BlastWaveBlastWaveHACKOPEDIA
Hackopedia • File 020
Kyiv, Ukraine

Ukrenergo Kyiv Power Grid Cyberattack (2016)

Volume 2Energy edition2016Last verified 18 sources, 13 primaryGRU unit, per US-UK advisory

In December 2016 an attacker opened breakers at a Kyiv transmission substation and took out about a fifth of the city's night-time load for about an hour. A 2019 reassessment argues the outage was the setup, not the goal.

For two and a half years the Kyiv outage read as a sequel: shorter than the year before, delivered by software rather than hands on keyboards. Ukrenergo's night shift deserves credit; it switched to manual control and had the power back in about an hour and a quarter. A 2019 Dragos reassessment argued the outage was the setup, and the goal a possibly destructive event when operators restored power with protection asleep. It is one vendor's assessment, and it calls the predicted impact conjecture.

What is documented is narrower: the relay tool read its target addresses backwards and did nothing. The relays sat on the same subnet as the control systems the attack switched, and the flaw it used had a vendor fix from July 2015. What stood between that network and the protection was a bug in the attacker's own code. That is BlastWave's reading of the record, not a disclosed fact.

What is not known: Ukrenergo gave megawatts, not a customer count, and has published no final technical report. How the attacker got in is known only from an investigator's account to the press of a July 2016 phishing campaign. Whether the relay attack's packets reached any relay, and how exactly breakers were reclosed, is not on the record. The intent to damage equipment on restoration is one vendor's 2019 assessment, which itself calls the predicted impact conjecture. Cost is undisclosed. The UK says it attributed the attack in 2016; this pass found no 2016 UK statement.

Recommendation

  1. Take the path away from the protection Nothing that can send a breaker command should be able to address a protective relay. If control traffic can reach relay management ports, that pairing is the finding.
  2. Remove standing access to relays Relay management answers only in an authenticated, logged maintenance window from a named engineering host. A fix published in July 2015 is the floor, not the control.
  3. Make read-only consumers read one way Historians and reporting receive relay events and telemetry one way, so the systems that can talk to the protection are only those that must.
The Tied-Off Vent Line
Podcast · Joe and Cam · 9:23
Ukrenergo Short
Video · 60 to 90 seconds

Sources: Kovalchuk, Facebook, 18 Dec 2016, and to Reuters, 20 Dec 2016; ESET, Industroyer, 12 Jun 2017; US-CERT TA17-163A, 12 Jun 2017; Dragos (Slowik), 15 Aug 2019; US DOJ, 19 Oct 2020; CISA et al. AA22-110A, 20 Apr 2022. Full list with links.

Soft Spots: The destructive-intent reading is one Dragos analyst's 2019 assessment, self-described as conjecture. That a bug, not an architectural control, stood between network and protection is BlastWave's analysis, not a disclosed fact.

The full record

Every claim numbered to its source. Last updated .

Breakers opened at one Kyiv transmission substation, the night shift restored power by hand, and a 2019 reassessment argued the outage was only the setup. What is verified, what is only reported or assessed, and what is still unknown.

Summary

Just before midnight on 17 December 2016, breakers opened at Ukrenergo's Pivnichna substation north of Kyiv, cutting about 200 MW, roughly a fifth of the capital's night-time consumption. Operators restored power by hand in about an hour and a quarter. ESET called Industroyer's use "highly probable." A 2019 argument that equipment damage was the goal is one vendor's assessment.1,2,6,7

Timeline of the 2016 Kyiv outage and what followed

Every date is tied to a source. Press reporting appears only as evidence of what was said.

