2015 Ukraine power grid hack

First registered successful hacking attack on power grid On December 23, 2015, the power grid in two western oblasts of Ukraine was hacked, which resulted in power outages for roughly 230,000 consumers in Ukraine for 1-6 hours. The attack took place during the ongoing Russo-Ukrainian War (2014–present) and is attributed to a Russian advanced persistent threat group known as "Sandworm". https://www.reuters.com/article/us-ukraine-cybersecurity-sandworm-idUSKBN0UM00N20160108 U.S. firm blames Russian 'Sandworm' hackers for Ukraine outage Jim Finkle 7 January 2016 Reuters 2 July 2017 23 June 2017 https://web.archive.org/web/20170623070812/http://www.reuters.com/article/us-ukraine-cybersecurity-sandworm-idUSKBN0UM00N20160108 live It is the first publicly acknowledged successful cyberattack on a power grid.Kostyuk Nadiya Zhukov Yuri M. 2019-02-01 Invisible Digital Front: Can Cyber Attacks Shape Battlefield Events? https://doi.org/10.1177/0022002717737138 Journal of Conflict Resolution en 63 2 317–347 10.1177/0022002717737138 44364372 0022-0027 2022-02-25 2022-02-25 https://web.archive.org/web/20220225152312/https://journals.sagepub.com/doi/10.1177/0022002717737138 live subscription Description On 23 December 2015, hackers using the BlackEnergy 3 malware remotely compromised information systems of three energy distribution companies in Ukraine and temporarily disrupted the electricity supply to consumers. Most affected were consumers of Prykarpattyaoblenergo (uk Прикарпаттяобленерго; servicing Ivano-Frankivsk Oblast): 30 substations (7 110kv substations and 23 35kv substations) were switched off, and about 230,000 people were without electricity for a period from 1 to 6 hours. Zetter Kim Inside the cunning, unprecedented hack of Ukraine's power grid 3 March 2016 Wired San Francisco, California, USA 1059-1028 https://www.wired.com/2016/03/inside-cunning-unprecedented-hack-ukraines-power-grid/ 2021-02-08 2021-02-08 https://web.archive.org/web/20210208174448/https://www.wired.com/2016/03/inside-cunning-unprecedented-hack-ukraines-power-grid/ live At the same time, consumers of two other energy distribution companies, Chernivtsioblenergo (uk Чернівціобленерго; servicing Chernivtsi Oblast) and Kyivoblenergo (uk Київобленерго; servicing Kyiv Oblast) were also affected by a cyberattack, but at a smaller scale. According to representatives of one of the companies, attacks were conducted from computers with IP addresses allocated to the Russian Federation. http://mpe.kmu.gov.ua/minugol/control/uk/publish/article?art_id=245086886&cat_id=35109 Міненерговугілля має намір утворити групу за участю представників усіх енергетичних компаній, що входять до сфери управління Міністерства, для вивчення можливостей щодо запобігання несанкціонованому втручанню в роботу енергомереж 2016-02-12 mpe.kmu.gov.ua Міністерство енергетики та вугільної промисловості України 2016-10-10 2016-08-15 https://web.archive.org/web/20160815073423/http://mpe.kmu.gov.ua/minugol/control/uk/publish/article?art_id=245086886&cat_id=35109 live The previous month, Ukrainian activists had damaged four electricity transmission lines in Ukraine supplying electricity to Crimea, causing about 1.6 million people and 150 schools in Crimea to be without power. Ukrinterenergo repaired the lines a few days later, as Russia was considering stopping supplies of coal to Ukraine in response.https://www.bbc.co.uk/news/world-europe-34893493 Crimea without power after pylons blown up BBC News 22 November 2015 19 January 2026https://www.osw.waw.pl/en/publikacje/analyses/2015-11-25/crimea-left-without-power Crimea is left without power Strzelecki Jan Rafał Sadowski Centre for Eastern Studies 25 November 2015 19 January 2026 Vulnerability In 2019, it was argued that Ukraine was a special case, comprising unusually dilapidated infrastructure, a high level of corruption, the ongoing Russo-Ukrainian War, and