Cyber Primer

Integrating cyber operations
Case study 3 – Alleged cyber attack against a state’s
critical national infrastructure
Cyber attack against Ukrainian critical national infrastructure
Who
Although the United States’ Department of Homeland Security, who conducted
the analysis, did not name any group or nation as being responsible for causing
the power cuts, independent analysts have linked the spear-phishing attack to
Russia – iSight Partners, a United States security firm, said the probable culprit
was the so-called ‘Sandworm Team’, a Russian hacking group it has been tracking
for more than a year.
What
Cyber attack against three Ukrainian regional electric power distribution
companies (Oblenergos) that cut power to 225,000 people in Ukraine. The
attack is thought to be the first known successful cyber attack aimed at critical
national infrastructure.
How
A report written by the cyber emergency response team in the Industrial Control
Systems arm of the Department of Homeland Security said the attack had several
stages and initially involved hackers installing malware on computer systems at
power generation firms in Ukraine, probably facilitated by a spear-fishing email
sent to an employee.
The cyber attack was reportedly synchronised and coordinated across the three
locations, probably following extensive reconnaissance of the target networks.
According to company personnel, the cyber attacks at each company occurred
within 30 minutes of each other and impacted multiple central and regional
facilities. During the cyber attacks, malicious remote operation of the breakers
was conducted by multiple external individuals using either existing remote
administration tools at the operating system level or remote industrial control
system (ICS) client software via virtual private network (VPN) connections. The
companies believe that the actors acquired legitimate credentials prior to the
cyber attack to facilitate remote access.
While the power was cut, the attackers also bombarded customer service phone
lines with fake calls to stop customers reporting the cut.
80
Cyber Primer (2nd Edition)