  1. Siemens and ICS-CERT publish advisories on a denial-of-service flaw in SIPROTEC protective relays; CVE-2015-5374 is published on 18 July and says a manual reboot may be required to recover the device.11
  2. A Honeywell researcher who assisted with part of the investigation later told Vice the attack began as part of a massive phishing campaign this month.8
  3. Breakers open at the Pivnichna transmission substation north of Kyiv. Northern right-bank Kyiv and adjacent towns lose power. The malware later published by ESET carries an activation timestamp for this date.1,2
  4. Ukrenergo's acting chief Vsevolod Kovalchuk writes that specialists switched equipment to manual control, began restoring power in about 30 minutes and restored it fully in 1 hour 15 minutes. The main version: "external interference through data networks."1
  5. Kovalchuk tells Reuters the outage was about 200 MW, "equivalent to about a fifth of the capital's energy consumption at night."7
  6. Vice reports the July 2016 phishing account.8
  7. Ukrenergo confirms a cyber attack: workstations and SCADA servers were disrupted by "external influences," as reported by Reuters and SecurityWeek. No final public technical report follows.5
  8. ESET publishes the malware as Industroyer and Dragos as CRASHOVERRIDE; US-CERT issues alert TA17-163A saying it was "reportedly used in 2016" in Ukraine. No one names a state.2,3,4
  9. The UK names "BlackEnergy Actors" and "Sandworm" as GRU; the release lists no Ukrainian grid incident.12
  10. Dragos publishes Joe Slowik's reassessment of the attack as protection-focused, based on incident artifacts made available to Dragos in 2018. Wired reports on it in September 2019.6,13
  11. The EU lists the GRU's GTsST (field post number 74455) for attacks on a Ukrainian power grid in "the winter of 2015 and 2016."14
  12. The US Justice Department charges six GRU Unit 74455 officers; its release names Industroyer. Charged, not convicted.9
  13. Joint advisory AA22-110A, issued with the UK, Australian, Canadian and New Zealand agencies, states that GTsST actors deployed CrashOverride (Industroyer) against a Ukrainian electrical transmission company in 2016.10
  14. The UK publishes a GRU profile saying a fifth of Kyiv lost power and that the UK attributed the attack in 2016. Last updated 13 July 2026.15

Key facts and their status

Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.

QuestionWhat the record saysStatus
Where did the outage happen?One transmission substation, Pivnichna, north of Kyiv1Verified (operator, as republished)
How much power was lost?About 200 MW, "equivalent to about a fifth of the capital's energy consumption at night"7Verified (operator, to Reuters)
How many customers lost power?Not stated. The operator gave megawatts, not a customer count7Undisclosed
How long did it last?Restoration began in about 30 minutes; full in about 1 hour 15 minutes, under manual control1Verified (operator, as republished)
Did Ukrenergo confirm a cyber attack?Yes, in January 2017: workstations and SCADA servers disrupted by "external influences"5Verified (as reported)
Was Industroyer used that night?ESET: "highly probable"; Dragos: high confidence; activation date 17 December 2016 in the code2,4Researcher finding
How did the attacker get in?No technical record says. One researcher told Vice: a phishing campaign from July 20168Reported only
Did the attack on the protective relays work?No. The tool read its four hard-coded addresses backwards and was "inert" (Dragos, 2019)6Researcher finding
Was the goal to damage equipment?One vendor's 2019 assessment, which calls the predicted impact "a matter of conjecture"6Assessment, not fact
Who is responsible?Six GRU Unit 74455 officers charged by the US in 2020; the unit's GTsST named in a 2022 US-UK-allied advisory9,10Verified (charged, not convicted)
Was equipment damaged?No equipment damage has been reportedNone reported
What did it cost?Not publishedUndisclosed

What happened at the Kyiv substation in December 2016?

Breakers opened at one transmission substation just before midnight on 17 December 2016, and the operator's night shift restored power by hand in about an hour and a quarter. The substation was Pivnichna, north of Kyiv; northern right-bank Kyiv and adjacent towns lost power. The next day Ukrenergo's acting chief director, Vsevolod Kovalchuk, wrote on Facebook that his specialists switched the equipment to manual control, began restoring power within about 30 minutes and had it fully restored in 1 hour 15 minutes. His main working version of the cause was "external interference through data networks."1 The post itself is known through Ukrainian press that reproduced it the same day.

