Russian hackers disrupted Ukrainian electrical grid last year | CyberScoop<\/title> <meta name=\"description\" content=\"The notorious Russian hacking group known as Sandworm took down a substation that caused a brief outage, according to a new Mandiant report.\"> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/sandworm-russia-ukraine-grid\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"Russian hackers disrupted Ukrainian electrical grid last year\"> <meta property=\"og:description\" content=\"The notorious Russian hacking group known as Sandworm took down a substation that caused a brief outage, according to a new Mandiant report.\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/sandworm-russia-ukraine-grid\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:published_time\" content=\"2023-11-09T08:00:00+00:00\"> <meta property=\"article:modified_time\" content=\"2023-11-09T15:31:04+00:00\"> <meta property=\"og:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-4.jpg\"> <meta property=\"og:image:width\" content=\"1920\"> <meta property=\"og:image:height\" content=\"1280\"> <meta property=\"og:image:type\" content=\"image\/jpeg\"> <meta name=\"author\" content=\"Christian Vasquez\"> <meta name=\"twitter:card\" content=\"summary_large_image\"> <meta name=\"twitter:creator\" content=\"@chrismvasq\">  <link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-2\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1699561119g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress-next\/dist\/css\/related-posts-block-styles.min.css?m=1699388725g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-8\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1698989400g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=7dab012cdc88b5676610\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/77952\"><link rel=\"EditURI\" type=\"application\/rsd+xml\" title=\"RSD\" href=\"https:\/\/cyberscoop.com\/xmlrpc.php?rsd\">\n<meta name=\"generator\" content=\"WordPress 6.4.1\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=77952\">\n<link rel=\"alternate\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fsandworm-russia-ukraine-grid%2F\">\n<link rel=\"alternate\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fsandworm-russia-ukraine-grid%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"post-template-default single single-post postid-77952 single-format-standard\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/sandworm-russia-ukraine-grid\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--newsletter js-stickybar\" readability=\"0.82\"> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"25.854755784062\">\n<div class=\"single-article__header-content\" readability=\"30.591603053435\">\n<p> The notorious Russian hacking group known as Sandworm took down a substation that caused a brief outage, according to a new Mandiant report. <\/p>\n<\/p><\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"426\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year.jpg?resize=640%2C426&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-4.jpg 1920w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-4.jpg?resize=300,200 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-4.jpg?resize=768,512 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-4.jpg?resize=1024,683 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-4.jpg?resize=1536,1024 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-4.jpg?resize=600,400 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-4.jpg?resize=252,168 252w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-4.jpg?resize=506,337 506w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-4.jpg?resize=1013,675 1013w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-4.jpg?resize=1265,843 1265w\" sizes=\"(max-width: 1013px) 100vw, 1013px\"><figcaption> PARASKOVIIVKA, UKRAINE – DECEMBER 17: An electric substation of salt mine on December 17, 2022 in Paraskoviivka, Ukraine. Now local residents remain in the village and the military of the Armed Forces of Ukraine. There is no electricity, the village is under constant shelling. Communication works only on the pedestrian bridge via the railway. The salt mines of the state enterprise “Artemsil” stopped working due to hostilities at the end of May. (Photo by Vitalii Pavlenko\/Global Images Ukraine via Getty Images) <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"74.539723661485\"><body readability=\"150.78417056075\"><\/p>\n<p>The notorious Russian hackers known as Sandworm attacked an electrical substation in Ukraine last year and caused a brief power outage, according to a report released Thursday by the cybersecurity firm Mandiant.<\/p>\n<p>The attack is the first time since 2017 that the power has gone out in Ukraine due to a cyberattack, and Thursday\u2019s report sheds new light on how Russian hackers are carrying out digital attacks on Ukrainian infrastructure since last year\u2019s invasion.<\/p>\n<p>A hacking group linked to Russia\u2019s Main Intelligence Directorate (GRU), Sandworm, carried out the attack by relying on tools already found on the substation\u2019s operational technology networks before using a wiper to cover their tracks on the victim\u2019s IT networks, according to Mandiant, which was acquired by Google last year.