C0028 2015 Ukraine Electric Power Attack
2015 Ukraine Electric Power Attack was a Sandworm Team campaign during which they used BlackEnergy (specifically BlackEnergy3) and KillDisk to target and disrupt transmission and distribution substations within the Ukrainian power grid. This campaign was the first major public attack conducted against the Ukrainian power grid by Sandworm Team.
| Item | Value |
|---|---|
| ID | C0028 |
| Associated Names | |
| First Seen | December 2015 |
| Last Seen | January 2016 |
| Version | 1.0 |
| Created | 27 September 2023 |
| Last Modified | 18 December 2024 |
| Navigation Layer | View In ATT&CK® Navigator |
Groups
| ID | Name | References |
|---|---|---|
| G0034 | Sandworm Team | 4 5 |
Techniques Used
| Domain | ID | Name | Use |
|---|---|---|---|
| enterprise | T1071 | Application Layer Protocol | - |
| enterprise | T1071.001 | Web Protocols | During the 2015 Ukraine Electric Power Attack, Sandworm Team used BlackEnergy to communicate between compromised hosts and their command-and-control servers via HTTP post requests. 1 |
| enterprise | T1059 | Command and Scripting Interpreter | - |
| enterprise | T1059.005 | Visual Basic | During the 2015 Ukraine Electric Power Attack, Sandworm Team installed a VBA script called vba_macro.exe. This macro dropped FONTCACHE.DAT, the primary BlackEnergy implant; rundll32.exe, for executing the malware; NTUSER.log, an empty file; and desktop.ini, the default file used to determine folder displays on Windows machines. 1 |
| enterprise | T1136 | Create Account | - |
| enterprise | T1136.002 | Domain Account | During the 2015 Ukraine Electric Power Attack, Sandworm Team created privileged domain accounts to be used for further exploitation and lateral movement. 1 |
| enterprise | T1133 | External Remote Services | During the 2015 Ukraine Electric Power Attack, Sandworm Team installed a modified Dropbear SSH client as the backdoor to target systems.1 |
| enterprise | T1562 | Impair Defenses | - |
| enterprise | T1562.001 | Disable or Modify Tools | During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry internet settings to lower internet security. 1 |
| enterprise | T1070 | Indicator Removal | - |
| enterprise | T1070.004 | File Deletion | During the 2015 Ukraine Electric Power Attack, vba_macro.exe deletes itself after FONTCACHE.DAT, rundll32.exe, and the associated .lnk file is delivered. 1 |
| enterprise | T1105 | Ingress Tool Transfer | During the 2015 Ukraine Electric Power Attack, Sandworm Team pushed additional malicious tools onto an infected system to steal user credentials, move laterally, and destroy data. 1 |
| enterprise | T1056 | Input Capture | - |
| enterprise | T1056.001 | Keylogging | During the 2015 Ukraine Electric Power Attack, Sandworm Team gathered account credentials via a BlackEnergy keylogger plugin. 12 |
| enterprise | T1570 | Lateral Tool Transfer | During the 2015 Ukraine Electric Power Attack, Sandworm Team moved their tools laterally within the corporate network and between the ICS and corporate network. 1 |
| enterprise | T1112 | Modify Registry | During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe, which in-turn launches the malware and communicates with C2 servers over the Internet. 1. |
| enterprise | T1040 | Network Sniffing | During the 2015 Ukraine Electric Power Attack, Sandworm Team used BlackEnergy’s network sniffer module to discover user credentials being sent over the network between the local LAN and the power grid’s industrial control systems. 3 |
| enterprise | T1566 | Phishing | - |
| enterprise | T1566.001 | Spearphishing Attachment | During the 2015 Ukraine Electric Power Attack, Sandworm Team obtained their initial foothold into many IT systems using Microsoft Office attachments delivered through phishing emails. 2 |
| enterprise | T1055 | Process Injection | During the 2015 Ukraine Electric Power Attack, Sandworm Team loaded BlackEnergy into svchost.exe, which then launched iexplore.exe for their C2. 1 |
| enterprise | T1018 | Remote System Discovery | During the 2015 Ukraine Electric Power Attack, Sandworm Team remotely discovered systems over LAN connections. OT systems were visible from the IT network as well, giving adversaries the ability to discover operational assets. 3 |
| enterprise | T1218 | System Binary Proxy Execution | - |
| enterprise | T1218.011 | Rundll32 | During the 2015 Ukraine Electric Power Attack, Sandworm Team used a backdoor which could execute a supplied DLL using rundll32.exe. 1 |
| enterprise | T1204 | User Execution | - |
| enterprise | T1204.002 | Malicious File | During the 2015 Ukraine Electric Power Attack, Sandworm Team leveraged Microsoft Office attachments which contained malicious macros that were automatically executed once the user permitted them. 2 |
| enterprise | T1078 | Valid Accounts | During the 2015 Ukraine Electric Power Attack, Sandworm Team used valid accounts on the corporate network to escalate privileges, move laterally, and establish persistence within the corporate network. 2 |
| ics | T0803 | Block Command Message | During the 2015 Ukraine Electric Power Attack, Sandworm Team blocked command messages by using malicious firmware to render serial-to-ethernet converters inoperable. 2 |
| ics | T0804 | Block Reporting Message | During the 2015 Ukraine Electric Power Attack, Sandworm Team blocked reporting messages by using malicious firmware to render serial-to-ethernet converters inoperable. 2 |