Two days later Kovalchuk gave Reuters the size: about 200 megawatts, "equivalent to about a fifth of the capital's energy consumption at night."7 That is a share of night-time load, not a share of people. The operator never gave a customer count.

"That is a lot. This kind of blackout is very, very rare."
Vsevolod Kovalchuk, acting chief director, NEC Ukrenergo, to Reuters by phone, 20 December 20167

In January 2017 Ukrenergo confirmed a cyber attack: as SecurityWeek put it, the normal operation of workstations and SCADA servers had been disrupted by "external influences."5 The operator has published no final technical report.

Was the Kyiv outage caused by Industroyer?

Very probably, by the judgment of the two firms that published the malware, and both stated their confidence rather than certainty. On 12 June 2017 ESET published it as Industroyer and Dragos as CRASHOVERRIDE, and US-CERT issued an alert saying it was "reportedly used in 2016" in Ukraine.2,3,4 The framework carries payloads for the substation protocols IEC 60870-5-101, IEC 60870-5-104 and IEC 61850 and for OPC DA, a wiper, and a denial-of-service tool for Siemens SIPROTEC relays that uses CVE-2015-5374. It contains an activation date of 17 December 2016.2

"While in principle it's difficult to attribute attacks to malware without performing an onsite incident response, it's highly probable that Industroyer was used in the December 2016 attack on the Ukrainian power grid."
Anton Cherepanov and Robert Lipovsky, ESET, WeLiveSecurity, 12 June 20172

Dragos stated high confidence in the link. Its 2017 report did not have the relay tool: "Dragos could not validate that this module exists."4 ESET published the SIPROTEC tool; the detail that it targeted four specific addresses comes from Dragos's 2019 analysis of incident artifacts.2,6

Did the attackers try to damage grid equipment?

One analysis argues so; it is an assessment, and its own author calls the predicted impact conjecture. In August 2019 Joe Slowik of Dragos, working from incident artifacts made available to Dragos in 2018, went back to the last stage of the attack: a denial of service aimed at protective relays, the devices that trip a line before a fault does damage. He assessed that the attackers sought "to create the preconditions for a possible physically-destructive event when the victim restored operations," calling it the "most-likely intention."6

The same paper says that predicting the impact "had it worked correctly is a matter of conjecture."6 The published description of the flaw the tool used, CVE-2015-5374, says "a manual reboot may be required to recover the service of the device."11 The reading is one vendor's analytical assessment with its own confidence, not an established fact. No equipment damage has been reported.

Why did the attack on the protective relays fail?

On the record, because of a bug in the attacker's own code, not because of a defense. Dragos's 2019 analysis reports that the denial-of-service tool had specific IP addresses, presumably for four SIPROTEC devices, hard-coded, and that the program read them backwards when it created its connections. That byte-order error made the tool "inert."6

The same paper reports that the relays sat on the same subnet as the other control systems the attack manipulated.6 That is a vendor's reconstruction from artifacts; the operator has published no network description. The flaw the tool used had a vendor fix published in July 2015.11 Nothing on the record says whether Ukrenergo's relays had it, and this entry does not imply they did not.

Wired reported in September 2019 that, for reasons Dragos "can't quite explain," the packets "were sent to the wrong IP addresses," and that operators "may have" restored power faster than the attackers expected.13 The first is a simplification of the paper's byte-order explanation; the second is a journalist's hedge, not a finding. No source shows that the operators, segmentation or any security control stopped the relay attack.

How did the attackers get into Ukrenergo's network?