exceptional possibilities for Russian infiltration due to the historical links between the two countries. Overland Indra The geopolitics of renewable energy: debunking four emerging myths 1 March 2019 Energy Research and Social Science 49 36–40 10.1016/j.erss.2018.10.018 2214-6296 https://www.sciencedirect.com/science/article/pii/S2214629618308636/pdfft 2021-02-08 free 2021-08-19 https://web.archive.org/web/20210819043148/https://www.sciencedirect.com/science/article/pii/S2214629618308636/pdfft live 11250/2579292 free The Ukrainian power grid was built when it was part of the Soviet Union, has been upgraded with Russian parts and (as of 2022), still not been fixed.December 2022 Russian attackers are as familiar with the software as operators. Furthermore, the timing of the attack during the holiday season guaranteed only a skeleton crew of Ukrainian operators were working (as shown in videos).Sanger David E. Barnes Julian E. 2021-12-20 U.S. and Britain Help Ukraine Prepare for Potential Russian Cyberassault en-US The New York Times https://www.nytimes.com/2021/12/20/us/politics/russia-ukraine-cyberattacks.html 2022-01-17 0362-4331 2022-01-16 https://web.archive.org/web/20220116234106/https://www.nytimes.com/2021/12/20/us/politics/russia-ukraine-cyberattacks.html live Method The cyberattack was complex and consisted of the following steps: Prior compromise of corporate networks using spear-phishing emails with BlackEnergy malware Seizing SCADA under control, remotely switching substations off Disabling/destroying IT infrastructure components (uninterruptible power supplies, modems, RTUs, commutators) Destruction of files stored on servers and workstations with the KillDisk malware Denial-of-service attack on call-center to deny consumers up-to-date information on the blackout. Emergency power at the utility company's operations center was switched off. In total, up to 73 MWh of electricity was not supplied (or 0.015% of daily electricity consumption in Ukraine). See also 2016 Kyiv cyberattack, which resulted in another power outage Ukrenergo, electricity transmission system operator in Ukraine Ukrainian energy crisis, 2024 energy shortage in Ukraine 2017 cyberattacks on Ukraine Russo-Ukrainian cyberwarfare Cyberwarfare by Russia Vulkan files leak 2025 cyberattack on Polish power grid References 30em Further reading https://ics.sans.org/media/E-ISAC_SANS_Ukraine_DUC_5.pdf Analysis of the Cyber Attack on the Ukrainian Power Grid. Defense Use Case E-ISAC 18 March 2016 Robert M. Lee Michael J. Assante Tim Conway http://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf When The Lights Went Out Booz Allen Hamilton Nate Beach-Westmoreland Jake Styczynski Scott Stables November 2016 External links Adi Nae Gamliel (2017–10–6) "Securing Smart Grid and Advanced Metering Infrastructure". https://www.wired.com/story/russian-hackers-attack-ukraine/ How An Entire Nation Became Russia's Test Lab for Cyberwar Andy Greenberg Andy Greenberg 2017-06-20 Wired https://www.wired.com/2016/03/inside-cunning-unprecedented-hack-ukraines-power-grid/ Inside the Cunning, Unprecedented Hack of Ukraine's Power Grid Kim Zetter Kim Zetter Wired 2016-03-03 https://www.wired.com/2016/01/everything-we-know-about-ukraines-power-plant-hack/ Everything We Know About Ukraine's Power Plant Hack Kim Zetter Wired 2016-01-20 https://www.fireeye.com/blog/threat-research/2016/01/ukraine-and-sandworm-team.html Sandworm Team and the Ukrainian Power Authority Attacks John Hulquist FireEye 2016-01-07 ICS-CERT, [https://www.cisa.gov/uscert/ics/advisories/ICSA-16-336-02) ICS-CERT, Cyber-Attack Against Ukrainian Critical Infrastructure (IR-ALERT-H-16-056-01) Category:Cyberattacks on the energy sector Category:2015 in Ukraine Category:Cyberattacks during the Russo-Ukrainian war Category:Power outages in Ukraine Category:December 2015 crimes in Europe Category:December 2015 in Ukraine Category:2010s in hacking