The document, run by the Ukraine Computer Emergency Response Team (CERT), describes “at least two successful attack attempts”, one of which began on March 19, just days after Ukraine’s involvement. join the European power grid in an effort to end dependence on Russia.
Following publication, Victor Zhora, Deputy Director of the State Special Service for Digital Development of Ukraine, describe The privacy report is “preliminary” for Wired and calls it “mistake”.
Whether they are successful or not, the cyberattacks on the Ukrainian power grid represent a dangerous continuation of Russia’s aggression toward Ukraine through a hacking group called Sandworm, identified by the United States as the Anti-Semitic Agent. 74455 of Russia’s military intelligence service.
Hackers believed to work for Russian intelligence previously disrupted the electricity system in Ukraine in both 2015 and 2016. While the 2015 attack was largely manual, the 2016 incident was a major one. Automated attacks are carried out using malware called Industroyer. The malware that investigators found in the 2022 attacks is named Industroyer2 because of its resemblance.
“We are dealing with an adversary that has tolerated us for eight years in cyberspace,” Zhora told reporters on Tuesday. “The fact that we were able to stop it shows that we are stronger and better prepared [than last time]. ”
Analysts at ESET have dissected Industroyer2’s code to outline its capabilities and goals. The hackers not only tried to turn off the power, but also destroyed the computers that Ukrainians used to control their electricity grid. That would cut off the ability to get power back online quickly using the power company’s computer.
In previous cyberattacks, the Ukrainians could quickly regain control within hours by switching to manual operations, but the war has made that extremely difficult. It’s not easy to get a truck to the substation when enemy tanks and soldiers may be nearby and the computer has been sabotaged.
“When they openly wage war against our country, attacking Ukraine’s hospitals and schools, there’s no point in hiding,” said Zhora. “Once you hit houses in Ukraine with rockets, there’s no need to hide.”
Given Moscow’s successful track record of active cyberattacks against Ukraine and around the world, experts have predicted that the country’s hackers will emerge and cause damage. US officials spent months warning about the escalation from Russia when it Fight in the land war with Ukraine.
During the war, Ukraine and the US both blamed Russian hackers for using multiple wipers. The financial system and government have been affected. Kyiv is also the target of denial of service attacks, rendering government websites useless at critical times.
However, the Industroyer2 attack marks the most severe known cyberattack in warfare to date. Ukrainian cybersecurity officials are working with Microsoft and ESET to investigate and respond.
This is one of the few publicly known incidents in which government-backed hackers have targeted industrial systems.
The case first came to light in 2010, when it was revealed that malware known as Stuxnet had been created – as reported by the US and Israel – to sabotage Iran’s nuclear program . Russian-backed hackers have also been reported launched many such campaigns against industrial targets in Ukraine, the United States and Saudi Arabia.
The article was updated to note that a Ukrainian official described the previous UA-CERT report as “preliminary” and “erroneous”.