<\/p>\n<p>The attack appears to have been carried out to achieve a psychological impact rather than a specific military objective, said John Hultquist, Mandiant\u2019s chief analyst.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>\u201cThere\u2019s not much evidence that this attack was designed for any practical, military necessity. Civilians are typically the ones who suffer from these attacks and they are probably carried out to exacerbate the psychological toll of the war,\u201d Hultquist said. \u201cIt\u2019s important that we not lose sight of the serious threat Ukraine is still facing, especially as winter approaches.\u201d<\/p>\n<p>The attack on the Ukrainian grid represents one component of broad, frequent attacks on Ukrainian infrastructure by Russian hackers. Both private and public entities in Ukraine have faced thousands of cyberattacks since Russia invaded, but Kyiv has been fairly successful in repelling these digital assaults. The attack on Ukraine\u2019s grid described by Mandiant this week is the first known instance of Russian hackers successfully turning out the lights since the February 2022 invasion.<\/p>\n<p>It\u2019s not clear how Sandworm initially got into the substation\u2019s networks, but the initial intrusion is thought to have happened sometime around June 2022. On Oct. 10, 2022, the attackers cut power by manipulating the substation\u2019s systems. The power outage lasted less than a day, according to Mandiant. <\/p>\n<p>Two days later, Sandworm deployed a variant of the Caddywiper malware on the IT networks of the substation to hide its tracks.<\/p>\n<p>Sandworm is among the most enduring and effective publicly known Russian hacking operations. The group has been blamed for the NotPetya attack, which is believed to be the most economically damaging cyberattack on record, and attacks on the <a href=\"https:\/\/www.wired.com\/story\/untold-story-2018-olympics-destroyer-cyberattack\/\">2018 Winter Olympics<\/a> in South Korea.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>Sandworm has carried out a series of attacks on the Ukrainian grid since seizing control of the Crimean peninsula in 2014, kicking off the conflict between Moscow and Kyiv. In 2016 and 2017, Sandworm successfully attacked the Ukrainian grid, shutting off power in the dead of winter. <\/p>\n<p>The group has a long-standing focus on Ukraine, the researchers said Thursday, deploying multiple rounds of wiper malware both before and after Russia\u2019s 2022 invasion. Ukraine\u2019s Computer Emergency Response Team (CERT-UA), which tracks the group as <a href=\"https:\/\/cert.gov.ua\/article\/39518\">UAC-0082<\/a>, has blamed the unit for multiple incidents during the war, including a thwarted <a href=\"https:\/\/cyberscoop.com\/ukrainian-electrical-grid-industroyer2-russia-sandworm\/\">attack on several electricity substations<\/a> and other parts of a grid serving 2 million people in April 2022, Ukrainian officials said at the time. <\/p>\n<p>Victor Zhora, a top Ukrainian cyber official, said that this was the second time a \u201ccyber weapon\u201d was used against Ukrainian energy companies since the Russian invasion last year. Speaking at the CYBERWARCON security conference in Arlington, Va., on Thursday, Zhora said that the latest attacks were \u201cthankfully, not very effective,\u201d though he did point to other outages that could have been caused by a cyberattack.<\/p>\n<p>Ukrainian officials have also blamed Russian hackers for deploying the malware Industroyer.V2, which was discovered before it could be used to disrupt power.<\/p>\n<p>Since the launch of Russia\u2019s full-blown invasion last year, analysts have puzzled over the extent to which the Kremlin has succeeded in integrating kinetic and cyber operations. The invasion coincided with a Russian attack on a Viasat satellite internet system, disrupting communications for Kyiv at a crucial moment in the conflict. But as the conflict has dragged on, Russian cyber operations <a href=\"https:\/\/cyberscoop.com\/black-hat-russia-china-ukraine\/\">have shifted toward intelligence gathering<\/a>. <\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>The attack on the substation may be a rare example of coordinated Russian cyber and kinetic attacks, but that remains difficult to confirm. Mandiant\u2019s analysts note that the attack on the Ukrainian substation coincided with the \u201cstart of a multi-day set of coordinated missile strikes on critical infrastructure across Ukraine,\u201d but caution that they \u201clack sufficient evidence to assess a possible link.\u201d<\/p>\n<p>Nathan Brubaker, head of emerging threat and analytics at Mandiant, said that Sandworm could have carried out the attack weeks earlier. \u201cSandworm is a very, very capable and well-resourced organization, so without question, they could have done this sooner if they wanted to,\u201d Brubaker said.<\/p>\n<p>Sandworm appears to have developed the operational technology component of the attack in around two months. Successful attacks on industrial plants or utilities that target operational technology typically take much longer due to the complex and unique nature of each industrial facility. The speed with which Sandworm developed the attack speaks to its resources and the skills of its members.