Novel OT Attack Used by Russians to Disrupt Power in Ukraine

In a significant escalation of cyber warfare tactics, the Russian-backed hacker group Sandworm has launched a sophisticated operational technology (OT) attack on Ukraine's power grid, causing widespread disruptions. This attack, detailed in reports by cybersecurity experts, marks a concerning advancement in the use of cyber tactics in the ongoing geopolitical conflict.

Mandiant, a cybersecurity firm owned by Google, revealed that the intrusion began as early as June 2022, culminating in two major disruptive events on October 10 and 12, 2022. The first event was a power outage, which was then followed by a wiper attack aimed at causing further disruption and removing forensic evidence.

"While we were unable to identify the initial access vector into the IT environment, Sandworm gained access to the OT environment through a hypervisor that hosted a supervisory control and data acquisition (SCADA) management instance for the victim’s substation environment," Mandiant reported.

The attack employed living off the land (LotL) techniques at the OT level, a method that enhances the attackers' ability to evade detection. The apparent intent attack was to trip Ukraine’s substation circuit breakers, causing unplanned power outages that coincided with mass missile strikes across Ukraine.

John Hultquist, Chief Analyst at Mandiant, highlighted the broader implications of such attacks, stating, "There’s not much evidence that this attack was designed for any practical, military necessity. Civilians are typically the ones who suffer from these attacks and they are probably carried out to exacerbate the psychological toll of the war."

Sandworm, also known as Telebots, Voodoo Bear, and Iron Viking, has been active since 2009 and is believed to be linked to Russia's military intelligence service, the GRU. The group has a history of disruptive and destructive attacks, particularly in Ukraine, using wiper malware. "Given Sandworm’s global threat activity and novel OT capabilities, we urge OT asset owners to take action to mitigate this threat," Mandiant researchers warned.

This recent attack by Sandworm not only demonstrates a growing maturity in Russia's offensive OT arsenal but also raises concerns about the evolving landscape of cyber warfare. As winter approaches, the impact of such attacks on civilian life and critical infrastructure becomes increasingly significant, underscoring the need for heightened cybersecurity measures.