The 2015 attack on Ukrainian power companies is useful because CISA documented how it worked: stolen credentials, remote access over VPN, remote breaker operation, then wiper malware to slow recovery. Each stage maps to a control you can test today. This post walks the sequence and turns it into a checklist.
The sequence, as CISA describes it
CISA's alert lists these steps. Spear-phishing emails with malicious Office attachments likely delivered BlackEnergy malware, though its exact role is unconfirmed. The companies believe attackers obtained legitimate credentials. Operators outside the company then used remote tools over VPN to open breakers. KillDisk malware wiped systems and corrupted boot records. Serial-to-Ethernet devices at substations were disabled by corrupting their firmware. Server power supplies were scheduled to disconnect, which CISA assessed was meant to hinder restoration.
Stage by stage controls
Entry. Email with macro-laden attachments is old but still works. Block or sandbox risky attachment types, and keep patching.
Credentials. Stolen credentials turned a network foothold into control. CISA advises strong multi-factor authentication using dissimilar factor types, and limiting remote access so vendor connections are not persistent.
Remote operation. The attackers used the same tools operators use. Make remote sessions operator-controlled and time-limited, and alert on operations outside a change window.
Destruction. Wipers and firmware attacks target your ability to recover. Keep offline backups of configurations and tested restore steps for devices that cannot be easily replaced.
Segmentation. CISA recommends isolating ICS networks from untrusted networks, locking down unused ports and services, and using data diodes where one-way communication is enough.
A checklist to run this quarter
- Can you list every remote access path into the control network, including forgotten ones? CISA specifically calls out perimeter backdoors and forgotten access.
- Do vendor connections stay open all the time?
- Is application allowlisting in place on static machines such as HMIs and database servers?
- Do you have a written, exercised plan for safely operating or shutting down processes if the control system is breached?
- Is there an asset inventory that someone updates?
If you answer "I do not know" to the first or last question, start there.
What software vendors should add
If you sell to operators, ship the safe defaults: no shared vendor accounts, per-session approval, full audit logs of remote commands, and signed firmware. Operators can only follow CISA's advice if your product makes it practical.
Using the checklist in practice
Do not try to fix everything at once. Run the list as a short workshop with an operator, an IT lead and someone from the vendor side. For each question, write down the owner, the evidence and the date it was last checked. Items you cannot evidence become the backlog.
Pay most attention to the remote access question. The alert shows that outsiders used the same remote tools operators rely on, so the tool itself was not the flaw. Missing limits around who could use it, when and from where were the gap. A time-limited, approved session with logging turns the same tool from an open door into a controlled one.
Quick check
What did the attackers use to open the breakers?
Per CISA, operators outside the companies used existing remote administration tools or remote ICS client software over VPN connections, with credentials the companies believe were obtained earlier.
Why attack recovery as well as operations?
CISA noted wiped systems, disabled substation devices and scheduled power supply disconnects, which it assessed was meant to hinder restoration.
Sources
Last reviewed: 19 October 2026.
