A power blackout in Ukraine over Christmas and a destructive cyberattack on a major Ukrainian media company were caused by the same malware from the same major hacking group, known as Sandworm, according to security researchers at Symantec.
The blackout, which affected large parts of western Ukraine, is believed to be the first example of a power outage deliberately caused by a hacking attack. The country’s state intelligence agency, the SBU, attributed the attacks to state-sponsored hackers from Russia. If true, that would link the hacking of the power grid to the general escalation of cyberwarfare between the two nations in the aftermath of the invasion of Crimea.
That attribution was strengthened by the revelation that the hacking of power company Prykarpattyaoblenergo was carried out using malware substantially similar to an earlier attack, which affected the computers of a Ukranian media company in late October 2015.
Symantec researchers say that initially, a computer at the media company was compromised by malware called “BlackEnergy”. “The attackers appear to have used this infection to retrieve administrator credentials and used them to execute Disakil [a second type of Malware] on a number of computers. Communication from these computers halted after Disakil was executed, suggesting that it succeeded in wiping them and rendering them inoperable.
“The group behind the BlackEnergy Trojan is known as Sandworm and has a history of targeting organizations in Ukraine. It has also been known to attack Nato, a number of western European countries, and companies operating in the energy sector.”
The same malware was implicated in the attack on the country’s power grid, according to Robert Lee of information security firm Sans, who wrote that “if the malware does end up being related to the BlackEnergy2 campaign then this adds to the possibility that the facility … was specifically targeted”.
The link to BlackEnergy was backed up by Eugene Bryskin, of the Ukrainian government’s Computer Emergency Response Team. Bryskin told Forbes that Sans’ suspicions were accurate, particularly the link to BlackEnergy.
Hacking attacks on physical infrastructure have long been a concern among the security community, but have been rarely seen in practice.
Part of that is due to the nature of the industrial control systems for critical infrastructure, which tend not to be connected to the wider internet, and to use poorly understood proprietary instruction sets. This sort of “security by obscurity” provides a high hurdle for potential attackers to leap, but as hacking becomes an accepted part of international conflict, the resources available to attackers have rendered physical infrastructure a tempting target.
In 2013, researchers with industrial consultants Automatak found 25 serious vulnerabilities in the control systems for power plants, and warned that the security through obscurity was a false comfort. “If someone tries to breach the control centre through the internet, they have to bypass layers of firewalls. But someone could go out to a remote substation that has very little physical security and get on the network and take out hundreds of substations potentially. And they don’t necessarily have to get into the substation either.”
When it comes to Ukraine, however, it doesn’t look like the attackers had to go that far. Analysis of the malware suggests that the main vector of attack was a compromised Excel spreadsheet, which was used to run the malware on computers within the power company’s control centre. It would then seek out some specific programs used as part of the industrial control system, and simply erase them before restarting the computer.
