Industroyer2 attack on Ukrainian power substation

On April 8, 2022, the Ukrainian Computer Emergency Response Team (CERT-UA), supported by ESET and Microsoft, intervened in an active Sandworm operation against a Ukrainian regional electricity provider that served approximately two million people. Investigation determined the attackers had been inside the utility's IT network since at least February 2022 and had moved laterally into the ICS environment by mid-March. A custom binary, named Industroyer2 by ESET, had been compiled on March 23 with hardcoded IEC 60870-5-104 information object addresses corresponding to the specific substation under attack; this differed structurally from the 2016 Industroyer / CrashOverride malware, which was modular and protocol-flexible. A scheduled task created at 15:02 UTC on April 8 was set to execute Industroyer2 at 16:10 UTC, followed at 16:20 UTC by CaddyWiper to destroy operator workstations and slow recovery; AWFULSHRED, SOLOSHRED, and ORCSHRED were prepared to wipe Linux and Solaris hosts running ABB MicroSCADA and supporting RTU connectivity. CERT-UA detection and removal of the staged payloads averted any actual customer-facing outage. ESET, Mandiant / Google TAG, and Dragos all attributed the operation to Sandworm (GRU Unit 74455); Dragos assessed activity-cluster overlap under its ELECTRUM designation.

No actual outage; counterfactual scope of approximately two million customers had the destructive sequence completed. Operational significance is doctrinal: this is the first Industroyer-class deployment since the 2016 Ukrainian power-grid attack, in wartime, and against a higher-value target.