MITRE ATT&CKcampaign
C0028 2015 Ukraine Electric Power Attack
- Domain
- enterprise, ics
- Version
- 1.0
- Created
- 2023-09-27
Description
2015 Ukraine Electric Power Attack was a Sandworm Team campaign during which they used BlackEnergy (specifically BlackEnergy3) and KillDisk to target and disrupt transmission and distribution substations within the Ukrainian power grid. This campaign was the first major public attack conducted against the Ukrainian power grid by Sandworm Team.
Related
Attributed to · MITRE ATT&CK (1)
- G0034 Sandworm Team group
Uses · MITRE ATT&CK (39)
- T1691.001 Command Message sub-technique
- T1691.002 Reporting Message sub-technique
- T1692.001 Command Message sub-technique
- T1693.001 System Firmware sub-technique
- T1695.001 Serial COM sub-technique
- T1685 Disable or Modify Tools technique
- T0886 Remote Services technique
- S0607 KillDisk software (malware)
- T0813 Denial of Control technique
- T0814 Denial of Service technique
- T0816 Device Restart/Shutdown technique
- T0822 External Remote Services technique
- T0823 Graphical User Interface technique
- T0826 Loss of Availability technique
- T0827 Loss of Control technique
- T0828 Loss of Productivity and Revenue technique
- T0831 Manipulation of Control technique
- T0846 Remote System Discovery technique
- T0859 Valid Accounts technique
- T0867 Lateral Tool Transfer technique
- T0884 Connection Proxy technique
- T0885 Commonly Used Port technique
- T1071.001 Web Protocols sub-technique
- T1204.002 Malicious File sub-technique
- T1570 Lateral Tool Transfer technique
- T1059.005 Visual Basic sub-technique
- T1566.001 Spearphishing Attachment sub-technique
- T1056.001 Keylogging sub-technique
- T1070.004 File Deletion sub-technique
- T1136.002 Domain Account sub-technique