The Evolution of Cyber Attacks on Electric Operations
Summary: Dragos recounts a continual rise in sophisticated cyber attacks on electric infrastructure, citing Ukraine's December 2015 attack that left over 225,000 customers without power for up to 6 hours until manual restoration, and CRASHOVERRIDE in December 2016, the first malware framework to target a transmission substation and cause an outage in Kiev. Dragos tracks six public threat activity groups specifically targeting electric operations, including ELECTRUM, the group behind CRASHOVERRIDE, out of nine total groups targeting industrial organizations globally.
Key Takeaway: Attackers are codifying and scaling tradecraft from prior industrial attacks, and six tracked threat groups now focus specifically on electric operations - a learning curve that runs against utilities whose grids took hours of manual work to restore in 2015.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026