On 23 December 2015, remote intruders at three Ukrainian regional electric distribution companies opened breakers, causing unscheduled outages for approximately 225,000 customers. CISA's alert says the attackers likely used stolen credentials and remote access tools, then wiped systems at the end to slow recovery.
What happened
The attacks were reportedly synchronised, within 30 minutes of each other, and followed extensive reconnaissance. Operators remotely opened breakers using either existing OS level remote administration tools or remote industrial control client software over VPN connections. The companies believe the attackers obtained legitimate credentials beforehand.
Power was restored, but all three companies were still running under constrained operations when the report was written. Three other organisations were also intruded upon without operational impact.
Making recovery harder
At the end of the attacks, KillDisk malware wiped systems by erasing files and corrupting the master boot record. Windows based HMIs inside remote terminal units were overwritten in at least one case. Serial to Ethernet devices at substations were made inoperable by corrupting their firmware. Server UPS disconnects were scheduled through the UPS management interface, assessed as an attempt to hinder restoration.
BlackEnergy malware was found on the networks, but its role is unconfirmed. It may have given initial access through spear phishing with malicious Office attachments.
Attribution and limits
A July 2021 update states the US Government attributes the activity to Russian nation state cyber actors. The interagency team interviewed staff at six Ukrainian organisations but could not independently review technical evidence, which is worth remembering when quoting details.
The physical angle
Opening a breaker is a normal operator action. The attackers did not need a clever exploit against a relay. They used the same interface a dispatcher uses, which is why identity and remote access controls carry so much weight in utilities.
Lessons from the alert
- Follow basic IT practice: trusted hardware and software, asset inventory, timely patching and planned refresh.
- Keep contingency plans for safe operation or shutdown, assuming the control system may be working against the process. Manual operation skills matter.
- Isolate control networks from untrusted networks, especially the internet, and lock down unused ports and services.
- Limit remote access: operator controlled, time limited, with no persistent vendor connections into control networks.
- Use strong multi factor authentication, avoiding combinations of similar tokens that can be stolen together.
- Find and remove backdoors such as forgotten functions in perimeter devices.
- Use application allowlisting on static systems such as HMIs and database servers, and run impact analysis before defensive changes.
For the 2003 blackout, a different failure that also hid information from operators, see the alarm software failure.
Quick check
Was malware the cause of the outage?
The report says operators remotely opened breakers. Malware such as KillDisk was used to wipe systems afterwards, and BlackEnergy's exact role is unconfirmed.
What is the first fix for a utility?
The alert puts basics first: inventory, patching, isolating control networks and controlling remote access with MFA.
Sources
Last reviewed: 19 October 2026.