No technical record says. The only account is in the press: Marina Krotofil, a Honeywell researcher who assisted with part of the investigation, told Vice in January 2017 that the attack "began as part of a massive phishing campaign" in July 2016.8 No report by the operator or a responder, and no government advisory or charging document, states an initial access vector, and none mentions a supply-chain compromise. The October 2020 indictment alleges that the network of "a Ukrainian electric transmission company" "had been compromised by the Conspirators since in and around April 2016," but it states no method of access, and an indictment is an allegation.17 An Idaho National Laboratory case study posted in December 2025 says spearphishing, but it states that it "is based on publicly available reports": a compilation, not a finding.18

Who was behind the 2016 Kyiv power outage?

The US charged six officers of GRU Unit 74455 in October 2020, and a 2022 advisory from the US, the UK and three allies names that unit's GTsST actors for the 2016 Industroyer deployment. The attribution arrived in stages, each with its own grain.

  • June 2017: ESET named no actor and found no apparent code similarities with the BlackEnergy tools used the year before. Dragos named a cluster it calls ELECTRUM, which it assessed with high confidence, through confidential sources, has "direct ties to the Sandworm team." US-CERT named no one.2,3,4
  • July 2020: the EU listed the GRU's GTsST (74455) for attacks on a Ukrainian power grid in "the winter of 2015 and 2016," wording that can be read as one winter, the December 2015 attack only.14
  • October 2020: the US Justice Department charged six Unit 74455 officers for conduct including the December 2015 to December 2016 attacks on Ukraine's electric grid "using malware known as BlackEnergy, Industroyer, and KillDisk." An indictment is an allegation: charged, not convicted.9
  • April 2022: joint advisory AA22-110A, issued by CISA, the FBI and the NSA with UK, Australian, Canadian and New Zealand agencies, named GTsST for the 2016 campaign and says the US and UK governments had previously attributed that activity to GTsST.10
"In 2016, GTsST actors conducted a cyber-intrusion campaign against a Ukrainian electrical transmission company and deployed CrashOverride malware (also known as Industroyer)"
CISA, FBI, NSA and partner agencies, Joint Cybersecurity Advisory AA22-110A, 20 April 202210

The UK's GRU profile, first published in July 2025, says "The UK attributed this attack to Unit 74455 in 2016."15 We could not find a 2016 UK statement. The UK's October 2018 release named "BlackEnergy Actors" and "Sandworm" as GRU but listed no Ukrainian grid incident.12 Absence in what we searched is not proof of absence.

What is still not known about Ukrenergo

  • How many customers lost power. Ukrenergo gave megawatts, not a customer count.7
  • A final technical account from the operator. None has been published.
  • How the attacker got in, beyond one researcher's press account of a July 2016 phishing campaign.8
  • Whether the relay attack's packets reached any relay, and exactly how the breakers were reclosed.
  • Whether the targeted relays had the July 2015 fix.11
  • Whether the attackers intended equipment damage on restoration. That is one vendor's 2019 assessment, which calls the predicted impact conjecture.6
  • The cost of the incident.
  • What the UK's statement that it attributed the attack "in 2016" refers to. As of late September 2026 we had found no 2016 UK statement.12,15
  • Whether the EU's "winter of 2015 and 2016" was meant to cover December 2016.14

Claims about Ukrenergo the record does not support

Widely repeated claimWhat the record says
"A fifth of Kyiv losing power."The operator said about 200 MW, "equivalent to about a fifth of the capital's energy consumption at night": a share of night-time load, not of people. The UK's GRU profile converts one into the other.7,15
"About 234,000 customers were affected."No primary source gives a customer count. The operator gave megawatts. The figure traces to nothing we can find.7,16
"New Clues Show How Russia's Grid Hackers Aimed for Physical Destruction" (headline, 2019)That is the assessment of one Dragos paper (2019), which calls the predicted impact "a matter of conjecture." It is not an established fact.6,13
The relay attack "failed because the attacker assumed they could flood unsegmented, exposed channels."It sent crafted packets aimed at four specific relays, not a flood, and failed because the program read those addresses backwards.6,16
"The packets were sent to the wrong IP addresses."Close, but the paper's explanation is that the four hard-coded addresses were read backwards during socket creation: a byte-order error.6,13
Access was "phishing or supply-chain compromise (e.g., infected third-party software)."No record mentions a supply chain. The only account of access is one researcher's press interview describing a phishing campaign.8,16
"The UK attributed this attack to Unit 74455 in 2016."Stated in the UK's 2025 GRU profile. We found no 2016 UK statement; the UK's 2018 release lists no Ukrainian grid incident.12,15

