Ukraine: Intruders maneuver remotely and customers lose electricity

On December 23, 2015, unscheduled outages affected about 225,000 customers of Ukrainian electricity distributors. The international technical investigation finds remote intrusions against three regional companies. The result is seen in homes, not just on operators’ screens.

Attackers access environments from which they can act on the distribution. The disturbance combines action on equipment and measures intended to complicate the reaction. The electrical system becomes the target of an operation prepared in the operator’s IT.

The BlackEnergy software is discovered in the networks concerned. The first technical report, however, points out that the presence of a program alone does not prove its exact role in each cut. It is necessary to distinguish the tool that facilitates access from the action that actually opens a circuit breaker.

Ukrainian teams restore power, including by returning to manual maneuvers when necessary. The response then includes investigations and an access review. The ability to take back control of an equipment locally then counts as much as the protection of a computer station.

The US authorities later linked the attacks on the Ukrainian power grid to Russian military intelligence operations known as Sandworm. This government attribution is distinct from the more limited level of certainty of the first technical review.

This story is impressive because it shows a passage between two worlds. Access rights, software and procedures become levers on a physical service on which a population depends.