| ics | T0805 | Block Serial COM | During the 2015 Ukraine Electric Power Attack, Sandworm Team overwrote the serial-to-ethernet converter firmware, rendering the devices not operational. This meant that communication to the downstream serial devices was either not possible or more difficult. 1 |
| ics | T0885 | Commonly Used Port | During the 2015 Ukraine Electric Power Attack, Sandworm Team used port 443 to communicate with their C2 servers. 1 |
| ics | T0884 | Connection Proxy | During the 2015 Ukraine Electric Power Attack, Sandworm Team established an internal proxy prior to the installation of backdoors within the network. 1 |
| ics | T0813 | Denial of Control | During the 2015 Ukraine Electric Power Attack, KillDisk rendered devices that were necessary for remote recovery unusable, including at least one RTU. Additionally, Sandworm Team overwrote the firmware for serial-to-ethernet converters, denying operators control of the downstream devices. 12 |
| ics | T0814 | Denial of Service | During the 2015 Ukraine Electric Power Attack, power company phone line operators were hit with a denial of service attack so that they couldn’t field customers’ calls about outages. Operators were also denied service to their downstream devices when their serial-to-ethernet converters had their firmware overwritten, which bricked the devices. 2 |
| ics | T0816 | Device Restart/Shutdown | During the 2015 Ukraine Electric Power Attack, Sandworm Team scheduled the uninterruptable power supplies (UPS) to shutdown data and telephone servers via the UPS management interface. 21 |
| ics | T0822 | External Remote Services | During the 2015 Ukraine Electric Power Attack, Sandworm Team used Valid Accounts taken from the Windows Domain Controller to access the control system Virtual Private Network (VPN) used by grid operators. 1 |
| ics | T0823 | Graphical User Interface | During the 2015 Ukraine Electric Power Attack, Sandworm Team utilized HMI GUIs in the SCADA environment to open breakers. 2 |
| ics | T0867 | Lateral Tool Transfer | During the 2015 Ukraine Electric Power Attack, Sandworm Team moved their tools laterally within the ICS network. 1 |
| ics | T0826 | Loss of Availability | During the 2015 Ukraine Electric Power Attack, Sandworm Team opened the breakers at the infected sites, shutting the power off for thousands of businesses and households for around 6 hours. 21 |
| ics | T0827 | Loss of Control | During the 2015 Ukraine Electric Power Attack, operators were shut out of their equipment either through the denial of peripheral use or the degradation of equipment. Operators were therefore unable to recover from the incident through their traditional means. Much of the power was restored manually. 2 |
| ics | T0828 | Loss of Productivity and Revenue | During the 2015 Ukraine Electric Power Attack, power breakers were opened which caused the operating companies to be unable to deliver power, and left thousands of businesses and households without power for around 6 hours. 21 |
| ics | T0831 | Manipulation of Control | During the 2015 Ukraine Electric Power Attack, Sandworm Team opened live breakers via remote commands to the HMI, causing blackouts. 2 |
| ics | T0886 | Remote Services | During the 2015 Ukraine Electric Power Attack, Sandworm Team used an IT helpdesk software to move the mouse on ICS control devices to maliciously release electricity breakers. 4 |
| ics | T0846 | Remote System Discovery | During the 2015 Ukraine Electric Power Attack, Sandworm Team remotely discovered operational assets once on the OT network. 3 1 |
| ics | T0857 | System Firmware | During the 2015 Ukraine Electric Power Attack, Sandworm Team overwrote the serial-to-ethernet gateways with custom firmware to make systems either disabled, shutdown, and/or unrecoverable. 2 |
| ics | T0855 | Unauthorized Command Message | During the 2015 Ukraine Electric Power Attack, Sandworm Team issued unauthorized commands to substation breaks after gaining control of operator workstations and accessing a distribution management system (DMS) application. 2 |
| ics | T0859 | Valid Accounts | During the 2015 Ukraine Electric Power Attack, Sandworm Team used valid accounts to laterally move through VPN connections and dual-homed systems. Sandworm Team used the credentials of valid accounts to interact with client applications and access employee workstations hosting HMI applications. 21 |
Software
| ID | Name | Description |
|---|---|---|
| S0089 | BlackEnergy | 1 |
References
-
Booz Allen Hamilton. (2016). When The Lights Went Out. Retrieved December 18, 2024. ↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩
-
Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems. (2016, March 18). Analysis of the Cyber Attack on the Ukranian Power Grid: Defense Use Case. Retrieved March 27, 2018. ↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩↩
-
Charles McLellan. (2016, March 4). How hackers attacked Ukraine’s power grid: Implications for Industrial IoT security. Retrieved September 27, 2023. ↩↩↩
-
Andy Greenberg. (2017, June 28). How an Entire Nation Became Russia’s Test Lab for Cyberwar. Retrieved September 27, 2023. ↩↩
-
Scott W. Brady. (2020, October 15). United States vs. Yuriy Sergeyevich Andrienko et al.. Retrieved November 25, 2020. ↩