Volume 2Energy edition2015Last verified 11 sources, 10 primaryGRU unit, per EU sanction and US indictment
On 23 December 2015 intruders logged into the control systems of three Ukrainian distribution companies and opened breakers on about 225,000 customers. Crews went out and restored power by hand within hours.
The attackers did not need a clever program to cut the power. They needed a path to the operators' screens and a password those screens would believe. Harvested credentials and a VPN put strangers at the operators' own consoles, and the breakers opened because the control system did exactly what an authenticated operator told it to. Everything after the outage was aimed at the recovery: corrupted converter firmware, wiped workstations, rigged backup power, a flooded call centre.
It did not work, and the reason belongs to the operators. Crews closed breakers by hand and service came back within hours; the responders wrote that the staff deserve congratulations. They do. A utility whose substations cannot be operated by hand would have faced the same intrusion without that way back. That last sentence is BlastWave's analysis, not a disclosed fact.
What is not known: Nobody has published how many people lost power; the figure is customers. Durations differ by source: three hours at one company, six in a later US laboratory study, one to six in press accounts. The substation total is unsettled, thirty at one company alone against at least 27 across all three in the same report. The US team reviewed no technical evidence itself. Whether BlackEnergy played any role in the breaker operations was, in the US alert's words, not known. Financial cost is undisclosed, and no government outside Ukraine named an actor until 2020.
Recommendation
Take the path away Nothing on the business network or the internet should have a route to the screens that operate breakers. Remote access is what carried the intruders there.
Make a stolen password worth nothing No standing remote access into the control network. Every session approved, identity-bound and multi-factor, so credentials harvested in advance open no door.
Make anything that only watches one-way Business systems, reporting and remote monitoring read operational data one way, so the systems that can send a command are only those that must.
Sources: ICS-CERT IR-ALERT-H-16-056-01, 25 Feb 2016; ICS-ALERT-14-281-01E, rev. 2 Mar 2016; E-ISAC/SANS Defense Use Case, 18 Mar 2016; EU Reg. 2020/1125, 30 Jul 2020; US DOJ indictment, 19 Oct 2020. Full list with links.
Soft Spots: 225,000 is customers from interviews, not people; durations and substation counts differ by source. That a utility whose substations cannot be run by hand would have faced the same intrusion with no way back is BlastWave's analysis.
The full record
Every claim numbered to its source. Last updated .
Two days before Christmas 2015, intruders opened breakers on about 225,000 customers through the operators' own control systems, and crews restored power by hand. What is verified, what is only reported, and what is still unknown.
Summary
On 23 December 2015, remote intruders operated the control systems of three Ukrainian electricity distribution companies and opened substation breakers, cutting power to approximately 225,000 customers for several hours. Crews restored service by operating substations by hand. BlackEnergy malware was found on the companies' networks, but the responders' analysis found it could not have caused the outage itself.1,2
Timeline of the 2015 Ukraine power grid attack
Every date is tied to a source. Press reporting appears only as evidence of what was said.
Outages begin. Kyivoblenergo's own report, as quoted by the E-ISAC and SANS analysis, puts its outage at approximately 15:35. According to company personnel, the attacks at the three companies occurred within 30 minutes of each other. Breakers are opened remotely through the companies' own control software.1,2
The attackers wipe systems with KillDisk, render serial-to-Ethernet devices at substations inoperable by corrupting their firmware, reportedly schedule disconnects of server UPS units, and flood a call center with thousands of calls. Crews restore power by operating substations by hand within hours.1,2
Ukraine's Security Service (SBU) says it has forestalled an attempt by Russian special services to hit the computer networks of energy facilities.6
ESET reports that BlackEnergy was used to deliver a destructive component in attacks against the Ukrainian electrical power industry. It does not say the malware caused the outage.7
Reuters, as republished by IBTimes UK on 14 February, reports the energy ministry's findings: one company's intruders connected from a subnetwork belonging to an internet provider in the Russian Federation, and the ministry did not hold the Russian government directly responsible. Deputy Minister Oleksandr Svetelyk speaks of six months of preparation.8
ICS-CERT publishes IR-ALERT-H-16-056-01 after a US interagency team, drawn from DHS, the Department of Energy, the FBI and NERC, interviews the companies: approximately 225,000 customers; breakers operated by "multiple external humans"; BlackEnergy's role not known. The alert names no attacker.1
An update to ICS-CERT's BlackEnergy alert, ICS-ALERT-14-281-01E, dated 2 March 2016 in an archived copy, says ICS-CERT cannot confirm a causal link between the outage and the malware.9
The E-ISAC and SANS ICS publish their joint analysis: neither BlackEnergy 3 nor KillDisk could have caused the outage; the cause was direct interactive operation of the control systems.2
The UK Foreign and Commonwealth Office and NCSC list Sandworm and BlackEnergy Actors among names associated with the GRU. The list of incidents does not include this one.10
The EU sanctions the GRU's Main Centre for Special Technologies (GTsST), naming cyber attacks on a Ukrainian power grid in the winter of 2015 and 2016. It is the first government document outside Ukraine to name an actor for this incident.5
The US Justice Department announces charges against six officers of GRU Unit 74455 for attacks including this one. They are charged, not convicted.4
A note added to the 2016 US alert attributes the activity to "Russian nation-state cyber actors," without naming a unit.1
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
Question
What the record says
Status
How many customers lost power?
