This alert update is a follow-up to the original NCCIC/ICS-CERT Alert titled IR-ALERT-H-16-043-01P Ukrainian Power Outage Event that was published February 12, 2016, on the US-CERT secure Portal library.

——— Begin Update A Part 1 of 2 ——–

On December 23, 2015, Ukrainian power companies (Oblenergos) experienced an unprecedented cyber-attack causing power outages,which impactedover 225,000 customers in Ukraine. These attacks were conducted by remote cyber-attackers who, leveraging legitimate credentials obtained via unknown means, remotely operated breakers to disconnect power. While power has been restored, all the impacted Oblenergos continue to run under constrained operations. In addition, three other organizations, some from other critical infrastructure sectors, were also intruded upon but did not experienceoperational impacts. There have been public reports that indicate BlackEnergy (BE) malware was responsible for the attack. However,National Cybersecurity and Communications Integration Center (NCCIC)/Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) does not have sufficient supporting evidenceto confirm the role of BE but continues to conduct further analysis. If BE played a role, it was most likely in the reconnaissance and preparatoryphases, not during the actual attack. Many malware implants could have conducted this activity.

This incident highlights the urgent need for critical infrastructure owners and operators across all sectors to implement enhanced cyber measures that reduce risks from the following types of adversary techniques:

• Theft of legitimate user credentials to enable access masquerading as approved users,
• Leveraging legitimate remote access pathways (VPNs),
• The remote operation of human-machine interface (HMI) via company installed remote access software (such as RDP, TeamViewer or rlogin)
• The use of destructive malware such as KillDisk to disable industrial control systems (ICSs) and corporate network systems
• Firmware overwrites that disable/destroy field equipment
• Unauthorized scheduled disconnects of uninterruptable power supplies (UPS) to devices to deny their availability
• The delivery of malware via spear-phishing emails and the use of malicious Microsoft Office attachments
• Use of Telephone Denial of Service (TDoS) to disrupt operations and restoration.

This report is being shared for situational awareness and network defense purposes. ICS-CERT strongly encourages organizations across all sectors to review and employ the mitigation strategies and detection mechanisms contained within this report.

DETAILS

An interagency team composed of representatives from the NCCIC/ICS-CERT, U.S. Computer Emergency Readiness Team (US-CERT), Department of Energy,Federal Bureau of Investigation, and the North American Electric Reliability Corporationtraveled to Ukraine to collaborate and gain more insight. The Ukrainian government worked closely and openly with the U.S. team and shared information to help prevent future cyber-attacks.

The following account of events is based on the interagency team’s interviews with operations and information technology staff and leadership at six Ukrainian organizations with first-hand experience of the event. The team was not able to independently review technical evidence of the cyber-attack; however, a significant number of independent reports from the team’s interviews, as well as documentary findings, corroborate the events as outlined below.

Through interviews with impacted entities, the team learned that power outages Ukraine experienced on December 23, 2015, were caused by remote cyber-attacks at three regional electric power distribution companies (Oblenergos), impacting approximately 225,000 customers. While power has been restored, all the impacted Oblenergos continue to run under constrained operations. In addition, three other organizations, some from other critical infrastructure sectors, were also intruded upon but did not experience operational impacts.

The team assesses that the attacks against the Oblenergos demonstrated some Tactics, Techniques, and Procedures (TTPs) that,while previously known, have not been previously observedin an actual cyber-attack. The cyber-attacks were reportedly synchronized and coordinated, probably following extensive reconnaissance of the victim networks.

After gaining a foothold in the victim networks, attackers acquired legitimate credentials and leveraged valid remote access pathways to conduct their attack.The physical impact events of the cyber-attacks launched within 30 minutes of each other, impacting multiple central and regional facilities. Over 50 regional substations experienced malicious remote operation of their breakers conducted by multiple external humans. This was done using either existing remote administration tools at the operating system level or remote ICS client software via virtual private network (VPN) connections.

All three impacted companies indicated that the actors wiped some systems by executing the KillDisk malware at the conclusion of the cyber-attack. The KillDisk malware erases selected files on target systems and corrupts the master boot record, rendering systems inoperable. It was further reported that in at least one instance, Windows-based HMIs embedded in remote terminal units were also overwritten with KillDisk. The actors also rendered Serial-to-Ethernet devices at substations inoperable by corrupting their firmware. In addition, the actors interrupted power to some data centers through scheduled power outages on server UPS via the remote management interface. The team assesses that these actions were done in an attempt to interfere with expected restoration efforts.

Initial intrusion appears to have been through malware,which was delivered via spear-phishing emails with malicious Microsoft Office attachments.While it has not been confirmed with technical artifacts, it is probable that the two events are related. While the cyber-attack has been widely attributed to BE in the open press, any remote access trojan could have been used in these attacks, and none of BE’s unique capabilities were leveraged. At this time,no definitive link can be drawn between the outage and the presence of the BEmalware, however analysis is ongoing.

…

Share this: