Industroyer2 Attempted Attack on Ukrainian Substations (2022)
Volume 2Energy edition2022Last verified 12 sources, 8 primaryAttributed by CERT-UA to Sandworm
In April 2022 an attacker staged malware inside a Ukrainian energy company, loaded with real substation addresses and timed for Friday evening. The power stayed on. The outage often blamed on it came in October, with other tools.
The most repeated fact about Industroyer2 is the one thing it did not do. Wikipedia’s article, read 24 September 2026, says it “initiated a blackout.” It did not: Ukraine’s government said the defenders prevented an outage. The attempt was real and close. The attacker had been inside since February at the latest, built a tool that speaks the protocol used to open breakers, loaded eight real device addresses and scheduled it for a Friday evening, with a wiper ten minutes behind. The defenders did well, in wartime, against a clock.
The question is what they had to work with. On the public record, what stood between a scheduled task and eight substation devices was people finding it in time. Nothing shows a path that was closed or a command that would have been refused. That reading is BlastWave’s analysis, not a disclosed fact. October is the harder lesson: once the path exists, the attacker does not need Industroyer2 at all.
What is not known: Nobody has published what stopped it. CERT-UA says the plan was prevented; ESET credits a prompt response by the defenders, CERT-UA and its own help; SSSCIP’s Victor Zhora said they were very lucky. Whether the scheduled task was removed before 16:10 UTC, fired and failed, or never ran is not on the record. Nor is the SCADA component said to be disrupted, the company’s name, how the attacker got in, what let it reach the relays, or what the wipers destroyed. No US, UK or EU attribution of it has been found.
Recommendation
Take the path away Nothing on the business network or domain should reach a host that speaks IEC 104 to a substation. A machine that schedules tasks and can address a relay is the finding.
Remove standing command authority Accept control commands only from a named control-centre master in an authenticated session. Plain IEC 104 does not check who is talking; IEC 62351 exists for this gap.
Make read-only consumers read one way Historians and reporting receive substation telemetry over a one-way path, so the systems that can send a breaker command are only those that must.
Sources: CERT-UA#4435, 12 Apr 2022; ESET, “Industroyer2: Industroyer reloaded,” 12 Apr 2022; AP, 12 Apr 2022; Mandiant, 25 Apr 2022 and 9 Nov 2023; No CISA advisory specific to this incident found. Full list with links.
Soft Spots: What stopped it is unpublished; no mechanism is on the record. The disrupted SCADA component is AP’s report of officials’ words. That nothing architectural stood in the way is BlastWave’s analysis, not a disclosed fact.
The full record
Every claim numbered to its source. Last updated .
Malware loaded with real substation addresses, scheduled for a Friday evening, and a power supply that stayed on. What is verified, what is only reported, and what is still unknown.
Summary
In April 2022, an attacker inside a Ukrainian energy company scheduled Industroyer2, malware loaded with eight substation device addresses, to run at 16:10 UTC on 8 April. CERT-UA and ESET disclosed it on 12 April and attributed it to Sandworm. Ukrainian officials said defenders prevented outages, and the power stayed on. What stopped it has never been published.1,2,6
Timeline of the Industroyer2 attempt
Every date is tied to a source. Press reporting appears only as evidence of what was said.
Initial compromise of the energy company, per CERT-UA. SSSCIP's Victor Zhora, as paraphrased by TechTarget SearchSecurity in August 2022, put it at 17 February and likely earlier.1,3
Industroyer2 compiled, according to the PE timestamp of the sample ESET analyzed.2
ESET is called in to analyze new malware discovered by CERT-UA, as reported from Black Hat in August 2022.3
CaddyWiper deployed on some Windows machines, with destructive malware for Linux and Solaris.2
An operator creates the scheduled task to launch Industroyer2.2,7
Scheduled execution time for Industroyer2, "to cut power." CERT-UA says the disconnection of substations was planned for Friday evening, 8 April. Whether the task fired is not on the record. The power stayed on.1,2,6,7
Scheduled execution time for CaddyWiper on the same machine, to erase Industroyer2's traces.2,7
CERT-UA (CERT-UA#4435) and ESET publish. Ukrainian officials brief reporters: one SCADA component disrupted, outages prevented.1,2,6
US agencies publish AA22-103A on the toolkit known as Pipedream, a separate case. The same day, Wikipedia's Industroyer article gains the sentence saying Sandworm "initiated a blackout" with Industroyer2.8,9
Mandiant publishes its analysis: two samples, carrying eight and three target addresses.4
ESET's Anton Cherepanov and Robert Lipovsky present the case at Black Hat USA, with the timeline in UTC.3,7
Mandiant later reports two disruptive events at a Ukrainian utility. On 10 October a different operation likely trips substation circuit breakers, causing an unplanned power outage, using the SCADA system's own tools rather than Industroyer2, according to Mandiant's report of November 2023.10
Wikipedia's Industroyer article still says Sandworm "initiated a blackout" with Industroyer2.9
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
Question
What the record says
Status
Did the power go out?