Approximately 225,000, the US team's figure from interviews with the companies1
Verified
How many people lost power?
Never published. The figure is customers, not people
Undisclosed
Who opened the breakers?
"Multiple external humans," through remote administration tools or control system client software over VPN1,2
Verified (from interviews)
Did BlackEnergy cause the outage?
No. The US alert: role "not known." E-ISAC and SANS: neither BlackEnergy 3 nor KillDisk could cause it1,2
Verified
How did the intruders first get in?
Macro-enabled Office documents installing BlackEnergy 3, per E-ISAC and SANS; "reportedly" spear phishing, per the US alert1,2
Researcher finding
How were the control network credentials obtained?
The companies believe legitimate credentials were acquired before the attack; how is not published1
Reported (company belief)
How long was the power out?
Several hours. Three hours at Kyivoblenergo; six in a later US laboratory study2,3
Verified (sources differ)
How many substations were disconnected?
Thirty at Kyivoblenergo alone; "at least 27" across all three in the same report. The total is unsettled2
Unsettled
What did Ukraine's security service say at the time?
On 28 December 2015, that it had forestalled an attempt by Russian special services to hit the computer networks of energy facilities6
Verified (via republication)
Who has been charged?
Six GRU Unit 74455 officers, US indictment, 19 October 20204
Did BlackEnergy malware cause the Ukraine blackout?
No: the US responders said they did not know whether the malware played any role, and the joint E-ISAC and SANS analysis said it could not have caused the outage. BlackEnergy 3 was the access tool. The breakers were opened by people operating the companies' own control software.1,2
The story that malware turned the lights off formed in the first week. On 3 January 2016, ESET reported, in careful language, that BlackEnergy had been used to deliver a destructive component against the Ukrainian power industry; headlines turned that into malware causing the blackout.7 The US government record declined that reading in writing. The update to ICS-CERT's BlackEnergy alert, dated 2 March 2016 in an archived copy, noted open source reports alleging the outage was caused by BlackEnergy and said that, "based on the technical artifacts ICS-CERT and US-CERT have been provided, we cannot confirm a causal link between the power outage with the presence of the malware."9 The interagency alert of 25 February 2016 said each company reported a BlackEnergy infection, "however we do not know whether the malware played a role in the cyber-attacks."1
"neither BlackEnergy 3 nor KillDisk contained the required components to cause the outage."
The same analysis places the actual cause in manipulation of the control system itself, by direct interactive operations by the adversary.2 In BlastWave's view, the distinction matters for defense: detecting a known malware family addresses the crowbar on the back door, not the reason a crowbar on the business network led to the breaker screens.
How did the attackers open the breakers?
By logging in. The US interagency alert says the remote operation of the breakers was carried out by "multiple external humans," using either remote administration tools already on the machines or the control system's own client software over VPN connections. The companies believe the actors acquired legitimate credentials before the attack to make that remote access possible.1
The path began on business systems. The E-ISAC and SANS analysis describes spear phishing with macro-enabled Microsoft Office documents that installed BlackEnergy 3; the US alert says the malware was "reportedly" delivered that way.1,2 The two documents carry different grains, and this entry keeps them separate. Ukraine's Deputy Energy Minister, as Reuters reported it, spoke of six months of preparation.8
The US team learned this through interviews with the affected companies. The alert records that the team was not able to independently review technical evidence of the attack.1
What did the attackers do to stop the power coming back?
