10 Years Since the First Ukraine Power Grid Attack: Lessons in Defense
Summary: On 23 December 2015, adversaries remotely accessed SCADA dispatch systems and manually opened circuit breakers at 30 substations, cutting power to 225,000 people in western Ukraine after about six months of studying operators and network architecture. The 2016 follow-up used CRASHOVERRIDE, purpose-built malware speaking native ICS protocols including IEC 60870-5-101, IEC 60870-5-104, IEC 61850 and OPC DA, while the 2015 attackers also deployed KillDisk, corrupted firmware on Serial-to-Ethernet converters, scheduled UPS disconnects and jammed the utility's call centre lines.
What's compelling: The groups behind the attacks, tracked as KAMACITE and ELECTRUM, remain active: they hit Ukrainian infrastructure again in 2022 with Industroyer2 and have expanded targeting beyond Ukraine to other regions and sectors. The attackers also controlled operators' mice in real time, opening breakers as staff tried to close them - a reminder that internal visibility, now required under NERC CIP-015, is the difference between seeing that happen and not.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026