Including our own. Our Volume 1 Hackopedia entry gave the attack about 234,000 affected customers, a figure we cannot trace to any primary source; said the relay attack failed because the attacker assumed it could flood unsegmented, exposed channels, when it failed on the attacker's own coding error; gave the vector as "phishing or supply-chain compromise (e.g., infected third-party software)," of which the second half appears in no record; and said our product would have prevented it. Our Volume 1 Ukraine Power Grid page, which covers both winters, put CRASHOVERRIDE in the same attacker field as the 2015 tools without saying which belongs to which winter.16 All are corrected here. We correct our own record first; it is what earns the right to correct anyone else's.

BlastWave analysis: the outage was an hour; the architecture is the finding

Analysis, not a disclosed fact

For two and a half years the Kyiv outage was read as a sequel: a shorter blackout than the year before, delivered by software rather than by hands on keyboards. The operator's own account deserves plain credit: the night shift went to manual control and had the power back in about an hour and a quarter.1 The 2019 second reading changed what the first one meant, but it is one vendor's assessment and calls its own predicted impact conjecture.6 What is documented is narrower: the relay tool read its target addresses backwards and did nothing.

That makes this an architecture story, not a malware story. The relays sat on the same subnet as the control systems the attack switched, and the flaw it used had a vendor fix published in July 2015.6,11 What stood between that network and the protection was a byte-order bug in the attacker's own code. That is BlastWave's reading of the record, not a disclosed fact. On the consequence ladder this is OT command execution with corroborated physical effect: breakers opened and load was lost, as the operator itself reported. The effect that would have mattered most failed on its own.

How BlastWave removes the paths an attacker uses to reach OT

Listen and watch

Podcast: “The Tied-Off Vent Line” (9:23). Joe Baxter and Cam Cullen on how a 2019 second reading changed what the Kyiv outage meant, and why the stage aimed at the protection failed on a bug rather than a defense.

Video: Ukrenergo Short (60 to 90 seconds).

Frequently asked questions

What happened in the 2016 Ukrenergo cyberattack?

Just before midnight on 17 December 2016, breakers opened at Ukrenergo's Pivnichna transmission substation north of Kyiv. The operator's acting chief, Vsevolod Kovalchuk, said the next day that specialists switched to manual control, began restoring power in about 30 minutes and restored it fully in 1 hour 15 minutes. He told Reuters the outage was about 200 MW. In January 2017 Ukrenergo confirmed a cyber attack.

How much of Kyiv lost power in December 2016?

Ukrenergo gave a load figure, not a population figure. Kovalchuk told Reuters on 20 December 2016 that the outage was about 200 megawatts, equivalent to about a fifth of the capital's energy consumption at night. That is a share of night-time consumption, not a fifth of the city's people. The operator never published a customer count, and figures such as 234,000 customers trace to no primary source.

Was Industroyer (CRASHOVERRIDE) used in the Kyiv attack?

Very probably, according to the firms that published it on 12 June 2017. ESET wrote that it is difficult to attribute attacks to malware without an onsite incident response, but that it is highly probable Industroyer was used in the December 2016 attack; its code carries an activation date of 17 December 2016. Dragos said high confidence. US-CERT said it was reportedly used in 2016 in Ukraine.

Did the Industroyer attack try to destroy equipment?

