December 2015 Ukraine power grid cyberattack

On 23 December 2015, hackers were able to successfully compromise information systems of three energy distribution companies in Ukraine and temporarily disrupt the electricity supply to consumers. It is considered to be the first known successful cyberattack on a power grid.

Most affected were consumers of «Prykarpattyaoblenergo» (Ukrainian: Прикарпаттяобленерго; servicing Ivano-Frankivsk Oblast): 30 substations(seven 110kv substation and 23 35kv substation) were switched off, and about 230 thousand people were left without electricity for a period from 1 to 6 hours.[1]

At the same time consumers of two other energy distribution companies, «Chernivtsioblenergo» (Ukrainian: Чернівціобленерго; servicing Chernivtsi Oblast) and «Kyivoblenergo» (Ukrainian: Київобленерго; servicing Kyiv Oblast) were also affected by a cyberattack, but at a smaller scale. According to representatives of one of the companies, attacks were conducted from computers with IP addresses allocated to the Russian Federation.[2]

It has been argued that the Ukraine power grid cyberattack is of limited relevance for concerns over hacking of grids in connection with expanding use of renewable energy, as the Ukraine case took place under special conditions that do not apply elsewhere.[3]

Description

The cyberattack was complex and consisted of the following steps:[2]

  • prior compromise of corporate networks using spear-phishing emails with BlackEnergy malware;
  • seizing SCADA under control, remotely switching substations off;
  • disabling/destroying IT infrastructure components (uninterruptible power supplies, modems, RTUs, commutators);
  • destruction of files stored on servers and workstations with the KillDisk malware;
  • denial-of-service attack on call-center to deny consumers up-to-date information on the blackout.

In total, up to 73 MWh of electricity was not supplied (or 0.015% of daily electricity consumption in the Ukraine).[2]

Cyber attacks on the energy distribution companies took place during an ongoing conflict in the Ukraine and is attributed to a Russian advanced persistent threat group known as "Sandworm".[4]

gollark: I love those!
gollark: It does also make some debugging more annoying when the HTML is just a solid block of nigh-unwhitespaced code.
gollark: The minifier osmarks.tk uses *does* do the unquoting thing, but the savings are minimal.
gollark: no.
gollark: EmacsOS is definitely TC.

See also

References
  1. Kim Zetter (2016-03-03). "Inside the Cunning, Unprecedented Hack of Ukraine's Power Grid". Wired.
  2. "Міненерговугілля має намір утворити групу за участю представників усіх енергетичних компаній, що входять до сфери управління Міністерства, для вивчення можливостей щодо запобігання несанкціонованому втручанню в роботу енергомереж". mpe.kmu.gov.ua. Міністерство енергетики та вугільної промисловості України. 2016-02-12.
  3. Overland, Indra (2019-03-01). "The geopolitics of renewable energy: Debunking four emerging myths". Energy Research & Social Science. 49: 36–40. doi:10.1016/j.erss.2018.10.018. ISSN 2214-6296.
  4. Jim Finkle (2016-01-07). "U.S. firm blames Russian 'Sandworm' hackers for Ukraine outage". Reuters.

Further reading
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.