The infamous unit of Russia’s GRU army intelligence company often known as Sandworm stays the one staff of hackers to have ever triggered blackouts with their cyberattacks, turning off the lights for a whole lot of 1000’s of Ukrainian civilians not as soon as, however twice inside the previous decade. Now it seems that within the midst of Russia’s full-scale conflict in Ukraine, the group has achieved one other doubtful distinction within the historical past of cyberwar: It focused civilians with a blackout assault on the similar time missile strikes hit their metropolis, an unprecedented and brutal mixture of digital and bodily warfare.
Cybersecurity agency Mandiant at the moment revealed that Sandworm, a cybersecurity trade title for Unit 74455 of Russia’s GRU spy company, carried out a 3rd profitable energy grid assault concentrating on a Ukrainian electrical utility in October of final yr, inflicting a blackout for an unknown variety of Ukrainian civilians. On this case, not like any earlier hacker-induced blackouts, Mandiant says the cyberattack coincided with the beginning of a sequence of missile strikes concentrating on Ukrainian essential infrastructure throughout the nation, which included victims in the identical metropolis because the utility the place Sandworm triggered its energy outage. Two days after the blackout, the hackers additionally used a bit of data-destroying “wiper” malware to erase the contents of computer systems throughout the utility’s community, maybe in an try to destroy proof that could possibly be used to investigate their intrusion.
Mandiant, which has labored carefully with the Ukrainian authorities on digital protection and investigations of community breaches for the reason that begin of the Russian invasion in February of 2022, declined to call the focused electrical utility or town the place it was positioned. Nor wouldn’t it supply info just like the size of the ensuing energy loss or the variety of civilians affected.
Mandiant does observe in its report on the incident that as early as two weeks earlier than the blackout, Sandworm’s hackers seem to have already possessed all of the entry and capabilities essential to hijack the economic management system software program that oversees the circulation of energy on the utility’s electrical substations. But it seems to have waited to hold out the cyberattack till the day of Russia’s missile strikes. Whereas that timing could also be coincidental, it extra possible suggests coordinated cyber and bodily assaults, maybe designed to sow chaos forward of these air strikes, complicate any protection in opposition to them, or add to their psychological impact on civilians.
“The cyber incident exacerbates the affect of the bodily assault,” says John Hultquist, Mandiant’s head of risk intelligence, who has tracked Sandworm for almost a decade and named the group in 2014. “With out seeing their precise orders, it is actually arduous on our aspect to make a willpower of whether or not or not that was on goal. I’ll say that this was carried out by a army actor and coincided with one other army assault. If it was a coincidence, it was a really fascinating coincidence.”
Nimbler, Stealthier Cybersaboteurs
The Ukrainian authorities’s cybersecurity company, SSSCIP, declined to completely affirm Mandiant’s findings in response to a request from WIRED, however it did not dispute them. SSSCIP’s deputy chair, Viktor Zhora, wrote in an announcement that the company responded to the breach final yr, working with the sufferer to “decrease and localize the affect.” In an investigation over the 2 days following the near-simultaneous blackout and missile strikes, he says, the company confirmed that the hackers had discovered a “bridge” from the utility’s IT community to its industrial management methods and planted malware there able to manipulating the grid.
Mandiant’s extra detailed breakdown of the intrusion reveals how the GRU’s grid hacking has developed over time to turn into much more stealthy and nimble. On this newest blackout assault, the group used a “residing off the land” strategy that has turn into extra frequent amongst state-sponsored hackers searching for to keep away from detection. As an alternative of deploying their very own {custom} malware, they exploited the reliable instruments already current on the community to unfold from machine to machine earlier than lastly working an automatic script that used their entry to the ability’s industrial management system software program, often known as MicroSCADA, to trigger the blackout.
In Sandworm’s 2017 blackout that hit a transmission station north of the capital of Kyiv, against this, the hackers used a custom-built piece of malware often known as Crash Override or Industroyer, able to robotically sending instructions over a number of protocols to open circuit-breakers. In one other Sandworm energy grid assault in 2022, which the Ukrainian authorities has described as a failed try to set off a blackout, the group used a newer model of that malware often known as Industroyer2.
