INCIDENT REPORT · CP-2016-001

Industroyer / CrashOverride attack on Kyiv grid

L3 · ELEVATEDCONFIRMED

Malware purpose-built to attack electric grid control systems was used against a transmission substation in Kyiv in December 2016. ESET named it Industroyer and Dragos named it CrashOverride.

Incident ID: CP-2016-001
Incident date: 17 DEC 2016
Detection date: Not publicly documented
Affected countries: Ukraine
Plotted location: Kyiv, Ukraine (Affected infrastructure location)
Threat classification: Level 3 — ELEVATED
Classification rationale: Significant capability against critical infrastructure, but the outage was localized and lasted about an hour.
Attack type: Infrastructure Compromise
Nature: Malicious activity
Attack vector: Grid-specific malware (Industroyer/CrashOverride) able to directly control substation switches and circuit breakers
Sectors: Energy
Critical infrastructure: Yes
Organizations affected: Ukrenergo (transmission substation serving Kyiv)
Operational consequences: Part of Kyiv lost power for about one hour. Researchers described it as only the second known malware built to disrupt physical industrial processes, after Stuxnet.
Estimated financial impact: No reliably documented figure
Attribution (as stated): Attributed by the US Department of Justice (October 2020 indictment) to Russian GRU Unit 74455 (Sandworm), whose charged attacks on Ukraine's power grid ran from December 2015 to December 2016

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

Industroyer / CrashOverride attack on Kyiv grid

L3 · ELEVATEDCONFIRMED

Malware purpose-built to attack electric grid control systems was used against a transmission substation in Kyiv in December 2016. ESET named it Industroyer and Dragos named it CrashOverride.

Incident ID

CP-2016-001

Incident date

17 DEC 2016

Detection date

Not publicly documented

Affected countries

Ukraine

Plotted location

Kyiv, Ukraine (Affected infrastructure location)

Threat classification

Level 3 — ELEVATED

Classification rationale

Significant capability against critical infrastructure, but the outage was localized and lasted about an hour.

Attack type

Infrastructure Compromise

Nature

Malicious activity

Attack vector

Grid-specific malware (Industroyer/CrashOverride) able to directly control substation switches and circuit breakers

Sectors

Energy

Critical infrastructure

Yes

Organizations affected

Ukrenergo (transmission substation serving Kyiv)

Operational consequences

Part of Kyiv lost power for about one hour. Researchers described it as only the second known malware built to disrupt physical industrial processes, after Stuxnet.

Estimated financial impact

No reliably documented figure

Attribution (as stated)

Attributed by the US Department of Justice (October 2020 indictment) to Russian GRU Unit 74455 (Sandworm), whose charged attacks on Ukraine's power grid ran from December 2015 to December 2016