U.S. warned of exploit in Ukrainian cyberattacks

Shutterstock image (by gyn9037): High voltage towers, electricity infrastructure.

A new report from Kaspersky Lab about the coordinated cyberattack over the Christmas holidays that took out sections of the Ukrainian power grid says the exploit might have appeared in the U.S. two years ago.

Cybersecurity experts say the offensive was the first cyberattack to take out a power grid.

The ability to turn a critical infrastructure cyberattack into a physical assault is among the biggest fears of security officials worldwide. Not surprisingly, cybersecurity protections for the energy grid are a top priority in the comprehensive energy bill -- the first in five years -- making its way through the Senate.

According to a Jan. 28 report by Kaspersky Lab's Global Research and Analysis Team, the attack on the Ukrainian power grid used email phishing and malware that harnessed Microsoft Word document attachments to infiltrate industrial control systems.

Kaspersky and other cybersecurity experts have said the Russia-linked BlackEnergy APT group is behind the attack.

The U.S. Industrial Control Systems Cyber Emergency Response Team warned in 2014 about BlackEnergy's use of Word and other Microsoft Office documents in a targeted campaign to infiltrate computer facilities at a U.S. academic institution, Western European governments, and energy and telecommunications companies.

ICS-CERT said BlackEnergy had successfully broken into numerous industrial control systems at U.S. electrical and water companies by exploiting Microsoft Windows and Word.

According to Kaspersky's report, the attacks in the Ukraine, which has been a favorite BlackEnergy target, showed a shift from Excel to Word attachments to spread the malware. That shift could mean the group has tweaked the malware to make it a more potent threat to the critical infrastructure sector.

"Interestingly, the use of Word documents (instead of Excel) was also mentioned by ICS-CERT, in their alert," the report states.

Another advanced persistent threat actor, called Turla, has begun using Word documents to drop malicious payloads, according to Kaspersky. "This leads us to believe that many of these attacks are successful and their popularity will increase," the report states.

About the Author

Mark Rockwell is a senior staff writer at FCW, whose beat focuses on acquisition, the Department of Homeland Security and the Department of Energy.

Before joining FCW, Rockwell was Washington correspondent for Government Security News, where he covered all aspects of homeland security from IT to detection dogs and border security. Over the last 25 years in Washington as a reporter, editor and correspondent, he has covered an increasingly wide array of high-tech issues for publications like Communications Week, Internet Week, Fiber Optics News, magazine and Wireless Week.

Rockwell received a Jesse H. Neal Award for his work covering telecommunications issues, and is a graduate of James Madison University.

Click here for previous articles by Rockwell. Contact him at or follow him on Twitter at @MRockwell4.


  • Cybersecurity

    DHS floats 'collective defense' model for cybersecurity

    Homeland Security Secretary Kirstjen Nielsen wants her department to have a more direct role in defending the private sector and critical infrastructure entities from cyberthreats.

  • Defense
    Defense Secretary James Mattis testifies at an April 12 hearing of the House Armed Services Committee.

    Mattis: Cloud deal not tailored for Amazon

    On Capitol Hill, Defense Secretary Jim Mattis sought to quell "rumors" that the Pentagon's planned single-award cloud acquisition was designed with Amazon Web Services in mind.

  • Census
    shutterstock image

    2020 Census to include citizenship question

    The Department of Commerce is breaking with recent practice and restoring a question about respondent citizenship last used in 1950, despite being urged not to by former Census directors and outside experts.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.