One analysis argues so. In August 2019 Joe Slowik of Dragos assessed that the attackers sought to create the preconditions for a possibly destructive event when operators restored power, by disabling protective relays. The same paper calls the predicted impact a matter of conjecture. It is one vendor's assessment, not an established fact, and no equipment damage has been reported.

Why did the attack on the protective relays fail?

According to Dragos's 2019 analysis, the attacker's denial-of-service tool had the relays' addresses hard-coded and read them backwards when it opened its connections, a byte-order error that left the tool inert. No source shows that the operators, network segmentation or any security control stopped it. The same paper reports the relays sat on the same subnet as the control systems the attack manipulated.

How did the attackers get into Ukrenergo?

No technical report by the operator or a responder, and no government advisory or charging document, states how. The only account is in the press: Marina Krotofil, a Honeywell researcher who assisted with part of the investigation, told Vice in January 2017 that the attack began as part of a massive phishing campaign in July 2016. No record supports a supply-chain compromise.

Who was responsible for the 2016 Kyiv power outage?

The US Justice Department charged six officers of Russia's GRU Unit 74455 on 19 October 2020, and its release names Industroyer; they are charged, not convicted. A joint advisory from US, UK and allied agencies on 20 April 2022 says the unit's GTsST actors deployed CrashOverride, also known as Industroyer, against a Ukrainian electrical transmission company in 2016. In 2017, ESET named no actor.

Ukraine Power GridThe first act a year earlier; the two entries agree on which malware belongs to which winter.Industroyer2The sequel: the 2022 attempt with no corroborated physical effect, where this was the effect with a failed second stage.TritonIn both, the stage aimed at the protective layer failed on a flaw in the attacker's own code (at Triton, together with the controller's own integrity check), not on any security control.

Sources

Primary sources are the operator's own statements, the responders' published analyses, US government alerts and charging documents, and EU and UK government publications. Press is cited for what the operator and researchers said, and as evidence of what was said.