Everything they did after opening the breakers was aimed at the recovery. According to the US alert, they wiped some systems with KillDisk at the conclusion of the attack, rendered serial-to-Ethernet devices at substations inoperable by corrupting their firmware, and reportedly scheduled disconnects of server uninterruptible power supplies through the UPS remote management interface.1 The E-ISAC and SANS analysis adds that a UPS was reconfigured so the outage would hit the company's own buildings, and that the attackers ran a telephone denial of service against the call center with thousands of calls, so customers could not report the outage.2
Firmware on the converters that carry commands to substations, corrupted.1
It did not work. Crews went to the substations and operated them by hand, and service came back within hours. The E-ISAC and SANS analysis says the loss of view into the system simply delayed restoration efforts, that the Ukrainian response "was impressive with all aspects considered," and that the companies' staff "deserve congratulations."2 In February 2016 the US alert reported that all the affected companies "continue to run under constrained operations." How long that lasted is not published.1
How many people lost power in the 2015 Ukraine blackout?
No one has published a figure for people; the record is approximately 225,000 customers. That is the US team's figure from interviews with company personnel, stated as "approximately" in the US alert and as "approximately," "up to" and "roughly" in the E-ISAC and SANS analysis.1,2 A customer is an account and a meter. Figures such as "230,000 people" or "over 200,000 people" are conversions no primary source made.
Durations differ by source. Kyivoblenergo's own report, as quoted by the E-ISAC and SANS analysis, says its substations were disconnected for three hours.2 The Idaho National Laboratory case study says power was restored in six hours.3 Press accounts range from one to six hours. This entry uses the analysis's own phrase, several hours.
The substation total is unsettled. The same analysis quotes seven 110 kV and 23 35 kV substations at Kyivoblenergo alone, then elsewhere says "at least 27 substations" across all three companies, adding that the total is probably higher.2 This entry states only the Kyivoblenergo figure, attributed.
Which companies. The US alert names no company. Kyivoblenergo and Prykarpattyaoblenergo announced their own outages; Chernivtsioblenergo is named in the Idaho National Laboratory case study and in Ukrainian reporting.2,3
Who was behind the 2015 Ukraine power grid attack?
The first government documents outside Ukraine to name an actor came in 2020: an EU sanctions listing of the GRU's Main Centre for Special Technologies, and a US indictment of six officers of GRU Unit 74455, who are charged, not convicted.4,5 An indictment, a sanctions listing and a contemporaneous statement are three different things, and each is dated below.
28 December 2015. Ukraine's Security Service said it had forestalled an attempt by Russian special services to hit the computer networks of energy facilities. The statement is read here through a verbatim Ukrainian republication.6
February 2016. The energy ministry found, as Reuters reported it, that one company's intruders connected from a subnetwork belonging to an internet provider in the Russian Federation, and did not hold the Russian government directly responsible.8
25 February 2016. The US interagency alert named no one.1
4 October 2018. The UK statement often cited for this attack lists Sandworm and BlackEnergy Actors among names associated with the GRU, but its list of incidents does not include the Ukrainian grid in 2015.10
30 July 2020. The EU sanctioned the GRU's Main Centre for Special Technologies (GTsST), naming cyber attacks on a Ukrainian power grid in the winter of 2015 and 2016.5
19 October 2020. The US Justice Department charged six GRU Unit 74455 officers in connection with attacks including this one. An indictment is an allegation.4
20 July 2021. A note added to the 2016 US alert attributes the activity to "Russian nation-state cyber actors," later than, and less specific than, the 2020 EU and US documents.1
Sandworm is a researchers' name; this entry uses the units the government documents name. Four and a half years passed between the outage and the first government document outside Ukraine to name an actor.
Was this the first blackout caused by a cyberattack?
It is the first publicly acknowledged one, in the responders' words; whether it was the first ever cannot be checked. The E-ISAC and SANS analysis describes the Ukrainian events as:
"the first publicly acknowledged incidents to result in power outages."
"Publicly acknowledged" is the claim the record supports. This entry does not print "first" without it.
What is still not known about Ukraine Power Grid
How many people lost power. The published figure is approximately 225,000 customers.1
How long the outages lasted at each company. Sources give three hours at one company, six hours in a later US laboratory study, and one to six hours in press accounts.2,3
How many substations were disconnected in total: thirty at one company alone against "at least 27" across all three in the same report.2
What the technical evidence shows. The US team was not able to review it independently.1
Whether BlackEnergy played any role in the breaker operations, which the US alert said was not known.1
How the control network credentials were obtained, and any single root cause; the companies never published one.
How long the companies ran under constrained operations after February 2016.1
The financial cost, which is undisclosed.
Claims about Ukraine Power Grid the record does not support
Widely repeated claim
What the record says
"BlackEnergy malware caused the Ukraine blackout."
