On 23 December 2015, remote intrusions at three Ukrainian regional power distributors caused outages affecting about 225,000 customers, per CISA's alert IR-ALERT-H-16-056-01. Attackers used stolen credentials over VPN, operated breakers by hand, and wiped systems to slow recovery. The lessons are about remote access and recovery.
What happened
CISA's page, updated in July 2021 when the US government attributed the activity to Russian nation-state actors, describes unscheduled outages at three regional distribution companies. Three other organizations were also intruded upon but had no operational impact. The attacks at each company happened within 30 minutes of each other, and multiple attackers manually operated breakers at central and regional facilities.
How attackers got in
The alert says attackers likely acquired legitimate credentials beforehand and used them to connect through VPNs. They used existing remote administration tools at the operating system level, or remote ICS client software.
BlackEnergy malware was reportedly delivered by spear phishing with Office attachments, but its exact role is still unclear. The alert quotes the view that any remote access trojan could have been used. That is a good reminder that the malware name matters less than the access path.
What made recovery hard
- KillDisk malware erased files and corrupted boot records.
- In at least one case, Windows HMIs embedded in remote terminal units were overwritten.
- Serial-to-Ethernet devices at substations were disabled by corrupting their firmware.
- Server UPS shutdowns were scheduled through the remote management interface, which the team assessed was meant to hinder restoration.
The defenses CISA lists
- Use trusted hardware and software, keep asset inventories, patch on time and refresh technology on a plan.
- Develop and exercise contingency plans for operating or shutting down processes safely if an ICS is breached.
- Use application whitelisting, especially on static systems such as HMIs and database servers.
- Isolate ICS networks from untrusted networks, lock down unused ports, and use data diodes where one-way flow is enough.
- Keep remote access operator-controlled and time-limited, avoid persistent vendor connections, and use strong multifactor authentication with dissimilar factors.
- Close backdoors and unnecessary access paths at the perimeter.
Reading it in 2026
The incident is old, yet most of the list still appears in current guidance. Compare it with the 2025 primary mitigations covered in our post on the five first steps. Remote access, segmentation and manual operation are on both lists.
The alert also notes a limit of its own account. It draws on interviews with staff at six Ukrainian organizations, and the team could not independently review technical evidence of the attack when the original alert was written. Treat fine details with care.
Quick check
Was the malware confirmed as the cause?
No. CISA says the role of BlackEnergy remains unclear, and that other remote access tools could have been used.
Why did operators struggle to restore power?
Per the alert, wiper malware, overwritten HMIs, disabled substation devices and scheduled UPS shutdowns all slowed recovery.
Safeguard focuses on software supply chain risk in the applications you build and buy, such as dependency scanning and SBOMs, rather than grid control networks.
Sources
Last reviewed: 19 October 2026.
