People ask for the most notorious cyberattacks, but a ranking is a matter of opinion. A better list is the attacks with public, government-authored technical records. Four stand out: the 2015 Ukrainian grid outage, NotPetya in 2017, the SolarWinds Orion compromise and the 2021 pipeline ransomware. Each teaches a different lesson.
What happened to the Ukrainian power grid in 2015?
On 23 December 2015, power companies in Ukraine had unscheduled outages. An interagency team led by ICS-CERT interviewed staff at six Ukrainian organizations. The report says remote intrusions at three regional distribution companies affected approximately 225,000 customers. Multiple external humans operated breakers remotely, using remote administration tools or industrial control client software over VPN connections. The companies believed the actors had obtained legitimate credentials beforehand. KillDisk malware was then used to wipe systems.
Lesson: Remote access with stolen credentials can reach operational systems. Strong authentication on remote paths and a clean boundary between corporate IT and control networks matter. The team also noted it could not independently review technical evidence, so the account is based on interviews.
What was NotPetya?
On 27 June 2017, a Petya variant spread across multiple countries and sectors. CISA's alert says it differed from earlier Petya mainly in how it propagated. It used stolen Windows credentials through a modified Mimikatz tool with built-in administration tools, and the SMB exploits EternalBlue and EternalRomance against unpatched systems. Microsoft had released the MS17-010 update in March 2017. The alert notes there is no evidence of a relationship between the encryption key and the victim ID, so decryption may be impossible even if a ransom is paid, and that it behaves like destructive malware more than ransomware. The alert was later updated to reflect the US Government's public attribution to the Russian military.
Lesson: Patch what is exploited, and do not let one stolen credential reach every machine. Flat networks turn one infection into thousands.
What was the SolarWinds Orion compromise?
In December 2020, CISA issued Emergency Directive 21-01. It said Orion versions 2019.4 through 2020.2.1 HF1 were being exploited, and that disconnecting affected devices was the only known mitigation available at the time. The US Government later attributed the activity to the Russian Foreign Intelligence Service (SVR). The directive has since been sunset by CISA.
Lesson: Trusted management software with broad network access is a high-value target. Know which products have that reach, and be ready to isolate them. This is supply chain risk in its plainest form.
What was the Colonial pipeline ransomware incident?
CISA and FBI's advisory AA21-131A says DarkSide ransomware was deployed against a pipeline company's IT network, with no indication that operational technology networks were directly affected. The company reported proactively disconnecting some OT systems. DarkSide is ransomware as a service, where developers share proceeds with affiliates. The advisory recommends segmentation between IT and OT, tested manual controls, and backups that are isolated and tested.
Lesson: An IT incident can force an operational shutdown out of caution. Practice running manually.
What do they have in common?
- Valid credentials or trusted tools did the work in three of the four.
- Network segmentation limited, or would have limited, spread.
- Recovery depended on backups and manual procedures that had been rehearsed.
- Attribution came later and from governments. Treat early claims with care.
"Cyber warfare" is a loose term, and these cases differ. Read each primary record for exactly what is established.
How to check or apply this
- Test whether a stolen low privilege credential could reach your crown jewels, and cut the paths.
- Segment IT from OT and sensitive systems from the general network.
- List software with broad management reach and plan how to isolate it quickly.
- Rehearse manual operations and restoration from isolated backups.
- Track vulnerabilities that attackers exploit, not only those with high scores.
Quick check
Was NotPetya ransomware?
CISA's analysis says it behaves more like destructive malware than ransomware, because the key and victim ID were not linked in the analyzed sample.
Where can I read the primary records?
CISA publishes the alerts and directives listed below.
Sources
- CISA ICS-CERT, IR-ALERT-H-16-056-01, Cyber-Attack Against Ukrainian Critical Infrastructure
- CISA, Petya Ransomware (NotPetya) alert
- CISA, Emergency Directive 21-01, Mitigate SolarWinds Orion Code Compromise
- CISA, AA21-131A, DarkSide Ransomware: Best Practices for Preventing Business Disruption
Last reviewed: 18 October 2026.
