2015 Ukraine Power Grid Attack (Sandworm/BlackEnergy)

What happened

On December 23, 2015, attackers attributed to Russia's Sandworm Team remotely and manually operated circuit breakers at more than 50 substations across three Ukrainian regional electricity distributors. The operation cut power to approximately 225,000 customers for one to six hours across the affected areas, according to WIRED. Investigators reported a spear-phishing campaign and BlackEnergy infections, but government reporting did not confirm that the campaign or malware acquired the credentials used in the outage. The attackers also deployed reported anti-recovery measures including KillDisk, firmware corruption, UPS disconnects, and a telephone denial-of-service attack. CISA later updated its attribution to Russian state actors, and the 2020 US DOJ indictment named GRU Unit 74455 officers in allegations concerning the Ukraine grid attacks.

How it worked

SANS/E-ISAC describes a macro-enabled Office-document infection path. The related NCCIC/ICS-CERT alert reports a broader spear-phishing campaign delivering BlackEnergy variants, but explicitly says the connection between that campaign and the outage was unclear. Investigators determined that the attackers used compromised legitimate credentials to access local systems through VPN and other legitimate remote-access pathways, but the exact nature of credential harvesting remained unknown. Using those credentials, the attackers reached the ICS network and directly operated breakers. The outage was caused by this reported human interaction with SCADA/HMI systems, while the role of BlackEnergy in acquiring credentials remained unconfirmed. Reported anti-recovery actions included firmware changes, UPS disconnects, KillDisk, and a telephone denial-of-service flood.

The lure and the tell

The reported lures were weaponized Microsoft Excel and Word documents emailed to utility personnel and disguised as business correspondence. The related NCCIC/ICS-CERT alert described the broader spear-phishing campaign as using Office attachments with "generally popular topics," but expressly left its connection to the outage unclear. The technical tell was the Office macro-security prompt urging the recipient to click "Enable Content" or "Enable Editing."

Outcome

On December 23, 2015, coordinated attackers remotely and manually operated breakers at more than 50 substations across the three utilities within about 30 minutes of each other, cutting power to roughly 225,000 customers for one to six hours across the affected areas, according to WIRED. Reported KillDisk, firmware, UPS, and telephone denial-of-service actions complicated recovery. Utility staff restored power substantially through manual, on-site switching after remote control was lost. The supplied reporting does not quantify a financial loss.

Why it matters

This incident demonstrated that attackers could use compromised credentials and legitimate remote-access paths to reach control systems and manually operate breakers, while reported phishing and malware details remained partly uncertain in government reporting. It illustrates the importance of IT/OT segmentation, macro security for the reported campaign, VPN and remote-access hardening, monitoring, and manual fallback procedures.

Defenses

The cited CISA/ICS-CERT alert and SANS/E-ISAC report recommend or describe defenses including phishing awareness, disabling Office macros or blocking macros from internet-sourced documents, application controls, network segmentation and strict IT to ICS access controls, multi-factor authentication on VPN and remote-access paths, monitoring remote-administration tools, manual or offline fallback procedures, firmware integrity checks, and backup communications for call centers. These measures address reported attack paths and impacts but are not presented here as proven to have stopped this incident.