Industroyer2 – Ukraine Grid Attack Attempt
April 2022
Executive Summary
Sandworm deployed Industroyer2, an updated variant of the 2016 Industroyer malware, against a Ukrainian regional energy company during Russia's ongoing invasion. The attack aimed to de-energize electrical substations using IEC 104 protocol commands. CERT-UA and ESET detected and neutralized the attack before it could cause a sustained outage, marking a successful wartime cyber defense.
Why This Matters
Industroyer2 confirmed that grid-targeting ICS malware is now a recurring feature of armed conflict, while its successful mitigation showed that coordinated cyber defense can work under wartime conditions.
Escalation Profile
7-Dimension Profile
Escalation Ladder
Phases
Pre-positioning in energy network
Sandworm established access to a Ukrainian energy company's OT network weeks before the planned attack.
Industroyer2 deployment attempt
Industroyer2 configured to issue IEC 104 commands to open breakers at targeted substations; CaddyWiper deployed on IT systems to hinder forensics.
Threshold Crossings
- •First known use of purpose-built ICS malware during an active conventional war
- •Confirmed that Sandworm maintained and updated its grid-attack toolkit across six years
Restraint Factors
- •Attack was detected and mitigated before causing sustained outage
- •Narrower scope than the 2016 Industroyer attack
Attribution Assessment
Threat actor mapped to Russia based on infrastructure analysis, malware attribution, and operational patterns.
Evidence: ESET: Industroyer2 — Sandworm Targets Ukraine's Power Grid Again
- •CERT-UA public disclosure with ESET technical analysis (Apr 2022)
- •Cited in allied governments' ongoing documentation of Russian cyber operations in Ukraine
- •Reinforced NATO and EU cyber assistance to Ukraine
Sources: CERT-UA Alert #4435: Industroyer2 and CaddyWiper
No dedicated journalistic sources in dataset. See sources section for full references.
“Confirmed” reflects available public evidence. All assessments carry inherent uncertainty and should be read alongside source material.
Unpeace Position
Unpeace Score
Composite severity rating on the peace–conflict spectrum
Contributing Dimensions
Coercive Function
Sabotage
Physical or functional disruption of systems — coercive value through demonstrating capability to cause real-world harm.
Observed coercive effects
- •First known use of purpose-built ICS malware during an active conventional war
- •Confirmed that Sandworm maintained and updated its grid-attack toolkit across six years
Entanglement Risk
Sectors affected
Countries / regions
Impact summary
Attack neutralized before sustained outage; demonstrated continued ICS threat capability during wartime.
Infrastructure Meaning
Malware / tooling
Capability profile
Attack neutralized before sustained outage; demonstrated continued ICS threat capability during wartime.
3 ATT&CK techniques mapped — see ATT&CK mapping below.
Governance Analysis
Governance Flags
Norms invoked
- •IHL prohibition on attacking civilian objects (electric grid serving civilians)
- •UN GGE 2015 norm against damaging critical infrastructure
Policy responses
- •CERT-UA public disclosure with ESET technical analysis (Apr 2022)
- •Cited in allied governments' ongoing documentation of Russian cyber operations in Ukraine
- •Reinforced NATO and EU cyber assistance to Ukraine
Regulatory changes
- •Strengthened international support for Ukrainian energy-sector cyber defense
- •Informed EU NIS2 Directive risk scenarios for energy operators
Governance impact assessment
Demonstrated both the persistent threat of ICS-targeted malware in armed conflict and the effectiveness of international cyber defense cooperation in neutralizing it.
Sources
ESET: Industroyer2 — Sandworm Targets Ukraine's Power Grid Again
CERT-UA Alert #4435: Industroyer2 and CaddyWiper
Sources listed reflect publicly available materials used to construct this case entry. Inclusion does not imply endorsement. Where no URL is provided, the source may be found via its title and date.
Related Cases
Ukraine Grid I
December 2015 · Russia
Ukraine 2015 was the first confirmed cyber-caused power outage, turning a theoretical risk into an operational reality that reshaped how governments defend energy grids.
Ukraine Grid II
December 2016 · Russia
Industroyer represented a generational leap in ICS malware sophistication — a modular, protocol-aware weapon that signaled the industrialization of grid-targeted cyber capabilities.
Stuxnet
circa 2007 – 2010 · United States / Israel
Stuxnet proved that software alone can destroy physical infrastructure, fundamentally changing how states, lawyers, and strategists think about the threshold between cyber operations and armed conflict.
Oldsmar Water
February 2021 · Unknown
Oldsmar made water-system cyber risk tangible for policymakers and the public, revealing how small utilities with minimal security budgets can become targets with public-health consequences.