is the door
The actors used remote administration tools or ICS client software over VPN, with credentials the companies believe were stolen earlier. Control who can reach the control network and how.
-
Plan for a hostile control system
ICS-CERT says plans should assume the ICS is working against safe operation. Keep manual procedures and trained staff, as the Ukrainian engineers did.
-
Attackers also attack recovery
Firmware on communication devices, UPS units and call centers were hit to slow restoration. List what you need to recover and protect it.
-
Wipers follow the intrusion
KillDisk ran at the end on all three companies. Offline backups and tested rebuilds matter for IT and for engineering workstations.
-
Email can start a long intrusion
The Idaho report assesses spearphishing may have given access as far back as May 2014. Phishing alerts in energy companies deserve follow-up.
-
Plain security basics still count
ICS-CERT stresses asset management, patching, whitelisting and network isolation before anything advanced.
What to check in your own organization
-
Remote access paths
List every VPN, remote admin tool and ICS client that can reach control systems. Remove persistent vendor connections and require multi-factor authentication.
-
Network separation
Confirm that control networks are isolated from the corporate network and the Internet, and test it.
-
Application whitelisting
Run whitelisting on HMIs and database servers, which change rarely, so unknown programs cannot run.
-
Credential hygiene
Make sure operator and engineering accounts are separate from office accounts and alert on logins from new places.
-
Manual operation drill
Practise running substations or plants by hand, including how staff reach sites if remote control fails.
-
Recovery dependencies
Check firmware images, UPS management interfaces, phone systems and call centers. Confirm you can restore them if they are corrupted or switched off.
-
Phishing in operations staff
Make sure suspicious Office attachments sent to energy and OT staff are reported and investigated, not only deleted.
Where it happened
- Industry Energy and utilities Exposed network devices, destructive attacks, ransomware and state-backed groups that target energy and utility operators, and the rules that apply.
- Country Ukraine Ukraine is the country where Russian state cyber operations have been most destructive, from the 2015 power grid attack to wiper malware in 2022. Europe
Questions
What happened on 23 December 2015?
Remote intruders opened breakers at three regional electricity distribution companies in Ukraine. About 225,000 customers lost power, says the US ICS-CERT alert.
Which companies were hit?
The Idaho National Laboratory names Chernivistioblenergo, Kievoblenergo and Prykarpattyoblenergo, with its own spellings. The ICS-CERT alert does not name them.
How long did the outage last?
The Idaho National Laboratory says the outage lasted six hours. Breakers were still operated manually more than two months later.
Who is blamed?
The US Government attributes the activity to Russian nation-state cyber actors (alert updated 20 July 2021). A CISA advisory of 23 February 2022 lists it among activity previously attributed to Sandworm. No Ukrainian government page was opened here.
Was BlackEnergy the cause?
Unclear. The US team did not know whether BlackEnergy played a role. A BlackEnergy 3 variant was present, but ICS-CERT could not confirm a causal link to the outage.
What is KillDisk?
Malware that erases selected files and corrupts the master boot record, so systems cannot start (ICS-CERT).
In our research
- Energy and utilities Industry
Sources
- Cyber-Attack Against Ukrainian Critical Infrastructure (IR-ALERT-H-16-056-01) CISA / ICS-CERT
- Precursor Analysis Report: Ukraine Energy Sector Cyber Attack 2015 (INL/RPT-22-69464) Idaho National Laboratory, US Department of Energy
- New Sandworm Malware Cyclops Blink Replaces VPNFilter (AA22-054A) CISA, NCSC, NSA, FBI
- Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure (AA22-110A) CISA, FBI, NSA and partners
- Ongoing Sophisticated Malware Campaign Compromising ICS (Update E) (ICS-ALERT-14-281-01E) CISA / ICS-CERT
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.