Sandworm [1] [2] [3] [4] [5] [6] [7], a Russia-backed hacking group believed to be linked to Russia’s GRU military intelligence agency [3], has been conducting cyber operations in support of the GRU since at least 2009. They primarily target entities in Ukraine but have also targeted European Union government organizations, NATO [1], and others.
Description
Sandworm recently carried out a disruptive cyber-attack on a Ukrainian critical infrastructure organization [5], utilizing novel techniques and backed by Russia’s GRU intelligence and special forces agency [6]. The attack caused a brief power outage by impacting industrial control systems (ICS) and operational technology (OT) [5] [6]. Sandworm potentially had access to the SCADA system for up to three months [1] [5]. The attack involved two disruptive events in October 2022, including a power outage and a wiper attack [5]. The first attack aimed to trip the victim’s substation circuit breakers [5], coinciding with mass Russian missile strikes against critical national infrastructure (CNI) targets in Ukraine [6]. The second attack involved the deployment of a new variant of CaddyWiper in the victim’s IT environment [5]. Mandiant’s response to the attack revealed the serious threat that Ukraine still faces and praised the exceptional work of Ukrainian defenders in preventing similar scenarios [6]. The attack demonstrated a clear evolution in Russia’s cyber-physical capabilities and suggests the maturity of the Kremlin’s offensive OT arsenal [6]. Sandworm is believed to be capable of developing similar capabilities against other OT systems worldwide [1] [6]. The attack also highlighted the psychological toll of such attacks on civilians and the growing maturity of Russia’s offensive OT arsenal.
Conclusion
The attack on Ukrainian critical infrastructure showcases Russia’s evolving cyber-physical attack capabilities and their potential to target other OT systems worldwide. It emphasizes the need for heightened security measures globally [4], particularly for entities using MicroSCADA systems [4]. Critical infrastructure operators worldwide should take this as a warning and fortify their defenses against similar threats [4]. The exceptional work of Ukrainian defenders and their partners has limited the impact of attacks in Ukraine [5], but the threat remains.
References
[1] https://www.helpnetsecurity.com/2023/11/09/ukrainian-power-grid-disruption/
[2] https://cyberscoop.com/sandworm-russia-ukraine-grid/
[3] https://siliconangle.com/2023/11/09/mandiant-russian-hackers-caused-power-outage-ukraine-2022-cyberattack/
[4] https://securityonline.info/mandiant-unveils-russian-cyber-espionage-in-ukraines-grid-disruption/
[5] https://www.infosecurity-magazine.com/news/russia-sandworm-disrupted-power/
[6] https://www.computerweekly.com/news/366558955/Revealed-How-Russias-Sandworm-ramped-up-attacks-on-Ukraines-critical-infrastructure
[7] https://techmonitor.ai/technology/cybersecurity/sandworm-power-cuts-ukraine-russia-cyberattack
