Industroyer/CRASHOVERRIDE Ukraine

On December 17, 2016, attackers using the Industroyer (also known as CRASHOVERRIDE) toolkit caused a one-hour outage at the Pivnichna substation north of Kyiv operated by Ukrenergo. Industroyer was the first malware framework purpose-built to speak ICS protocols (IEC 60870-5-101/104, IEC 61850, OPC DA), allowing the attackers to operate breakers without compromising operator workstations. ESET and Dragos attributed the toolkit to the Sandworm group.

Roughly one-fifth of Kyiv lost power for about an hour. Forensic investigators concluded the attack as deployed was a proof-of-capability — Industroyer also contained a wiper module that, had it executed as designed, would have prolonged the outage by overwriting protective relays.