Loading story…
CERT-UA disclosed a targeted attack on a Ukrainian energy facility in which operators attempted to disrupt high-voltage substations and destroy Windows, Linux, and network infrastructure. The operation used INDUSTROYER2 to issue hardcoded IEC 60870-5-104 (IEC-104) commands against specific substations, while CADDYWIPER targeted Windows systems and ORCSHRED, SOLOSHRED, and AWFULSHRED were prepared to wipe Linux hosts. CERT-UA said the attackers had access no later than February 2022, launched two attack waves, and planned the disruptive phase for April 8, but the intended impact was prevented; supporting tooling included ARGUEPATCH, TAILJUMP, PowerShell-based POWERGAP, SSH tunnel chains, and Impacket for remote execution and lateral movement.
Technical analyses from Nozomi Networks, Netresec, and Splunk found that Industroyer2 was a tailored, standalone executable focused exclusively on IEC-104, with hardcoded station parameters, IP addresses, and Information Object Addresses (IOAs) for deterministic command execution against predefined substations. Researchers reported strong code and structural similarities to the original Industroyer used in the 2016 Ukraine grid attack, concluding the malware likely evolved from the same source code and reflects Sandworm’s continued refinement of OT attack capabilities. The payload was designed to run in a privileged environment with direct substation access, terminate selected processes, manage IEC-104 sessions including TESTFR handling, and in some samples connect to specific targets over TCP port 2404, underscoring detailed prior knowledge of the victim’s operational technology environment.
See the actors and campaigns active against you right now.
8 events from the most recent confirmed update back to the earliest known activity.
Splunk Threat Research published a threat update on Industroyer2, describing its use against Ukraine's electric grid alongside CaddyWiper and outlining its execution logic and hardcoded targeting data. Splunk also released Linux and Windows detection analytics tied to behaviors observed in the campaign.
Nozomi Networks published analysis concluding that Industroyer2 closely resembles the original Industroyer IEC-104 component and likely came from the same evolving source code. The report described hardcoded station and IOA configurations and the malware's IEC-104 command sequence.
Netresec analyzed sample "40_115.exe" and concluded it was hard-coded to attack specific Ukrainian electric utility substations over IEC-104 on port 2404. The analysis also noted a second sample, "108_100.exe," configured for a different set of substations, indicating tailored malware builds.
CERT-UA said the planned shutdown of substations and broader infrastructure disruption was scheduled for the evening of Friday, 8 April 2022. The operation was intended to affect substations, Windows systems, Linux servers, and network equipment.
CERT-UA and Netresec reported that Industroyer2 binaries used in the operation were compiled on 2022-03-23 and contained hardcoded parameters for specific substations. The tailored builds indicate preparation for distinct target environments.
CERT-UA reported that the victim organization's initial compromise occurred no later than February 2022. This marked the start of the broader operation against the Ukrainian energy facility.
The original Industroyer malware was first deployed by Sandworm against Ukraine's power grid in 2016. Multiple references identify this as the earlier precursor to Industroyer2.
CERT-UA reported that the attackers' plan against the Ukrainian energy-sector facility was prevented from being carried out. The agency described two attack waves and shared operational information, malware samples, IOCs, and YARA rules with selected partners and Ukrainian energy-sector entities.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
7 references tracked. Mallory keeps watching after this page renders.
splunk.com
Open sourcenozominetworks.com
Open sourcenetresec.com
Open sourcenozominetworks.com
Open sourcecert.gov.ua
Open sourcedatatracker.ietf.org
Open sourcecollaborate.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and Polish incident responders linked a late-2025 cyberattack on Poland’s energy sector to Russia-aligned group **Sandworm**, with ESET attributing the operation with medium confidence based on overlaps with earlier Sandworm wiper activity. ESET said the attackers deployed a new data-wiping malware family it named **DynoWiper**, detected as `Win32/KillFiles.NMO`, against power-grid targets, while CERT Polska published an incident report on the 29 December 2025 energy-sector attack. ESET said it was not aware of any confirmed successful disruption, and the intended operational impact remained under investigation. Separate technical analysis of attacks against Polish wind and solar farm grid-connection substations described destructive actions against operational technology used to connect distributed energy resources to distribution operators. The attackers reportedly abused default credentials and weak security on **Hitachi Relion IEDs**, **Hitachi RTU560** controllers, **Mikronika RTUs**, and **Moxa NPort 6000** serial device servers, deleting critical files, wiping filesystems, resetting configurations, and in some cases uploading malicious firmware to effectively soft- or hard-brick devices. Analysts warned that such OT-focused destruction can prolong outages and recovery far beyond conventional IT wiping, echoing tactics seen in earlier Sandworm-linked grid operations such as **BlackEnergy** and **Industroyer**.
Aug 1, 2026
Ukrainian electric utilities suffered a coordinated cyberattack that caused power outages for civilians, marking one of the clearest cases of a cyber operation producing a real-world disruption of critical infrastructure. Reporting from iSIGHT Partners and SANS ICS assessed with high confidence that the outage was intentional and attributed the intrusion to **Sandworm Team**, citing the presence of **BlackEnergy 3** malware in affected environments and the use of the destructive component **KillDisk** during the operation. U.S. government industrial control system alerts later documented the incident as a cyberattack against Ukrainian critical infrastructure and tied it to a broader, ongoing malware campaign targeting ICS environments. The reporting said **KillDisk** may have been used less to trigger the outage than to hinder restoration and operator visibility after the attack, while flooding utility call centers with phone traffic likely complicated response efforts; the incident also fit Sandworm’s wider pattern of targeting Ukrainian entities, regional power organizations, and other government and media networks while showing sustained interest in **SCADA** and industrial control systems.
Jun 29, 2026
Multiple destructive malware campaigns struck Ukraine around the start of Russia’s invasion, with **HermeticWiper**, **IsaacWiper**, **CaddyWiper**, **WhisperGate**, and **DoubleZero** used against government, financial, and other organizations. Researchers reported that HermeticWiper corrupted boot records and partition data by abusing a legitimate EaseUS driver, while CaddyWiper and DoubleZero erased user data, partition information, and critical registry or boot components, often while deliberately sparing domain controllers to preserve attacker access. Several incidents appeared to follow prior compromise of victim networks, including abuse of **Active Directory**, scheduled execution, and in some cases worm-like spread via **HermeticWizard**; HermeticRansom was also deployed as a likely decoy alongside destructive activity. The destructive operations extended beyond enterprise Windows environments. **AcidRain** was used in the attack on Viasat’s **KA-SAT** network, wiping satellite modems in Ukraine and elsewhere in Europe by recursively destroying filesystems and storage devices, while the **Industroyer2** operation targeted a Ukrainian energy provider with malware built to communicate over **IEC-104** and cut power, paired with Windows, Linux, and Solaris wipers including **CaddyWiper**, **ORCSHRED**, **SOLOSHRED**, and **AWFULSHRED**. Across the reporting, defenders were urged to watch for mass file overwrites, shadow copy and event log deletion, MBR or partition changes, suspicious use of administrative tooling and group policy, and to maintain tested, isolated backups to recover from destructive attacks.
Aug 15, 2026