No. Ukrainian officials said defenders prevented electrical outages; CERT-UA wrote that the plan "has so far been prevented"1,6
Verified (CERT-UA; officials' statement via AP)
Was anything disrupted?
Officials said one component of the station's SCADA system. Which one, and by which malware, is not stated6
Reported (officials, via AP)
Was Industroyer2 deployed?
Yes. An operator created a scheduled task at 15:02 UTC to launch it at 16:10 UTC on 8 April 20222,7
Verified
Did the scheduled task fire?
Not on the record. No responder has said what happened at 16:10 UTC2,7
Undisclosed
What stopped it?
Unpublished. Responders credit the defenders, CERT-UA, ESET, Microsoft, and luck1,3,6
Undisclosed
Who was behind it?
Sandworm, per CERT-UA; ESET assesses it "with high confidence"1,2
Undisclosed. Inside no later than February 20221,2
Undisclosed
Which company was targeted?
Not named by any official source. A Ukrainian energy company operating high-voltage substations1,2
Undisclosed
How many device addresses?
Eight in the sample ESET analyzed; three in a second sample Mandiant found2,4
Verified (researcher analysis)
Did Industroyer2 cause the October 2022 outage?
No. Mandiant attributes that outage to a different operation using a native MicroSCADA binary10
Verified (researcher report)
Financial impact
Not published
Undisclosed
Did Industroyer2 cause a blackout in Ukraine?
No. Ukrainian officials said the people defending the station prevented electrical outages. At a briefing on 12 April 2022, as reported by the Associated Press, officials said that "people defending the station were able to prevent electrical outages."6
"The threat was serious, but it was prevented in a timely manner."
That is not the same as no effect at all. According to AP, "the malware succeeded in disrupting one component of the impacted power station's management systems, also known as SCADA systems."6 Which component, and whether Industroyer2 or a wiper did it, is not stated. TechTarget SearchSecurity reported in August 2022 that the CaddyWiper attack "caused more disruption than Industroyer2," which leans toward the wiper but does not settle it.3
The figure of 2 million people is a counterfactual. Deputy energy minister Farid Safarov said "2 million people would have been without electricity supply if it was successful."6 It is an estimate of what an attack that worked would have done, not a count of anyone affected.
Was Industroyer2 actually deployed?
Yes. It was on a machine inside the company, configured for real devices, and scheduled. ESET reported that Industroyer2 "only implements the IEC-104 (aka IEC 60870-5-104) protocol," the protocol a control center uses to tell a substation to open a breaker, and that "the analyzed sample contains eight different IP addresses of devices." It was compiled on 23 March 2022 according to its PE timestamp.2 Mandiant found a second sample: "One sample contains eight unique hardcoded target IP addresses, whereas the other only contains three."4
14:58: CaddyWiper deployed on some Windows machines, with destructive malware for Linux and Solaris.2
15:02: "Sandworm operator creates the scheduled task to launch Industroyer2."2,7
16:10: "Scheduled execution of Industroyer2 to cut power."2
16:20: "Scheduled execution of CaddyWiper on the same machine to erase Industroyer2 traces."2
16:10 UTC is 19:10 in Kyiv; that conversion is our arithmetic. CERT-UA says only that the disconnection of high-voltage substations was planned for "Friday evening, 8 April."1
Whether the 16:10 task fired is not on the record. ESET's analysis also says Industroyer2 "was deployed as a single Windows executable named 108_100.exe and executed using a scheduled task on 2022-04-08 at 16:10:00 UTC," while its timeline labels 16:10 a "scheduled execution." Neither sentence states what happened at 16:10, and none of ESET's written publications that we read says whether the task ran.2,7
What stopped the Industroyer2 attack?
