U.S. warned of exploit in Ukrainian cyberattacks

Shutterstock image (by gyn9037): High voltage towers, electricity infrastructure.

A new report from Kaspersky Lab about the coordinated cyberattack over the Christmas holidays that took out sections of the Ukrainian power grid says the exploit might have appeared in the U.S. two years ago.

Cybersecurity experts say the offensive was the first cyberattack to take out a power grid.

The ability to turn a critical infrastructure cyberattack into a physical assault is among the biggest fears of security officials worldwide. Not surprisingly, cybersecurity protections for the energy grid are a top priority in the comprehensive energy bill -- the first in five years -- making its way through the Senate.

According to a Jan. 28 report by Kaspersky Lab's Global Research and Analysis Team, the attack on the Ukrainian power grid used email phishing and malware that harnessed Microsoft Word document attachments to infiltrate industrial control systems.

Kaspersky and other cybersecurity experts have said the Russia-linked BlackEnergy APT group is behind the attack.

The U.S. Industrial Control Systems Cyber Emergency Response Team warned in 2014 about BlackEnergy's use of Word and other Microsoft Office documents in a targeted campaign to infiltrate computer facilities at a U.S. academic institution, Western European governments, and energy and telecommunications companies.

ICS-CERT said BlackEnergy had successfully broken into numerous industrial control systems at U.S. electrical and water companies by exploiting Microsoft Windows and Word.

According to Kaspersky's report, the attacks in the Ukraine, which has been a favorite BlackEnergy target, showed a shift from Excel to Word attachments to spread the malware. That shift could mean the group has tweaked the malware to make it a more potent threat to the critical infrastructure sector.

"Interestingly, the use of Word documents (instead of Excel) was also mentioned by ICS-CERT, in their alert," the report states.

Another advanced persistent threat actor, called Turla, has begun using Word documents to drop malicious payloads, according to Kaspersky. "This leads us to believe that many of these attacks are successful and their popularity will increase," the report states.

About the Author

Mark Rockwell is a senior staff writer at FCW, whose beat focuses on acquisition, the Department of Homeland Security and the Department of Energy.

Before joining FCW, Rockwell was Washington correspondent for Government Security News, where he covered all aspects of homeland security from IT to detection dogs and border security. Over the last 25 years in Washington as a reporter, editor and correspondent, he has covered an increasingly wide array of high-tech issues for publications like Communications Week, Internet Week, Fiber Optics News, magazine and Wireless Week.

Rockwell received a Jesse H. Neal Award for his work covering telecommunications issues, and is a graduate of James Madison University.

Click here for previous articles by Rockwell. Contact him at [email protected] or follow him on Twitter at @MRockwell4.


  • People
    Federal 100 logo

    Announcing the 2021 Federal 100 Award winners

    Meet the women and men being honored for their exceptional contributions to federal IT.

  • Comment
    Diverse Workforce (Image: Shutterstock)

    Who cares if you wear a hoodie or a suit? It’s the mission that matters most

    Responding to Steve Kelman's recent blog post, Alan Thomas shares the inside story on 18F's evolution.

Stay Connected