{"id":54461,"date":"2023-11-09T08:00:09","date_gmt":"2023-11-09T08:00:09","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/russias-sandworm-not-just-missile-strikes-to-blame-for-ukrainian-power-blackouts\/"},"modified":"2023-11-09T08:00:09","modified_gmt":"2023-11-09T08:00:09","slug":"russias-sandworm-not-just-missile-strikes-to-blame-for-ukrainian-power-blackouts","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/russias-sandworm-not-just-missile-strikes-to-blame-for-ukrainian-power-blackouts\/","title":{"rendered":"Russia’s Sandworm \u2013 not just missile strikes \u2013 to blame for Ukrainian power blackouts"},"content":{"rendered":"

Blackouts in Ukraine last year were not just caused by missile strikes on the nation but also by a seemingly coordinated cyberattack on one of its power plants. That’s according to Mandiant’s threat intel team, which said Russia’s Sandworm crew was behind the two-pronged power-outage and data-wiping attack.<\/p>\n

In research due to be published today, the Google-owned security shop details a previously unreported cyberattack on a Ukrainian power plant. That facility was compromised around June last year, and a two-day attack followed four months later, which just happened to coincide with massive missile strikes on Ukraine’s electrical grid. All in all, this knocked out power to about a third of the country. <\/p>\n

Mandiant says it can’t determine Sandworm’s initial means of intrusion. But somehow the crew \u2013 which Western government agencies and private-sector security researchers have previously linked to Russia’s GRU military intelligence unit \u2013 successfully gained access to the operational technology (OT) environment of the power station via a hypervisor hosting a supervisory control and data acquisition (SCADA) management instance for the plant’s substations. <\/p>\n

\n

We note that the timing of the attack overlaps with Russian kinetic operations<\/p>\n<\/blockquote>\n

The intruders snooped around the SCADA system for up to three months and then, on October 10, Sandworm used an optical disc image named “a.iso” to execute a native MicroSCADA binary that included the commands to switch off substations, causing the unplanned power outage.<\/p>\n

Two days later on October 12, the Sandworm crew followed up with a data-wiping attack against the same power plant, deploying a variant of CaddyWiper<\/a> to the IT environment. The wiper did not, however, affect the hypervisor nor the SCADA virtual machine.<\/p>\n