Nobody has published the mechanism. Whether the scheduled task was removed before 16:10 UTC, fired and failed, or never ran is not on the record. What the responders have said is generous to each other and candid about luck. CERT-UA wrote that "the implementation of the malicious plan has so far been prevented," and thanked Microsoft and ESET.1
"a prompt response by the defenders at the targeted energy company and the work of CERT-UA and our assistance."
"It looks that we were very lucky."
At Black Hat, Zhora credited timely information sharing by ESET and Microsoft, and Lipovsky was reported as saying the malware's authors made some mistakes that allowed defenders to mitigate the attack before it could successfully trigger a blackout.3 Which mistakes, he did not say.
The defenders at the company, CERT-UA, ESET and Microsoft did well, in the second month of an invasion, against a clock. Nothing on this page questions that.
Who was behind Industroyer2?
Ukraine named Sandworm, and ESET agreed with high confidence. No US, UK or EU government attribution of this incident specifically has been found. CERT-UA's bulletin of 12 April 2022 names the Sandworm group, which it tracks as UAC-0082.1
"We assess with high confidence that the APT group Sandworm is responsible for this new attack."
The US joint advisory AA22-110A of 20 April 2022 names the 2016 CrashOverride/Industroyer deployment and does not mention Industroyer2.5 UK and EU statements from April 2022 were not checked, so the absence of a Western government attribution is a finding of none found as of late September 2026, not proof that none exists. Governments have named Sandworm for other operations; those statements are not borrowed here.
How did the attackers get in and reach the substations?
Undisclosed. CERT-UA dates the initial compromise to no later than February 2022 and says the victim "suffered two waves of attacks," but gives no initial access vector.1 ESET wrote on the same day that it did not yet know how the attackers compromised the victim or how they moved from the IT network to the ICS network.2
CERT-UA records technique rather than cause: lateral movement between network segments through chains of SSH tunnels, remote execution with Impacket, and CaddyWiper distributed by Group Policy from the domain controller. Its target list covers Windows user computers, servers and ICS workstations, Linux servers and active network equipment; ESET adds Solaris.1,2 Nobody has published why a host on the victim's network was able to reach the relays.
What is still not known about Industroyer2
What stopped it: whether the scheduled task was removed before 16:10 UTC, fired and failed, or never ran.2,7
Which SCADA component Ukrainian officials said was disrupted, and whether Industroyer2 or a wiper disrupted it.3,6
Which mistakes by the malware's authors ESET said helped the defenders.3
The name of the energy company.
How the attacker got in.
Why the network let the attacker reach the relays. CERT-UA names chained SSH tunnels between segments, not the gap they crossed.1
What the wipers destroyed.
Whether any US, UK or EU government has attributed this incident. None found as of late September 2026.5
The financial cost.
Claims about Industroyer2 the record does not support
Widely repeated claim
What the record says
"In 2022, the Russian hacker group Sandworm initiated a blackout in Ukraine using a variant of Industroyer aptly dubbed Industroyer2." (Wikipedia, Industroyer article)
Ukrainian officials said defenders prevented electrical outages.6 The sentence has stood since 13 April 2022 and was live on 27 September 2026; the Wired article it cites is headlined "Russia's Sandworm Hackers Attempted a Third Blackout in Ukraine," and Wikipedia's own Sandworm article says "attempted."9 The outage that did happen was in October 2022, with different tools.10
Industroyer2 "was discovered before deploying, resulting in no impact." (MITRE ATT&CK)
ESET's timeline records an operator creating the scheduled task at 15:02 UTC on 8 April 2022. It was deployed and scheduled.2,7,11 Officials also said one SCADA component was disrupted.6
"Failed to take down Ukraine's energy grid in March."
TechTarget SearchSecurity, August 2022.3 CERT-UA and ESET place the planned attack on 8 April 2022; no primary record we read places it in March.1,2
"No later than February 22."
TechCrunch, 12 April 2022.12 CERT-UA says the initial compromise happened no later than February 2022; the day is probably a rendering error.1
Was Industroyer2 behind the October 2022 power outage in Ukraine?
