Ukraine power grid attack of 2015: could your org have caught it?

In December 2015, remote intruders caused power outages at three Ukrainian distribution companies, affecting about 225,000 customers, according to CISA. You can test your own readiness against that attack by checking remote access, credential hygiene, network separation, restoration plans and asset inventory. This checklist follows CISA's public account.

This post covers the December 2015 event described in CISA's alert. It does not draw conclusions about other incidents, and it does not blame the operators. Defending control systems is hard, and the useful question is what a careful organization can check.

What did CISA say happened?

CISA's alert says unscheduled outages hit Ukrainian power companies on 23 December 2015. Three regional electric distribution companies were affected, and other organizations were intruded upon without operational impact. The attacks at each company happened within 30 minutes of each other, which suggests coordination and earlier reconnaissance.

Operators remotely used circuit breakers. The attackers also wiped systems with KillDisk, corrupted firmware on serial to Ethernet devices, and scheduled UPS disconnects, which CISA's team assessed were meant to hinder restoration. BlackEnergy malware was found on the networks, though its exact role in the outages was not confirmed.

On access, CISA says the operators used remote administration tools or remote industrial control client software over VPN connections, and that the companies believe the attackers had obtained legitimate credentials beforehand. Spear phishing with malicious Office attachments was reported as a delivery route.

In July 2021 CISA added that the US Government attributes this activity to Russian nation-state cyber actors.

The checklist

Remote access

• Do you know every remote path into your control or operational networks, including vendor connections?
• Are vendor connections time limited and controlled by your operators, not left open permanently? CISA recommends avoiding persistent vendor connections.
• Is multi factor authentication in place for each remote route?

Credentials

• If an attacker held a valid VPN login today, what would they reach?
• Can you spot a legitimate account behaving oddly, such as a login at an unusual hour followed by control actions?

Separation

• Are control networks isolated from the corporate network and the internet, with unused ports and services locked down?
• Where one way communication is enough, do you use a one way device such as a data diode, as CISA suggests?

Endpoints

• Do key stations such as operator workstations allow only approved applications? CISA recommends application whitelisting, especially on static systems.

Recovery

• Have you tested operating or shutting down processes safely if the control system is compromised? CISA recommends contingency plans that you actually test.
• Could the attackers' delay tactics, such as damaged firmware and disabled backup power, stall your restoration?

Inventory and patching

• Do you have an asset inventory that includes embedded devices and their firmware?
• Do you run trusted hardware and software and patch on a schedule? CISA lists asset inventory and timely patching among its recommended practices.

Detection

• Do you have a process to act on detection content such as signatures, and to report suspicious activity?

Where software supply chain fits

The alert is mostly about access and operations, but two items touch software: corrupted device firmware and trusted software. Knowing what firmware and libraries run in field devices is a precondition for both. An SBOM for each device and a way to match it against new vulnerability advisories turn "we think we are fine" into a checkable statement. Safeguard builds SBOMs and scans them against vulnerability data, and it accepts SBOMs from vendors in SPDX and CycloneDX form. It does not monitor or defend operational networks.

What to do

1. List every remote access route and close or time limit the ones nobody owns.
2. Enforce multi factor authentication and review accounts used by vendors.
3. Map network separation and fix the gaps first on the paths into control systems.
4. Inventory embedded devices and firmware and ask suppliers for SBOMs.
5. Run a tabletop exercise for losing the control system while you restore manually.
6. Write the report and detection routine so suspicious activity gets reported.

Quick check

Sources

• CISA: IR Alert H-16-056-01, Cyber-Attack Against Ukrainian Critical Infrastructure, fetched 18 October 2026
• Safeguard CLI documentation, fetched 18 October 2026

Last reviewed: 18 October 2026.