In a report released on Thursday, U.S. cybersecurity firm Mandiant, part of Google, revealed that Russian cyber spies were responsible for a hack that disrupted part of Ukraine’s power grid in late 2022. This attack is considered a rare and advanced form of cyberwarfare, as successful hacks against industrial control systems are relatively unique.
The report stated that Russia is one of the few countries with the capabilities to carry out such cyberattacks, and this attack represents the latest evolution in Russia’s cyber physical attack capability.
Although the report did not identify the specific facility targeted in the attack, it highlighted that Russia’s cyberwarfare capability has been increasingly visible since the country’s invasion of Ukraine.
Last October, a massive wave of Russian missile strikes on Ukraine’s power network caused blackouts in many parts of the country, leading Kyiv to halt electricity exports and leaving four regions temporarily without electricity.
The hacking group responsible for the cyberattack, known as “Sandworm”, was able to cause a power cut in an unidentified area of Ukraine by tripping circuit breakers at an electrical substation at the same time as the missile strike. The group then deployed data-wiping malware in an attempt to cover their tracks.
Sandworm has been previously identified as a cyberwarfare unit of Russia’s GRU military intelligence agency. However, Russia’s foreign ministry did not respond to a request for comment, and the GRU could not be reached for comment. Ukraine’s foreign ministry and its SBU intelligence agency also did not provide comment.
Notably, Sandworm hackers rose to prominence in 2015 after a separate cyberattack against Ukraine’s power grid, which cut off power for around 255,000 people. This disruptive intrusion was widely considered to be one of the first successful cyberattacks against a power network.
Mandiant analyst Nathan Brubaker highlighted that there have only been a handful of incidents similar to this, with the majority being carried out by Sandworm. Overall, the report sheds light on the evolving landscape of cyberwarfare and the increasing sophistication of cyberattacks on critical infrastructure.
(Reporting by James Pearson in London; Additional reporting by Christopher Bing in Washington; Editing by Sharon Singleton)