<\/p>\n<p>Sandworm\u2019s substation attack relied entirely on tools already present in the target environment \u2014 a technique known as \u201cliving off the land.\u201d This gave Sandworm added flexibility to carry out the attack, while also making it harder for defenders to detect them.<\/p>\n<p>It also means that instead of spending millions of dollars to develop complex OT-specific malware \u2014 like the <a href=\"https:\/\/www.eenews.net\/articles\/the-inside-story-of-the-worlds-most-dangerous-malware\/\">Russian-developed Triton malware<\/a> that targeted a Saudi Arabian petrochemical plant in 2017 \u2014 Sandworm could instead rely on its members\u2019 exquisite understanding of the system they attacked to disable it, Brubaker said.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>While it\u2019s unclear how Sandworm carried out the initial intrusion, after gaining access to the substation the hackers used commands within an end-of-life MicroSCADA control system to likely open circuit breakers, causing the outage.<\/p>\n<p>What\u2019s concerning is that there is nothing unique about the MicroSCADA device, meaning that Sandworm can \u201ccarry out some similar type of attack at some other target anywhere in the world, theoretically, using what\u2019s present in the local environment,\u201d Brubaker said.<\/p>\n<p>\u201cIt makes it really difficult for the defender,\u201d he added. \u201cThey have to both defend against malware coming in, or new files coming in, and existing technologies and files and software that exists.\u201d<\/p>\n<p><\/body> <\/p>\n<footer class=\"single-article__footer\">\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<div class=\"popular-stories__stories\">\n<div class=\"popular-stories__cards\">\n<article class=\"post-item post-item--popular-stories-cards \" readability=\"21.831081081081\">\n<figure class=\"post-item__thumbnail\"> <a class=\"post-item__thumbnail-link\" href=\"https:\/\/cyberscoop.com\/russia-hackers-winrar-drone\/\" tabindex=\"-1\"> <img data-recalc-dims=\"1\" loading=\"lazy\" width=\"506\" height=\"337\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-1.jpg?resize=506%2C337&ssl=1\" class=\"attachment-ratio-16-9-md size-ratio-16-9-md wp-post-image\" alt decoding=\"async\" loading=\"lazy\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-5.jpg 1920w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-5.jpg?resize=300,200 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-5.jpg?resize=768,512 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-5.jpg?resize=1024,683 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-5.jpg?resize=1536,1024 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-5.jpg?resize=600,400 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-5.jpg?resize=252,168 252w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-5.jpg?resize=506,337 506w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-5.jpg?resize=1013,675 1013w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-5.jpg?resize=1265,843 1265w\" sizes=\"auto, (max-width: 506px) 100vw, 506px\"> <\/a><figcaption class=\"screen-reader-text\"> An operator of the volunteer organization \u2018Postup\u2019 controls the flight of an UAV carrying a metal detector to search for mines near the town of Derhachi, Kharkiv region, on October 1, 2023. (SERGEY BOBOK \/ AFP) <\/figcaption><\/figure>\n<header class=\"post-item__meta\" readability=\"2.5152838427948\">\n<h3 class=\"post-item__title\"> <a class=\"post-item__title-link\" href=\"https:\/\/cyberscoop.com\/russia-hackers-winrar-drone\/\"> Russian hackers offered phony drone training to exploit WinRAR vulnerability <\/a> <\/h3>\n<p> Despite an August patch, Russian and Chinese state-backed hackers are using a vulnerability in the popular software to carry out espionage. <\/p>\n<div class=\"post-item__byline\"> <span class=\"post-item__author\"> <span>By <\/span> <a class=\"post-item__author-link\" href=\"https:\/\/cyberscoop.com\/author\/aj-vicens\/\"> AJ Vicens <\/a> <\/span> <\/div>\n<p> <\/header>\n<p> <\/article>\n<article class=\"post-item post-item--popular-stories-cards \">\n<figure class=\"post-item__thumbnail\"> <a class=\"post-item__thumbnail-link\" href=\"https:\/\/cyberscoop.com\/russia-hacking-law-enforcement\/\" tabindex=\"-1\"> <img data-recalc-dims=\"1\" loading=\"lazy\" width=\"258\" height=\"168\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-2.jpg?resize=258%2C168&ssl=1\" class=\"attachment-ratio-16-9-sm size-ratio-16-9-sm wp-post-image\" alt decoding=\"async\" loading=\"lazy\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-6.jpg 1920w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-6.jpg?resize=300,195 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-6.jpg?resize=768,499 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-6.jpg?resize=1024,666 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-6.jpg?resize=1536,998 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-6.jpg?resize=600,390 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-6.jpg?resize=258,168 258w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-6.jpg?resize=518,337 518w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-6.jpg?resize=1038,675 1038w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-6.jpg?resize=1297,843 1297w\" sizes=\"auto, (max-width: 258px) 100vw, 258px\"> <\/a><figcaption class=\"screen-reader-text\"> A mural near the Giraffe