ELECTRUM Targeted Ukrainian Electric Entity Using Custom Tools and Caddy Wiper Malware, October 2022
Summary: Dragos attributes a disruptive attack on a Ukrainian electric substation, running from June 2022 to events on October 10 and 12, 2022, to the ELECTRUM threat group, which has technical overlaps with SANDWORM. ELECTRUM gained access to a hypervisor running an end-of-life version of MicroSCADA, attempted to execute custom living-off-the-land scripts against substation availability and control, and used a new version of CaddyWiper to remove its footprint from compromised IT systems.
Bottom line: ELECTRUM has attacked Ukrainian electric utilities repeatedly since 2015, including a 2016 outage that cut power to a quarter-million homes, and it stayed dormant on this entity's network for at least a month before acting. The compromised MicroSCADA was end-of-life, and that software has been deployed in more than 10,000 substations monitoring the electric supply for over 10 percent of the world's population.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026