Ukraine says potent Russian hack against power grid thwarted

BOSTON

According to officials from Ukraine, Russian military hackers tried to knock out power to millions in Ukraine last week in a long-planned attack. However, they were foiled.

Hackers managed to hack into one high-voltage power station. However, those defending the station were able stop electrical outages.

“The threat was serious, but it was prevented in a timely manner,”Victor Zhora, a top Ukrainian cybersecurity official, spoke to reporters through an interpreter. “It looks that we were very lucky.”

Officials said that hackers from Russia’s GRU military Intelligence agency used an upgraded version malware that was first seen in the 2016 attack that caused blackouts at Kyiv. This malware was specifically designed to target multiple substations. They also distributed malware to destroy computer operating systems, which hindered recovery.

Although authorities did not provide details about the substations targeted or their locations, security concerns meant that they were not available. However, Farid Safarov (deputy energy minister) said that they had. “2 million people would have been without electricity supply if it was successful.”

Zhora, deputy chair of State Service of Special Communications, stated that the malware was designed to knock out power just as people were returning home from work on Friday evening and turn on news reports.

He stated that the power grid networks were hacked before Russia invaded and that the attackers uploaded the malware, Industroyer2. The malware was able to disrupt one component of the impacted power stations’ management systems, also known by SCADA systems.

Zhora did not provide any further information or offer to explain how the attack was defeated. He also declined to identify which partners may have contributed directly. He acknowledged the importance of international assistance Ukraine received in identifying intrusions as well as the challenges of trying remove attackers from government, power grid, and telecommunications networks. U.S. Cybercommand keyboard soldiers are some of the helpers.

Cybercom was not immediately available to answer a question about whether it was involved in the emergency response.

The Computer Emergency Response Team of Ukraine thanked Microsoft, ESET and other cybersecurity firms for their assistance with dealing with the power grid attack.

Officials stated that the devastating attacks had been planned at minimum since March 23. Zhora speculated that Russia was responsible for them. “invigorate”After suffering heavy losses in a failed attempt to capture Kyiv (the capital), its soldiers were forced to surrender.

Zhora said that Russian cyberattacks had not succeeded in knocking out any power to Ukrainians ever since the invasion began.

GRU hackers from a group that researchers refer to as Sandworm successfully attacked Ukraine’s power system twice in the winters 2015. In 2020, U.S. authorities indicted six GRU officials for using an older version of Industroyer malware to hack Ukraine’s power grid. This involved gaining control over electrical substation switch circuit breakers.

Industroyer was used by Sandworm hackers to turn off circuit breakers in an attack that took place in 2016, according to Jean-Ian Boutin (director of threat research at ESET).

“We know that Industroyer still has the capability to turn off circuit breakers,”He said.

ESET worked closely with Ukrainian responders to determine that the attackers had infected the networks of the targeted plants using disk-wiping software.

Boutin stated that successfully activating the malware would make plant systems inoperable, which would severely hinder remediation and recovery as well as destroying the attackers’ digital footprints.

He said that one of the malware types used in the attack, known as CaddyWiper was first discovered by ESET in March. It was being used against a Ukrainian bank.

Western prosecutors accuse Sandworm of a series high-profile cyberattacks, including the 2017 NotPetya wiper virus that caused more damage than $10 billion worldwide. It destroyed data on entire networks of computers in companies doing business in Ukraine, including those belonging to shipper Maersk as well as Merck.

The use of cyberattacks by Russia against the Ukrainian infrastructure during its invasion was limited in comparison to experts’ prewar expectations. An attack Ukraine blames Russia for knocking down a critical satellite communications link, which also affected tens of thousand of Europeans, from France to Poland, in the early hours.

Hackers also took down the internet service and cellular service of Ukretelecom, another major telecommunications provider that serves the military.

Zhora said “the potential of Russian (state-backed) hackers has been overestimated”He listed a number reasons why he does not believe cyberattacks have played a significant role in the conflict.

• 
  It is not necessary to covertly engage in cyberactivity when the aggressor is attacking civilian targets with bombs or rockets.
• 
  With the help of volunteers from other countries, Ukraine has significantly increased its cyber defenses.
• 
  Attacks to knock out power that are as complex as this one can be are time-consuming and require a lot.

“This is not an easy thing to do,” Zhora said.

The Russian cyberattack on Ukraine has been ongoing for eight years. Zhora stated that the attacks have tripled from the invasion to the same time last year.

Russia claimed that its invasion was necessary to protect civilians in eastern Ukraine. This false claim is what the U.S. predicted Russia would make as a pretext to invade. Russia’s invasion has been called a terrorist attack by Ukraine. “war of aggression,”It’s a good idea “will defend itself and will win.”

——

This report was co-written by Alan Suderman (Associated Press), Richmond, Virginia.