shopping mall depicting two girls drawing a lightning bolt in the colors of the Ukrainian flag on September 25, 2023 in Bucha, Ukraine. (Photo by Andrii Nesterenko\/Global Images Ukraine via Getty Images) <\/figcaption><\/figure>\n<header class=\"post-item__meta\">\n<h3 class=\"post-item__title\"> <a class=\"post-item__title-link\" href=\"https:\/\/cyberscoop.com\/russia-hacking-law-enforcement\/\"> Russian hacking operations target Ukrainian law enforcement <\/a> <\/h3>\n<div class=\"post-item__byline\"> <span class=\"post-item__author\"> <span>By <\/span> <a class=\"post-item__author-link\" href=\"https:\/\/cyberscoop.com\/author\/aj-vicens\/\"> AJ Vicens <\/a> <\/span> <\/div>\n<p> <\/header>\n<p> <\/article>\n<article class=\"post-item post-item--popular-stories-cards \">\n<figure class=\"post-item__thumbnail\"> <a class=\"post-item__thumbnail-link\" href=\"https:\/\/cyberscoop.com\/sandworm-ukraine-infamous-chisel\/\" tabindex=\"-1\"> <img data-recalc-dims=\"1\" loading=\"lazy\" width=\"252\" height=\"168\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-3.jpg?resize=252%2C168&ssl=1\" class=\"attachment-ratio-16-9-sm size-ratio-16-9-sm wp-post-image\" alt decoding=\"async\" loading=\"lazy\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-7.jpg 1920w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-7.jpg?resize=300,200 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-7.jpg?resize=768,512 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-7.jpg?resize=1024,683 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-7.jpg?resize=1536,1024 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-7.jpg?resize=600,400 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-7.jpg?resize=252,168 252w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-7.jpg?resize=506,337 506w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-7.jpg?resize=1013,675 1013w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2023\/11\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year-7.jpg?resize=1265,843 1265w\" sizes=\"auto, (max-width: 252px) 100vw, 252px\"> <\/a><figcaption class=\"screen-reader-text\"> A Russian police officer guards the Red Square near the Kremlin, June 24, 2023, in Moscow, Russia. (Photo by Contributor\/Getty Images) <\/figcaption><\/figure>\n<header class=\"post-item__meta\">\n<h3 class=\"post-item__title\"> <a class=\"post-item__title-link\" href=\"https:\/\/cyberscoop.com\/sandworm-ukraine-infamous-chisel\/\"> \u2018Five Eyes\u2019 nations release technical details of Sandworm malware \u2018Infamous Chisel\u2019 <\/a> <\/h3>\n<div class=\"post-item__byline\"> <span class=\"post-item__author\"> <span>By <\/span> <a class=\"post-item__author-link\" href=\"https:\/\/cyberscoop.com\/author\/cvasquez\/\"> Christian Vasquez <\/a> <\/span> <\/div>\n<p> <\/header>\n<p> <\/article>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/sandworm-russia-ukraine-grid\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Russian hackers disrupted Ukrainian electrical grid last year | CyberScoop<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1190,873,874,270,880,288,354,1191],"tags":[1192,875,876,276,881,294,358,1193],"class_list":["post-2026","post","type-post","status-publish","format-standard","hentry","category-electric-grid","category-ics","category-operational-technology","category-russia","category-sandworm","category-threats","category-ukraine","category-ukraine-power-outage","tag-electric-grid","tag-ics","tag-operational-technology","tag-russia","tag-sandworm","tag-threats","tag-ukraine","tag-ukraine-power-outage"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/electric-grid\/\" rel=\"category tag\">electric grid<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/ics\/\" rel=\"category tag\">ics<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/operational-technology\/\" rel=\"category tag\">operational technology<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/russia\/\" rel=\"category tag\">Russia<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/sandworm\/\" rel=\"category tag\">Sandworm<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/threats\/\" rel=\"category tag\">Threats<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/ukraine\/\" rel=\"category tag\">Ukraine<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/ukraine-power-outage\/\" rel=\"category tag\">Ukraine power outage<\/a>","tag_info":"Ukraine power outage","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/2026","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=2026"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/2026\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=2026"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=2026"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=2026"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":2026,"date":"2023-11-09T08:00:00","date_gmt":"2023-11-09T08:00:00","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=77952"},"modified":"2023-11-09T08:00:00","modified_gmt":"2023-11-09T08:00:00","slug":"russian-hackers-disrupted-ukrainian-electrical-grid-last-year","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2023\/11\/09\/russian-hackers-disrupted-ukrainian-electrical-grid-last-year\/","title":{"rendered":"Russian hackers disrupted Ukrainian electrical grid last year"},"content":{"rendered":"