  1. PressLB.ua, report of 18 December 2016 (13:35) quoting the Facebook post of Vsevolod Kovalchuk, acting chief director of NEC Ukrenergo, 18 December 2016: Pivnichna substation; manual control; restoration begun in about 30 minutes and complete in 1 hour 15 minutes; main version "external interference through data networks." Also reported by UNN the same day. Cited as evidence of what the operator said; the post itself was not retrieved. lb.ua
  2. ResearcherAnton Cherepanov and Robert Lipovsky, ESET, "Industroyer: Biggest threat to industrial control systems since Stuxnet," WeLiveSecurity, 12 June 2017, and the accompanying white paper "Win32/Industroyer." welivesecurity.com · White paper (PDF)
  3. FederalUS-CERT, Alert TA17-163A, "CrashOverride Malware," 12 June 2017. cisa.gov
  4. ResearcherDragos, "CRASHOVERRIDE: Analysis of the Threat to Electric Grid Operations," version 2.20170613, June 2017. PDF
  5. PressEduard Kovacs, SecurityWeek, 19 January 2017, and Reuters, "Ukraine's power outage was a cyber attack - Ukrenergo," 18 January 2017: Ukrenergo confirms a cyber attack; workstations and SCADA servers disrupted by "external influences" (SecurityWeek's wording). Cited as evidence of what the operator said.
  6. ResearcherJoe Slowik, Dragos, "CRASHOVERRIDE: Reassessing the 2016 Ukraine Electric Power Event as a Protection-Focused Attack," 15 August 2019 (read from the author's archive). PDF
  7. PressPavel Polityuk, Reuters, "Ukraine investigates suspected cyber attack on Kiev power grid," 20 December 2016, read in a Yahoo Finance wire copy. Cited for Kovalchuk's own words to Reuters.
  8. PressKim Zetter, Vice Motherboard, 10 January 2017: Marina Krotofil (Honeywell, who assisted with part of the investigation) on a phishing campaign of July 2016. Cited as evidence of what was said. vice.com
  9. FederalUS Department of Justice, "Six Russian GRU Officers Charged in Connection with Worldwide Deployment of Destructive Malware and Other Disruptive Actions in Cyberspace," 19 October 2020. justice.gov
  10. FederalCISA, FBI, NSA and partner agencies of the UK, Australia, Canada and New Zealand, Joint Cybersecurity Advisory AA22-110A, "Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure," 20 April 2022. PDF (NCSC New Zealand copy)
  11. FederalCVE-2015-5374, published 18 July 2015: "A manual reboot may be required to recover the service of the device." Siemens security advisory SSA-732541 and ICS-CERT advisory ICSA-15-202-01, July 2015, on the same SIPROTEC flaw. CVE record
  12. GovernmentUK Government and National Cyber Security Centre, "UK exposes Russian cyber attacks" (the NCSC release "Reckless campaign of cyber attacks by Russian military intelligence service exposed"), 4 October 2018. gov.uk
  13. PressAndy Greenberg, Wired, "New Clues Show How Russia's Grid Hackers Aimed for Physical Destruction," September 2019. Cited as evidence of what was said. wired.com
  14. GovernmentCouncil Implementing Regulation (EU) 2020/1125 of 30 July 2020, listing of the Main Centre for Special Technologies (GTsST) of the GRU, field post number 74455 (read in the legislation.gov.uk copy). legislation.gov.uk
  15. GovernmentUK Government, "Profile: GRU cyber and hybrid threat operations," first published 18 July 2025, last updated 13 July 2026. gov.uk
  16. CompanyBlastWave, Hackopedia Volume 1, "Ukrenergo Kyiv Power Outage (2016)," live page and December 2025 book edition, and the Volume 1 Ukraine Power Grid page. Cited as evidence of what we said. hackopedia.blastwave.com · Volume 1 Ukraine Power Grid page
  17. FederalUnited States District Court for the Western District of Pennsylvania, indictment of six officers of GRU Unit 74455, unsealed 19 October 2020. An allegation; no defendant has been tried. PDF
  18. GovernmentIdaho National Laboratory, CyOTE program (DOE CESER), case study on Industroyer, posted December 2025. States that it is based on publicly available reports. Cited only to show what it says and what it is. PDF

Cite this page

BlastWave. “Ukrenergo Kyiv Power Grid Cyberattack (2016): What Is Verified.” Hackopedia, Volume 2, FILE 020. Last verified 15 October 2026. https://hackopedia.blastwave.com/energy/ukrenergo-2016/

Revision history

DateChange
15 Oct 2026Re-verified against primary sources. Added the October 2020 indictment's allegation that the transmission company's network was compromised from around April 2016 (no method stated). Linked a readable copy of advisory AA22-110A. Completed the ESET quotation. The initial access vector stays undisclosed.
6 Oct 2026Numbered FILE 020 in Hackopedia Volume 2, in the Energy edition.
2 Oct 2026Attribution updated: the April 2022 joint advisory AA22-110A, read at source, added for its naming of the GRU unit behind the 2016 CrashOverride (Industroyer) campaign.
28 Sep 2026Hand-check and final review: the operator's restoration figures re-read in the Ukrainian republication of the 18 December 2016 statement; the Reuters quotations, the January 2017 confirmation, the US-CERT alert, the Dragos 2017 report and the Wired article re-read; the entry checked against the related entries that mention it.
26 Sep 2026Full validation: every quotation from the Dragos 2019 paper, ESET, the CVE record, the Justice Department, the EU listing, the UK government publications and the press account of initial access checked at source, and our own Volume 1 pages re-read to state their errors exactly.
24 Sep 2026Volume 2 entry built from primary sources. Corrected Volume 1 errors: an untraceable customer count, the explanation for the relay attack's failure, a supply-chain vector with no source, and a claim that our product would have prevented the attack.

How Hackopedia verifies an entry

Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry