By James Pearson
LONDON (Reuters) -Russian&nbsp;cyber&nbsp;spies&nbsp;were&nbsp;behind&nbsp;a&nbsp;hack&nbsp;which&nbsp;disrupted&nbsp;part&nbsp;of&nbsp;Ukraine's&nbsp;power&nbsp;grid&nbsp;in&nbsp;late&nbsp;2022&nbsp;in a&nbsp;rare&nbsp;and&nbsp;advanced&nbsp;form&nbsp;of&nbsp;cyberwarfare,&nbsp;U.S.&nbsp;cybersecurity&nbsp;firm&nbsp;Mandiant,&nbsp;part&nbsp;of&nbsp;Google,&nbsp;said&nbsp;in a&nbsp;report&nbsp;on Thursday.
Ukraine's&nbsp;SBU, the country's main intelligence agency, confirmed in a statement to Reuters that&nbsp;Russian&nbsp;hackers had struck a facility near its frontline with Russia. &nbsp;
Successful&nbsp;hacks against industrial control systems are relatively unique, with Russia being one of the few countries with the capability to carry out such&nbsp;cyberattacks.
&ldquo;This attack represents the&nbsp;latest evolution in Russia&rsquo;s&nbsp;cyber&nbsp;physical attack capability,&nbsp;which&nbsp;has been increasingly visible since Russia&rsquo;s invasion of Ukraine,&rdquo;&nbsp;said&nbsp;the&nbsp;report,&nbsp;which&nbsp;did not identify the specific facility against&nbsp;which&nbsp;the attack had been carried out.
Last October, a massive wave of&nbsp;Russian&nbsp;missile strikes on&nbsp;Ukraine's&nbsp;power&nbsp;network caused blackouts&nbsp;in many&nbsp;parts of the country, prompting Kyiv to halt&nbsp;power&nbsp;exports&nbsp;and&nbsp;leaving four regions temporarily without electricity.
The&nbsp;hacking group, known in&nbsp;cybersecurity research circles by the moniker &ldquo;Sandworm&rdquo;, was able to cause a&nbsp;power&nbsp;cut in an unidentified area of Ukraine by tripping circuit breakers at an electrical substation at the same time as the missile strike, the&nbsp;report&nbsp;said. The group then deployed data-wiping malware in a bid to cover their tracks, the&nbsp;report&nbsp;added.
Sandworm has been previously identified as a&nbsp;cyberwarfare unit of Russia&rsquo;s GRU military intelligence agency.
Russia&rsquo;s foreign ministry did not respond to a request for comment. The GRU could not be reached for comment.
Ukraine&rsquo;s foreign ministry did not provide comment.&nbsp;
The SBU said Sandworm was&nbsp;behind&nbsp;the&nbsp;cyberattack&nbsp;and&nbsp;that the group was staffed by GRU officers. The attack was likely carried out to maximise the impact of&nbsp;Russian&nbsp;missile strikes, Illia Vitiuk, head of the agency's&nbsp;cybersecurity department,&nbsp;said&nbsp;in a statement.
Sandworm&nbsp;hackers rose to prominence in 2015 after a separate&nbsp;cyberattack against Ukraine&rsquo;s&nbsp;power&nbsp;grid,&nbsp;which&nbsp;cut off&nbsp;power&nbsp;for around 255,000 people. The disruptive digital intrusion was widely considered to be one of the first known successful&nbsp;cyberattacks against a&nbsp;power&nbsp;network.
&ldquo;There have only been a handful of incidents similar to this, with the majority carried out by Sandworm,&rdquo; Mandiant analyst Nathan Brubaker&nbsp;said.&nbsp;
(Reporting by James Pearson in London; Additional&nbsp;reporting by Christopher Bing in Washington&nbsp;and&nbsp;Tom Balmforth in Kyiv; Editing by Sharon Singleton&nbsp;and&nbsp;Bernadette Baum)

you might like

Russian spies behind cyber attack on Ukraine power grid in 2022 - researchers