On December 23, 2015, three Ukrainian heat and electricity distribution companies (oblenergos) underwent a concurrent cyberattack that caused 225,000 customers to lose their power (ISAC-SANS). The cyber adversary remotely sabotaged the SCADA distribution management system (DMS), maliciously took control of the HMIs, and subsequently launched destructive attacks to disable communications with the field. At least 27 substations were reported to have been taken offline.
This Ukrainian incident is a good example to understand the dynamics of a bold and successful cyber attack. The attack was the first of its kind, considering that it targeted a nation's critical infrastructure. It impacted physical assets, people, reliability, and reputation. Although third-party cloud providers (a typical component of IIoT architectures) were not involved in this use case, this study still showcases how the adversaries remotely hijacked the grid's operations; and...
