What happened
On 23 December 2015 three Ukrainian regional electricity distribution companies were hit by a coordinated cyberattack that opened breakers at roughly 30 substations and left about 225,000 customers without power. The joint E-ISAC/SANS analysis found the intrusion began months earlier with spear phishing emails carrying malicious Office documents that installed BlackEnergy 3, which was used to harvest credentials for the operators' VPN and SCADA environments.
How the deception worked
Staff at the distribution companies received emails with Word and Excel attachments; opening them produced a prompt to enable macros, which installed BlackEnergy 3. The attackers spent months conducting reconnaissance, stealing Windows domain credentials and mapping the SCADA environment, then used legitimate remote access to the operators' control systems to open circuit breakers by hand. They followed up by uploading malicious firmware to serial-to-Ethernet converters, wiping workstations with KillDisk, and flooding customer call centres with a telephony denial of service so outages were harder to report and restore.
AI involvement · No AI reported
No AI element reported.
The control that would have caught it· our reading, not a claim from the sources
Macro execution should be blocked by policy for ordinary users, and remote access into an ICS environment should be MFA-protected and separated from the corporate domain whose credentials phishing yields.
Sources (3)
- Analysis of the Cyber Attack on the Ukrainian Power GridE-ISAC and SANS ICS·media.kasperskycontenthub.comOpen ↗
- Analysis of the Cyber Attack on the Ukrainian Power Grid (archived copy)National Security Archive·nsarchive.gwu.eduOpen ↗
- Power grid cyberattack in Ukraine (2015)NATO CCDCOE Cyber Law Toolkit·cyberlaw.ccdcoe.orgOpen ↗
This entry summarises public reporting. It is not a legal finding, and details can change as investigations conclude. Found an error? Send a correction.