Ukraine power grid hack

The Ukraine power grid hack was cyberattack on Ukraine's power grid on December 2015, resulting in power outages for roughly 230,000 consumers in Ukraine. The attack took place during an ongoing conflict in Ukraine and is attributed to a Russian advanced persistent threat group known as "Sandworm".[1] It is the first publicly acknowledged successful cyberattack on a power grid.[2]

Description

On 23 December 2015, hackers remotely compromised information systems of three energy distribution companies in Ukraine and temporarily disrupted the electricity supply to consumers. Most affected were consumers of "Prykarpattyaoblenergo" (Ukrainian: Прикарпаттяобленерго; servicing Ivano-Frankivsk Oblast): 30 substations (7 110kv substations and 23 35kv substations) were switched off, and about 230000 people were without electricity for a period from 1 to 6 hours.[3]

At the same time consumers of two other energy distribution companies, "Chernivtsioblenergo" (Ukrainian: Чернівціобленерго; servicing Chernivtsi Oblast) and "Kyivoblenergo" (Ukrainian: Київобленерго; servicing Kyiv Oblast) were also affected by a cyberattack, but at a smaller scale. According to representatives of one of the companies, attacks were conducted from computers with IP addresses allocated to the Russian Federation.[4]

It has been argued that Ukraine was a special case, comprising unusually dilapidated infrastructure, a high level of corruption, a military conflict with Russia, and exceptional possibilities for Russian infiltration due to the historical linkages between the two countries.[5]

Method

The cyberattack was complex and consisted of the following steps:[4]

  • prior compromise of corporate networks using spear-phishing emails with BlackEnergy malware
  • seizing SCADA under control, remotely switching substations off
  • disabling/destroying IT infrastructure components (uninterruptible power supplies, modems, RTUs, commutators)
  • destruction of files stored on servers and workstations with the KillDisk malware
  • denial-of-service attack on call-center to deny consumers up-to-date information on the blackout

In total, up to 73 MWh of electricity was not supplied (or 0.015% of daily electricity consumption in Ukraine).[4]

See also

References
  1. Jim Finkle (7 January 2016). "U.S. firm blames Russian 'Sandworm' hackers for Ukraine outage". Reuters.
  2. Kostyuk, Nadiya; Zhukov, Yuri M. (2019-02-01). "Invisible Digital Front: Can Cyber Attacks Shape Battlefield Events?". Journal of Conflict Resolution. 63 (2): 317–347. doi:10.1177/0022002717737138. ISSN 0022-0027.
  3. Zetter, Kim (3 March 2016). "Inside the cunning, unprecedented hack of Ukraine's power grid". Wired. San Francisco, California, USA. ISSN 1059-1028. Retrieved 2021-02-08.
  4. "Міненерговугілля має намір утворити групу за участю представників усіх енергетичних компаній, що входять до сфери управління Міністерства, для вивчення можливостей щодо запобігання несанкціонованому втручанню в роботу енергомереж". mpe.kmu.gov.ua. Міністерство енергетики та вугільної промисловості України. 2016-02-12.
  5. Overland, Indra (1 March 2019). "The geopolitics of renewable energy: debunking four emerging myths". Energy Research and Social Science. 49: 36–40. doi:10.1016/j.erss.2018.10.018. ISSN 2214-6296. Retrieved 2021-02-08.

Further reading
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.