Ukraine BlackEnergy 3 power grid attack

On December 23, 2015, attackers using the BlackEnergy 3 toolkit and the KillDisk wiper opened breakers across three Ukrainian regional electricity distribution companies — Prykarpattyaoblenergo, Chernivtsioblenergo, and Kyivoblenergo — causing the first publicly confirmed power grid outage caused by a cyber attack. The attackers also flooded customer service phone lines and overwrote firmware on serial-to-ethernet converters to slow recovery. SBU, ICS-CERT, and SANS attributed the attack to the Russian Sandworm group.

Approximately 225,000 customers lost power for one to six hours across the three oblasts. Operators restored service by switching breakers manually at substations; the affected serial-to-ethernet devices required firmware re-flashing months later.