2015 cyber attack against power distribution in Ukraine

Incident Impacts Disruption to energy supply
Affected Sector Energy
Associated Intrusion Sets Sandworm

On December 23rd 2015, over 230,000 residents were left without power after multiple power distribution companies in western Ukraine were victims of a targeted cyber attack. After gaining access to company environments, reporting suggests that the attackers were then able to remotely control the SCADA distribution management system. According to reports, a total of seven 110kV and twenty three 35kV substations were disconnected for three hours with additional parts of the distribution grid forced to switch to manual operations.

Subsequent investigations identified BlackEnergy3 malware in victim environments and linked the attack to the Russia attributed intrusion set Sandworm, or Sandworm Team.

Cyber Threat Graph Context

Explore how this cyber incident relates to the wider threat graph

References