Jump to content

2015 Ukraine power grid hack

From Wikipedia, the free encyclopedia

This is an old revision of this page, as edited by Hihafdadsfas (talk | contribs) at 09:43, 23 July 2017 (i updated the percentage because it was inaccurate before). The present address (URL) is a permanent link to this revision, which may differ significantly from the current revision.

The December 2015 Ukraine power grid cyberattack took place on 23 December 2015 and is a considered to be the first known successful cyberattack on a power grid. Hackers were able to successfully compromise information systems of three energy distribution companies in Ukraine and temporarily disrupt electricity supply to the end consumers.

Most affected were consumers of «Prykarpattyaoblenergo» (Template:Lang-uk; servicing Ivano-Frankivsk Oblast): 30 substations were switched off, about 230 thousands people were left without electricity for a period from 1 to 6 hours.[1]

At the same time consumers of two other energy distribution companies, «Chernivtsioblenergo» (Template:Lang-uk; servicing Chernivtsi Oblast) and «Kyivoblenergo» (Template:Lang-uk; servicing Kyiv Oblast) were also affected by a cyberattack, but at a smaller scale. According to representatives of one of the companies, attacks were conducted from computers with IP addresses allocated to the Russian Federation.[2]

Description

The cyberattack was complex and consisted of the following steps:[2]

  • prior compromise of corporate networks using spear-phishing emails with BlackEnergy malware;
  • seizing SCADA under control, remotely switching substations off;
  • disabling/destroying IT infrastructure components (uninterruptible power supplies, modems, RTUs, commutators);
  • destruction of files stored on servers and workstations with the KillDisk malware;
  • denial-of-service attack on call-center to deny consumers up-to-date information on the blackout.

In total, up to 73 MWh of electricity was not supplied (or 95% of daily electricity consumption in Ukraine).[2]

Cyber attacks on the energy distribution companies took place during an ongoing Russian-Ukrainian war and is attributed to a Russian advanced persistent threat group known as "Sandworm".[3]

See also

References

  1. ^ Kim Zetter (2016-03-03). "Inside the Cunning, Unprecedented Hack of Ukraine's Power Grid". Wired.
  2. ^ a b c "Міненерговугілля має намір утворити групу за участю представників усіх енергетичних компаній, що входять до сфери управління Міністерства, для вивчення можливостей щодо запобігання несанкціонованому втручанню в роботу енергомереж". Міністерство енергетики та вугільної промисловості України. 2016-02-12.
  3. ^ Jim Finkle (2016-01-07). "U.S. firm blames Russian 'Sandworm' hackers for Ukraine outage". Reuters.

Further reading

Template:Ukrainian crisis navbox