No. The outage that did happen came six months later, from a different operation that used the SCADA system's own tools. Mandiant reported in November 2023 on two disruptive events at a Ukrainian utility on 10 and 12 October 2022. The attacker used the control system "to likely trip the victim's substation circuit breakers, causing an unplanned power outage that coincided with mass missile strikes."10
The tooling was not Industroyer2. Mandiant describes the attacker choosing to "execute a native MicroSCADA binary" and a script, "n.bat, which likely runs the native scilc.exe utility." It adds that the OT component "may have been developed in as little as two months."10 Mandiant attributes the October event to Sandworm; that is a vendor attribution of a different incident and is not used to strengthen the attribution of April.
BlastWave analysis: a real save, not an architecture
Analysis, not a disclosed fact
The attempt was real and it was close. The attacker had been inside since February at the latest, built a tool that spoke the protocol a control center uses to open breakers, loaded it with the addresses of eight real devices, and scheduled it for a Friday evening with a wiper set to erase the evidence ten minutes later.1,2 The question is what the defenders had to work with. On the public record, what stood between a scheduled task and eight substation devices was people finding it in time. Nothing in the record shows a path that was closed or a command that would have been refused. That reading is BlastWave's analysis, not a disclosed fact.
October is the harder lesson: once the path exists, the attacker does not need Industroyer2 at all.10 On this volume's consequence ladder, Industroyer2 sits at the top of OT-adjacent access and capability development: deployed and scheduled, with no corroborated physical effect.
Podcast: “The Outgoing Tray” (9:00). Joe Baxter and Cam Cullen on why a save that depends on people finding a scheduled task in time is a real save, and not an architecture.
Video: Industroyer2 Short (60 to 90 seconds).
Frequently asked questions
What was Industroyer2?
Industroyer2 is malware that ESET and CERT-UA disclosed on 12 April 2022 after it was found inside a Ukrainian energy company. ESET said it implements only the IEC 60870-5-104 protocol, which a control center uses to command substation equipment, and that the sample it analyzed carried the addresses of eight devices. It was scheduled to run at 16:10 UTC on 8 April 2022, with a wiper set to erase its traces ten minutes later.
Did Industroyer2 cause a blackout in Ukraine?
No. At a briefing on 12 April 2022, Ukrainian officials said, as reported by the Associated Press, that the people defending the station prevented electrical outages. They also said the attack disrupted one component of the station's SCADA system. The Ukrainian outage often blamed on Industroyer2 happened on 10 October 2022 and, according to Mandiant's November 2023 report, used the SCADA system's own tools, not Industroyer2.
How was the Industroyer2 attack stopped?
Nobody has published the mechanism. CERT-UA wrote in April 2022 that the plan had so far been prevented. ESET's Robert Lipovsky credited a prompt response by the company's defenders, CERT-UA and ESET, as reported from Black Hat in August 2022. Victor Zhora of Ukraine's special communications service said they were very lucky. Whether the scheduled task was removed, fired and failed, or never ran is not on the record.
Who was behind Industroyer2?
CERT-UA named the Sandworm group, which it tracks as UAC-0082, on 12 April 2022, and ESET said the same day it assessed with high confidence that Sandworm was responsible. As of late September 2026 we found no US, UK or EU government attribution of this incident specifically. The US advisory AA22-110A of April 2022 names the 2016 Industroyer deployment, not Industroyer2.
Was Industroyer2 deployed, or caught before it was installed?
It was deployed. ESET's published timeline records a Sandworm operator creating the scheduled task to launch Industroyer2 at 15:02 UTC on 8 April 2022, set to run at 16:10 UTC. MITRE ATT&CK's entry says it was discovered before deploying, which conflicts with ESET's timeline. What happened at 16:10 UTC has not been published by any responder.
What caused the October 2022 power outage in Ukraine?
Mandiant reported in November 2023 that a different operation, which it attributes to Sandworm, likely tripped substation circuit breakers at a Ukrainian utility on 10 October 2022, causing an unplanned outage that coincided with mass missile strikes. Mandiant says the attacker used a native MicroSCADA binary rather than custom malware such as Industroyer2. It is a separate incident from the April 2022 attempt.
How did the attackers get into the Ukrainian energy company?