The US alert said BlackEnergy's role was not known, ICS-CERT said it could not confirm a causal link, and the E-ISAC and SANS analysis said neither BlackEnergy 3 nor KillDisk could cause the outage. People opened the breakers through the operators' own software.1,2,9
"230,000 people lost power." (English Wikipedia; The Register gave "over 200,000 people")
Approximately 225,000 customers, from interviews. How many people lost power has never been published.1,2
"Two western oblasts" were hit. (English Wikipedia)
Three regional distribution companies, including Kyivoblenergo.1,2,3
"The UK attributed the Ukraine grid attack to the GRU in October 2018."
The 4 October 2018 statement lists Sandworm and BlackEnergy Actors among GRU-associated names; its list of incidents does not include this one. The first government documents outside Ukraine to name an actor are the EU listing and US indictment of 2020.4,5,10
Including our own. Our Volume 1 Hackopedia entry, "Ukraine Power Grid Blackouts (2015/16)," carried this incident and the following year's Kyiv transmission attack on one page, with the 2016 tooling, CRASHOVERRIDE, in the same attacker field as the 2015 malware. It said the attackers de-energized seven substations, when one company alone reported seven 110 kV and 23 35 kV substations, and it gave the customer figure with a plus sign when every primary source says approximately or up to.1,2,11 This entry covers 23 December 2015 only, Ukrenergo has its own entry, and all three errors are corrected here. We correct our own record first; it is what earns the right to correct anyone else's.
BlastWave analysis: the blackout was done by hand, and so was the recovery
Analysis, not a disclosed fact
The attackers did not need a clever program to cut the power. They needed a path to the screens the operators use every day, and a password those screens would believe. Harvested credentials and a VPN into the control network put strangers at the operators' own consoles, and the breakers opened because the control system did exactly what an authenticated operator told it to. That is a reachability and identity story before it is a malware story. Everything after the outage was aimed at the recovery, to make the outage something nobody could undo from a chair.
It did not work, and the reason belongs to the operators. Crews closed breakers by hand and service came back within hours; the responders wrote that the staff deserve congratulations, and they do. The fallback was a grid that could still be run by people with trucks and keys. A utility whose substations cannot be operated by hand would have faced the same intrusion without that way back. That last sentence is BlastWave's analysis, not a disclosed fact.
Podcast: “Eleven Pickup Trucks” (9:18). Joe Baxter and Cam Cullen on why people, not malware, opened the breakers, and why the crews who closed them by hand were the save.
Video: Ukraine Power Grid Short (60 to 90 seconds).
Frequently asked questions
What happened in the 2015 Ukraine power grid attack?
On 23 December 2015, starting at about 15:35 local time, remote intruders operated the control systems of three Ukrainian electricity distribution companies and opened breakers at substations, cutting power to approximately 225,000 customers. They then wiped systems, corrupted substation converter firmware, targeted backup power and flooded a call center. Crews restored power within hours by operating substations by hand, according to the US alert of February 2016 and the E-ISAC and SANS analysis of March 2016.
Did BlackEnergy malware cause the Ukraine blackout?
No. The US interagency alert of 25 February 2016 said each company reported a BlackEnergy infection but that the responders did not know whether the malware played a role. The joint E-ISAC and SANS analysis of 18 March 2016 said neither BlackEnergy 3 nor KillDisk contained the components needed to cause the outage. BlackEnergy provided access; people opened the breakers through the operators' own control software.
How many people lost power in Ukraine in December 2015?
No figure for people has been published. The US alert of February 2016 reported approximately 225,000 customers, a figure the US team obtained through interviews with the affected companies. A customer is an account and a meter, not a person, so figures such as 230,000 people are conversions that no primary source made.
Who was responsible for the 2015 Ukraine grid attack?
The first government documents outside Ukraine to name an actor came in 2020. The EU sanctioned the GRU's Main Centre for Special Technologies on 30 July 2020, and the US Justice Department announced charges against six GRU Unit 74455 officers on 19 October 2020; they are charged, not convicted. In December 2015, Ukraine's security service said it had forestalled an attempt by Russian special services to hit energy facilities' computer networks.
How did the attackers get into the Ukrainian power companies?
The E-ISAC and SANS analysis of March 2016 describes spear phishing with macro-enabled Office documents that installed BlackEnergy 3; the US alert of February 2016 says the malware was reportedly delivered that way. The companies believe the attackers then acquired legitimate credentials before the attack and used VPN access and remote tools to reach the operators' control software.
How was power restored after the Ukraine cyberattack?
Crews went out to the substations and operated them by hand, and power came back within hours. The E-ISAC and SANS analysis of March 2016 said the loss of view simply delayed restoration and that the companies' staff deserve congratulations. The US alert of February 2016 said all the affected companies were still running under constrained operations at that time.
Was the 2015 Ukraine attack the first blackout caused by a cyberattack?
