Analysis of Ukraine power grid cyber-attack 2015

Abstract

In December 2015, a regional electricity distribution company in Ukraine reported service outages to its customers. The outages were due to a cyber-attack on the company's computers systems and SCADA systems. Seven 110 kV and 23,335 kV substations were disconnected for many hours. Later reports suggested that additional portions of the electricity distribution grid were impacted and forced the operators to switch to manual mode. The Ukraine power grid attack of 2015 is perhaps one of the most notable cyberattacks in the ICS industry. Over a period of six months, the attackers were successfully able to launch a series of sophisticated attacks that completely disabled the power system of Ukrainian power companies. The paper discusses the sequence of attacks that led to the final failure of the Ukraine power grid. Further it will highlight the details of each attack steps taken by the attacker. This attack vector can serve as the footprint of the potential threats an organisation might face in the event of a similar attack to the organisation.