That has not been disclosed. CERT-UA said in April 2022 that the initial compromise happened no later than February 2022 and that the company suffered two waves of attacks. It described lateral movement through chains of SSH tunnels and a wiper pushed by Group Policy, but no initial access vector. ESET said the same day that it did not know how the attackers got in.
Primary sources are the responders' own publications (CERT-UA, ESET, Mandiant) and US government advisories. Ukrainian officials' statements are cited through the Associated Press report of their briefing. Press and Wikipedia are cited only as evidence of what was said or published.
GovernmentCERT-UA, "Кібератака групи Sandworm (UAC-0082) на об’єкти енергетики України з використанням шкідливих програм INDUSTROYER2 та CADDYWIPER (CERT-UA#4435)," 12 April 2022. In Ukrainian; read in the original. English renderings of its sentences are as published by The Record (Jonathan Greig, 12 April 2022) and Claroty Team82. cert.gov.ua · Claroty Team82 (English rendering)
ResearcherESET Research, "Industroyer2: Industroyer reloaded," WeLiveSecurity, 12 April 2022. welivesecurity.com
PressRob Wright, "Industroyer2: How Ukraine avoided another blackout attack," TechTarget SearchSecurity, 10 August 2022. Cited for remarks by ESET's Robert Lipovsky and SSSCIP's Victor Zhora at Black Hat USA, and as evidence of what was said. techtarget.com
ResearcherMandiant, "INDUSTROYER.V2: Old Malware Learns New Tricks," 25 April 2022. cloud.google.com
FederalCISA and partners, Joint Cybersecurity Advisory AA22-110A, "Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure," 20 April 2022 (read 27 September 2026; names the 2016 CrashOverride/Industroyer deployment, not Industroyer2). cisa.gov
PressFrank Bajak, Associated Press, "Ukraine says potent Russian hack against power grid thwarted," 12 April 2022. Cited for the on-record statements of Ukrainian officials at the 12 April 2022 briefing.
ResearcherAnton Cherepanov and Robert Lipovsky (ESET), "Industroyer2: Sandworm's Cyberwarfare Targets Ukraine's Power Grid Again," Black Hat USA, 10 August 2022 (slides). PDF
FederalCISA, DOE, NSA and FBI, Joint Cybersecurity Advisory AA22-103A, "APT Cyber Tools Targeting ICS/SCADA Devices," 13 April 2022. cisa.gov
PressWikipedia, "Industroyer," revision 1345627868 (27 March 2026, 04:23 UTC), the live revision on 24 and 27 September 2026; the sentence quoted here was added in revision 1082483518 (13 April 2022, 12:12 UTC). Also "Sandworm (hacker group)," revision 1374801694 (14 September 2026). Cited as evidence of what was published. wikipedia.org · Sandworm article, revision 1374801694
ResearcherMandiant (Proska et al.), "Sandworm Disrupts Power in Ukraine Using a Novel Attack Against Operational Technology," 9 November 2023. cloud.google.com
ResearcherMITRE ATT&CK, Software S1072, "Industroyer2" (retrieved 24 September 2026). attack.mitre.org
PressCarly Page, TechCrunch, 12 April 2022. Cited as evidence of what was published. techcrunch.com
Cite this page
BlastWave. “Industroyer2 Attempted Attack on Ukrainian Substations (2022): What Is Verified.” Hackopedia, Volume 2, FILE 041. Last verified 28 September 2026. https://hackopedia.blastwave.com/energy/industroyer2-2022/
Revision history
Date
Change
6 Oct 2026
Numbered FILE 041 in Hackopedia Volume 2, in the Energy edition.
28 Sep 2026
Hand-check of the record on what happened at 16:10 UTC: ESET's analysis, Black Hat slides and conference recap re-read; none states whether the scheduled task fired. The IEC 62351 premise behind the second recommendation checked against the standard's published scope.
26 Sep 2026
Full validation: every quotation and figure traced to CERT-UA, ESET, Mandiant, the US advisories and the Associated Press report of the 12 April 2022 briefing. CERT-UA's bulletin read in the original Ukrainian. The Wikipedia sentence pinned to a dated revision. The account of how the attacker moved through the network narrowed to what CERT-UA records.
24 Sep 2026
Volume 2 entry built from primary sources.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
