On December 23, 2015, the lights went out in western Ukraine. Three regional power distribution companies - Prykarpattyaoblenergo, Chernivtsioblenergo, and Kyivoblenergo - lost control of their SCADA systems simultaneously. Operators watched helplessly as remote hands took control of their workstations, opened circuit breakers across the distribution network, and then deleted the firmware on serial-to-Ethernet converters to prevent restoration. Approximately 230,000 customers lost power for one to six hours in the middle of a Ukrainian winter. It was the first confirmed cyberattack to cause a power outage.

Exactly one year later, on December 17, 2016, a second attack cut power to a section of Kiev, the Ukrainian capital. This attack was simpler and more automated - a custom ICS malware component named Industroyer (or Crash Override) was deployed to directly interact with substation equipment using industrial protocols, without requiring manual operator actions from the attackers. The two attacks together demonstrated an escalating capability: from spear-phishing and remote desktop to purpose-built ICS weapons. Both were attributed to Sandworm, GRU Unit 74455 - the same unit responsible for NotPetya.

The 2015 Attack: Six Months of Preparation

The 2015 Ukraine power attack began months before the December outage. Starting in the spring of 2015, spear-phishing emails containing malicious Microsoft Office documents were sent to Ukrainian energy sector employees. The documents exploited macro functionality to install BlackEnergy 3, a modular malware platform with a long history in Russian-nexus espionage operations.

BlackEnergy installed KillDisk - a destructive wiper component - and provided persistent remote access. Over the following months, the attackers mapped the target networks, identified SCADA systems and operator workstations, and installed VPNFilter and other remote access tools on systems they planned to use during the attack.

On December 23, the attackers executed the prepared operation simultaneously across all three distribution companies. From compromised operator workstations, they moved the mouse and opened circuit breakers. They launched a telephone denial of service attack against the companies' customer call centers, flooding them with calls to prevent customers from reporting the outage and prevent operators from receiving coordination calls. They then used KillDisk to overwrite the master boot records of servers and workstations, rendering them unbootable and forcing operators to restore systems manually.

The UPS (uninterruptible power supply) systems that would normally maintain power to data centers were also targeted - attackers had identified and disabled them, ensuring that when power was cut, the control systems would also lose power. The combination of manual control manipulation, telephone disruption, and destructive cleanup was a sophisticated combined-arms operation.

[TECHNICAL NOTE]
The 2015 attack demonstrated a multi-phase ICS attack methodology that security researchers call "living off the land plus ICS pivot": initial access via phishing using commodity malware (BlackEnergy), persistence and reconnaissance during a multi-month preparation phase, lateral movement to OT (operational technology) network from IT network via poorly segmented architecture, and physical impact execution by operators controlling SCADA systems directly from compromised workstations. The attackers did not need custom ICS tools in 2015 because they had compromised the workstations from which human operators normally controlled the grid - they could do anything an operator could do. The ICS security community calls this the "operator hijacking" vector, and it is harder to defend against than direct protocol attacks because it uses legitimate control channels.

The 2016 Attack: Industroyer

The December 2016 attack against Kiev's Ukrenergo transmission substation was technically more sophisticated and required less manual attacker presence. ESET researchers who analyzed the malware named Industroyer; Dragos named it Crash Override. It was the second ICS-specific malware ever discovered after Stuxnet.

Industroyer contained four payload modules, each implementing a different industrial communication protocol: IEC 104 (used in power distribution), IEC 101 (serial protocol for substation control), IEC 61850 (substation automation), and OPC DA (Windows-based industrial process control). By implementing these protocols directly, Industroyer could communicate with substation equipment without going through operator workstations - it was a direct weapon against grid infrastructure.

The Kiev attack cut approximately one-fifth of the city's power consumption capacity at midnight for about an hour. The relative modesty of the impact compared to the sophistication of the tool suggested either that the attack was restrained deliberately, that the malware contained bugs limiting its effectiveness, or that it was intended as a demonstration. Subsequent analysis concluded all three factors likely played a role.

Industroyer also included a wiper component similar to KillDisk and a DDoS component to disrupt communications during the attack - structural similarities to the 2015 attack's operational approach, suggesting the same planning team.

[WARNING]
The strategic context of the Ukraine power attacks is inseparable from the ongoing Russian-Ukrainian conflict. The attacks occurred in December 2015 and December 2016 - during the active hybrid war in eastern Ukraine following the 2014 Maidan revolution and Russian annexation of Crimea. Ukraine was being used as a proving ground for Russian offensive cyber capabilities: operations that could be deniably attributed, tested against real infrastructure, and refined before potential use against other targets. The December timing (Ukrainian winter) and the December 17, 2016 date (one day before the anniversary of the 2015 attack) suggested deliberate signaling as much as operational impact. The NSA and CISA have both warned that the same techniques demonstrated against Ukrainian power infrastructure represent realistic threats to US and European critical infrastructure - the Sandworm toolchain is considered an active threat to Western power grids.

Industroyer2 and the 2022 Invasion

Following Russia's full-scale invasion of Ukraine in February 2022, Sandworm deployed Industroyer2 - an updated version of the 2016 malware - against Ukrainian high-voltage substations in April 2022. ESET and Ukrainian CERT-UA discovered and disrupted the attack before it caused a blackout. Industroyer2 targeted IEC 104 protocol devices specifically and was compiled mere hours before it was scheduled to execute, suggesting ongoing active development.

The April 2022 attack was paired with CaddyWiper, a destructive disk wiper deployed on OT (operational technology) network systems to complicate recovery. The operational pattern - ICS payload plus wiper plus disruption - was consistent across all three Ukrainian power attacks, indicating persistent doctrine from the same unit.

Ukraine's ability to detect and disrupt Industroyer2 in 2022 reflected years of post-2015 investment in ICS security, incident response capability, and cooperation with Western security firms. ESET had been embedded with Ukrainian infrastructure operators since the 2016 attack, and the close relationship enabled rapid response. The failed April 2022 attack was one of the few instances where a Sandworm operation was publicly disrupted before achieving its objective.

[IOC]
Industroyer/Crash Override indicators: ESET and Dragos published detailed technical reports with file hashes, mutex names, C2 infrastructure patterns, and YARA rules in June 2017. Industroyer2 indicators were published by ESET and CERT-UA in April 2022. ICS network detection for Industroyer-class threats: monitor for protocol anomalies on IEC 60870-5-104, IEC 60870-5-101, and IEC 61850 network segments - Industroyer sends malformed or unauthorized commands via these protocols. IT/OT segmentation enforcement prevents the lateral movement from enterprise networks to control system networks that enabled both the 2015 and 2016 attacks. The Dragos Year in Review and NERC CIP standards documentation provide implementation guidance for US utility operators. CISA Advisory AA22-076A (March 2022) provides specific Sandworm TTPs and detection signatures applicable to US industrial control system operators.