The joint E-ISAC and SANS analysis of 18 March 2016 describes the Ukrainian events as the first publicly acknowledged incidents to result in power outages. That qualifier matters: whether any earlier, unacknowledged incident caused an outage cannot be checked, so the accurate statement is the first publicly acknowledged cyberattack to cause a power outage.
Primary sources are US government alerts, the joint E-ISAC and SANS analysis, a US Department of Energy laboratory case study, Ukrainian government statements, and UK, EU and US Justice Department documents. Where a primary document was read through a republication, its entry says so. Press is cited only as evidence of what was said.
FederalICS-CERT, IR-ALERT-H-16-056-01, "Cyber-Attack Against Ukrainian Critical Infrastructure," 25 February 2016. The live page carries a note added 20 July 2021 attributing the activity to "Russian nation-state cyber actors." cisa.gov
ResearcherE-ISAC and SANS ICS, "Analysis of the Cyber Attack on the Ukrainian Power Grid: Defense Use Case," TLP White, 18 March 2016. Includes Kyivoblenergo's own outage report as quoted. PDF (National Security Archive copy)
FederalIdaho National Laboratory, CyOTE case study, "Ukraine Energy Sector Cyber Attack 2015" (US Department of Energy program). PDF
FederalUS Department of Justice, "Six Russian GRU Officers Charged in Connection with Worldwide Deployment of Destructive Malware and Other Disruptive Actions in Cyberspace," 19 October 2020. justice.gov
GovernmentCouncil of the EU, Implementing Regulation (EU) 2020/1125, 30 July 2020, entry for the GRU Main Centre for Special Technologies (GTsST). Read through the UK OFSI financial sanctions notice of 31 July 2020 as republished, and the listing on legislation.gov.uk. eur-lex.europa.eu
GovernmentSecurity Service of Ukraine (SBU), press statement, 28 December 2015. Read through a verbatim Ukrainian republication; the original on ssu.gov.ua was not retrieved.
ResearcherESET, "BlackEnergy by the SSHBearDoor: attacks against Ukrainian news media and electric industry," WeLiveSecurity, 3 January 2016. welivesecurity.com
PressIBTimes UK, report of the Ministry of Energy and Coal Industry of Ukraine's investigation findings, as reported by Reuters, 14 February 2016. Cited for the ministry's findings on the Russian provider subnetwork, its not holding the Russian government directly responsible, and Deputy Minister Oleksandr Svetelyk's remarks on preparation.
FederalICS-CERT, ICS-ALERT-14-281-01E, "Ongoing Sophisticated Malware Campaign Compromising ICS (Update E)," first released 8 October 2014 and updated 10 December 2014; Update E, carrying the Ukraine paragraph, dated 2 March 2016 per the National Security Archive copy. The live page was last revised 20 July 2021. cisa.gov
GovernmentUK Foreign and Commonwealth Office and NCSC, "UK exposes Russian cyber attacks," 4 October 2018. gov.uk
CompanyBlastWave, Hackopedia Volume 1, "Ukraine Power Grid Blackouts (2015/16)," live page, read 24 September 2026.
Cite this page
BlastWave. “Ukraine Power Grid Cyberattack (2015): What Is Verified.” Hackopedia, Volume 2, FILE 003. Last verified 28 September 2026. https://hackopedia.blastwave.com/energy/ukraine-power-grid-2015/
Revision history
Date
Change
6 Oct 2026
Numbered FILE 003 in Hackopedia Volume 2, in the Energy edition.
28 Sep 2026
Hand-check at source. The Security Service of Ukraine's 28 December 2015 statement was read through a verbatim Ukrainian republication: it says the service forestalled an attempt by Russian special services to hit the computer networks of energy facilities, and this entry follows that wording exactly rather than summarizing it as an accusation about the outage. The energy ministry's February 2016 findings were confirmed through a republication of Reuters' report, and the Idaho National Laboratory case study was confirmed for the six-hour figure and all three company names. The EU listing is described in its singular "winter of 2015 and 2016."
26 Sep 2026
Full validation: both US alerts re-read on cisa.gov, the E-ISAC and SANS analysis, ESET's report, the UK statement and the Justice Department release re-read at source, and the EU listing re-read through legislation.gov.uk. The US alert now carries a 20 July 2021 attribution note, so every statement that it named no one is dated to February 2016. Corrected the release dates of ICS-CERT's BlackEnergy alert.
24 Sep 2026
Volume 2 entry built from primary sources, covering 23 December 2015 only; the 2016 Kyiv transmission attack has its own entry. Corrected the Volume 1 errors: the merged 2015 and 2016 page, "seven substations," and a customer figure with a plus sign.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
