A December outage in Ukraine that caused 225,000 customers to lose electricity was the work of hackers, a report prepared by US Department of Homeland Security officials has determined.
The report published Thursday by the DHS Industrial Control Systems Cyber Emergency Response Team largely agrees with analysis provided last month by a member of the SANS industrial control systems team—that the December 23 outage was caused by external hackers.
As Ars reported earlier, the unscheduled interruptions are the first confirmed instance of someone using hacking to generate a power outage.
None of the analysis so far has determined the precise role played by “BlackEnergy,” a malware package discovered in 2007 that infected at least three of the substations involved in the outage. While initial research speculated that BlackEnergy and an added data-wiping component called KillDisk may have given attackers access or allowed them to carry out destructive events causing the power to go out, the DHS report holds out the possibility that the two pieces of malware were used only after the outage in an attempt either to destroy evidence or make recovery more difficult.
Here’s the pertinent part of the DHS report:
Through interviews with impacted entities, the team learned that power outages were caused by remote cyber intrusions at three regional electric power distribution companies (Oblenergos) impacting approximately 225,000 customers. While power has been restored, all the impacted Oblenergos continue to run under constrained operations.
In addition, three other organizations, some from other critical infrastructure sectors, were also intruded upon but did not experience operational impacts.
The cyber-attack was reportedly synchronized and coordinated, probably following extensive reconnaissance of the victim networks.
According to company personnel, the cyber-attacks at each company occurred within 30 minutes of each other and impacted multiple central and regional facilities.
During the cyber-attacks, malicious remote operation of the breakers was conducted by multiple external humans using either existing remote administration tools at the operating system level or remote industrial control system (ICS) client software via virtual private network (VPN) connections.
The companies believe that the actors acquired legitimate credentials prior to the cyber-attack to facilitate remote access.
All three companies indicated that the actors wiped some systems by executing the KillDisk malware at the conclusion of the cyber-attack.
The KillDisk malware erases selected files on target systems and corrupts the master boot record, rendering systems inoperable.
It was further reported that in at least one instance, Windows-based human-machine interfaces (HMIs) embedded in remote terminal units were also overwritten with KillDisk.
The actors also rendered Serial-to-Ethernet devices at substations inoperable by corrupting their firmware.
In addition, the actors reportedly scheduled disconnects for server Uninterruptable Power Supplies (UPS) via the UPS remote management interface.
The team assesses that these actions were done in an attempt to interfere with expected restoration efforts.
Each company also reported that they had been infected with BlackEnergy malware; however, we do not know whether the malware played a role in the cyber-attacks.
The malware was reportedly delivered via spear phishing emails with malicious Microsoft Office attachments.
It is suspected that BlackEnergy may have been used as an initial access vector to acquire legitimate credentials; however, this information is still being evaluated.
It is important to underscore that any remote access Trojan could have been used and none of BlackEnergy’s specific capabilities were reportedly leveraged.
According to the SANS report, the attackers also flooded power authorities’ call centers with phone calls to confuse customer service representatives and to prevent real customers from getting through.
The DHS report is based on interviews with operations and IT staff at six Ukrainian organizations with first-hand experience of the events.
It’s not based on a first-hand technical analysis of any of the hardware or software involved.