Russian hackers thwarted in attempt to take out electrical grid, Ukrainians say

Russian losses near Kyiv and a looming onslaught in eastern Ukraine may be a factor in the attack, a Ukrainian official said.

The Ukrainian government repelled a Russian cyberattack that was set to take out multiple electricity substations and other parts of a grid serving 2 million people on April 8, the Ukrainian government said Tuesday.

The Russian military intelligence hacking group known as Sandworm — a prolific and persistent operation behind the infamous 2016 power grid hack in Ukraine — used a “more developed and sophisticated” version of the “Industroyer” malware used in the 2016 incident, said Victor Zhora, the deputy chief of Ukraine’s State Service of Special Communication and Information Protection, during a briefing with reporters Tuesday.

Analysts with Slovak cybersecurity firm ESET and Microsoft helped the Ukrainian government respond to the attack. ESET on Tuesday published an analysis of the malware, which it’s calling “Industroyer2.” The researchers say they believe it would have been able to control specific industrial control systems in order to cut power at an unidentified electrical facility.

In addition to Industroyer2, ESET researchers reported seeing Sandworm deploy several destructive malware families against the electrical infrastructure that were likely part of an effort to both obfuscate any analysis of the destructive hacking campaign and make systems inoperable and unrecoverable.

“We were able to identify it, fight it, and destroy it.”

— Victor Zhora, Ukrainian Cybersecurity Official

“We all know that they are preparing a major onslaught in the Donbas and Kharkiv oblast,” he said. “This is a result of the military failure of the Putin soldiers in Kyiv who have failed at Kyiv’s gate, and he regrouped his army to conquer the east of Ukraine. And likely such actions of his lieutenants in the cybersphere were to buttress and invigorate the hostilities of his soldiers who keep killing the civilian population in our country.”

MIT Technology Review reported Tuesday that Ukraine’s Computer Emergency Response Team originally said the hackers temporarily turned off nine stations. Zhora told Wired in response that the earlier CERT report was a “preliminary report” and that he stood by statements about deflecting the attack. Zhora expressed displeasure with the earlier report leaking.

Later Tuesday, a spokesperson for Zhora’s agency issued another statement: “We are aware about only one substation (with up to nine outgoing transmission lines) among which only one line may have witnessed minute idle period, potentially caused by fault tolerance mechanism.”

Cybersecurity experts and officials in the U.S. reacted quickly to Tuesday’s revelation from the Ukrainians. Jen Easterly, the director of the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) tweeted that her agency is working to exchange information with Ukraine’s Computer Emergency Response Team about the campaign:

John Hultquist, the vice president of intelligence analysis at cybersecurity firm Mandiant, said in a statement that “Sandworm is an apex predator, capable of serious operations, but they aren’t infallible. He added that “the best part of this story is the work by Ukraine CERT and ESET to stop these attacks, which would have probably only worsened Ukrainian suffering. It’s increasingly clear that one of the reasons attacks in Ukraine have been moderated is because defenders there are very aggressive and very good at confronting Russian actors.”

Updated 4/12/22: with additional reporting from MIT Technology Review and Wired, and Zhora and his agency.

Russian hackers disrupted Ukrainian electrical grid last year

The notorious Russian hacking group known as Sandworm took down a substation that caused a brief outage, according to a new Mandiant report.

Russian hacking operations target Ukrainian law enforcement

Ukrainian official: Russian hackers change tactics from disruptive attacks

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure