2015 Ukraine Electric Power Attack

Techniques

Malware Used

Attributed Groups

Tactics Covered

About This Campaign

2015 Ukraine Electric Power Attack was a Sandworm Team campaign during which they used BlackEnergy (specifically BlackEnergy3) and KillDisk to target and disrupt transmission and distribution substations within the Ukrainian power grid. This campaign was the first major public attack conducted against the Ukrainian power grid by Sandworm Team.

Attributed Groups

G0034

Sandworm Team

🇷🇺 Russia79 techniques

Techniques by Tactic (17)

Initial Access

T1078 Valid AccountsT1133 External Remote ServicesT1566.001 Spearphishing Attachment

Execution

T1059.005 Visual BasicT1204.002 Malicious File

Persistence

T1078 Valid AccountsT1112 Modify RegistryT1133 External Remote ServicesT1136.002 Domain Account

Privilege Escalation