The BlackEnergy Attack

Cyber-Attack on the Ukrainian Power Grid in 2015

Introduction

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

Context

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

Attackers

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

Target of Attack

Image Not Showing Possible Reasons
  • The image file may be corrupted
  • The server hosting the image is unavailable
  • The image path is incorrect
  • The image format is not supported
Learn More →

Motivation of Attack

  • Destabilisation
  • Influence
  • Chaos
  • Smoke screen

Method of Attack

  • Spear phishing attacks
  • Malware (BlackEnergy V3)
  • Denial of service attack (DDos)

Attack Phase 1

  • Surveillance of network
  • Spear phishing emails
  • Place sleeper malware in system
  • Locate user credentials and VPN

Attack Phase 2

  • DDos attack on customer call center
  • Activate malware
  • Take-over system
  • Disrupt communication between system and network
  • Open circuit breaker
  • Overwrite critical firmware
  • Damage disk drives

Aftermath

  • Forced manual operation for months
  • Paved the way for similar, bigger attacks
  • Confirmed existence of cyberwarfare

Protective Measures

  • Firewall
  • VPN

Risks/Vulnerabilities

  • No Two-Factor-Authetification
  • Lack of training with Spear phishing attacks
  • Leaked insider knowledge

Mitigation Opportunities

  • Two-Factor-Authetification
  • Better training
  • Surveilance and monitoring
  • Security reviews

Preperation

  • Disaster recovery exercises
  • Defense strategies
  • Security tests

Aspects of Information Security

  • Authenticity: Access to Engineer Accounts
  • Integrity: Modification of Firmware
  • Availability: Use of KillDisk Malware

Resources

Who turned out the lights in the Ukraine? 2015 Black Energy attack

CYBER-ATTACK AGAINST UKRAINIAN POWER PLANTS

BlackEnergy

Select a repo