Skip to content

2015 Ukraine Electric Power Attack

Campaign · ATTACK:ics:C0028

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:ics:C0028",
  "title": "2015 Ukraine Electric Power Attack",
  "type": "Campaign",
  "source_url": "https://attack.mitre.org/campaigns/C0028",
  "snapshot": "ics-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "campaign--46421788-b6e1-4256-b351-f8beffd1afba",
  "external_id": "C0028",
  "domain": "ics",
  "created": "2023-09-27T13:11:52.340Z",
  "modified": "2026-08-04T20:48:44.047Z",
  "version": "1.0",
  "aliases": [
    "2015 Ukraine Electric Power Attack"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Booz Allen Hamilton",
      "url": "https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf"
    }
  ]
}

Explicit source assertions (23)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:ics:C0028 → uses → ATTACK:ics:T0822

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--00b9e63b-57a7-408e-83d6-fc03535010a6

Booz Allen Hamilton

ATTACK:ics:C0028 → uses → ATTACK:ics:T0884

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--13d76624-7049-45c5-94d3-8f172b7f6336

Booz Allen Hamilton

ATTACK:ics:C0028 → uses → ATTACK:ics:S0607

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1dad5efc-395f-4b92-8f4f-3e987a4d5e57

Booz Allen Hamilton

ATTACK:ics:C0028 → uses → ATTACK:ics:T0859

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f0d1a71-7cb6-4979-b072-a859d117d47f

Booz Allen Hamilton · Ukraine15 - EISAC - 201603

ATTACK:ics:C0028 → uses → ATTACK:ics:T0886

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--352ed52c-88ba-4731-a917-4c33da0f29d4

Andy Greenberg June 2017

ATTACK:ics:C0028 → uses → ATTACK:ics:T0828

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--423271c0-04dc-42d0-8e27-fb0b6067e096

Booz Allen Hamilton · Ukraine15 - EISAC - 201603

ATTACK:ics:C0028 → attributed-to → ATTACK:ics:G0034

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4d407dda-944a-4974-b1c2-0a04d2c9ee4c

Andy Greenberg June 2017 · US District Court Indictment GRU Unit 74455 October 2020

ATTACK:ics:C0028 → uses → ATTACK:ics:T0831

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f83cc15-274d-44c6-859f-e598e362e76e

Ukraine15 - EISAC - 201603

ATTACK:ics:C0028 → uses → ATTACK:ics:T1693.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5068c7c3-5922-447a-bf49-8301e797e992

Ukraine15 - EISAC - 201603

ATTACK:ics:C0028 → uses → ATTACK:ics:T0885

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6573327e-3757-424e-8570-04ffe7d5d0e2

Booz Allen Hamilton

ATTACK:ics:C0028 → uses → ATTACK:ics:T1695.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6fb4c5ec-4079-4419-a098-6e3cf026c360

Booz Allen Hamilton

ATTACK:ics:C0028 → uses → ATTACK:ics:T0814

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7d752615-33f0-44ed-a156-25d84f384e75

Ukraine15 - EISAC - 201603

ATTACK:ics:C0028 → uses → ATTACK:ics:T0867

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8a86ad59-dff1-46dc-8ffd-3c62b96c6e62

Booz Allen Hamilton

ATTACK:ics:C0028 → uses → ATTACK:ics:T0816

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8b7403f5-90d2-4d2c-a484-87d29f419a9f

Booz Allen Hamilton · Ukraine15 - EISAC - 201603

ATTACK:ics:C0028 → uses → ATTACK:ics:T0823

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8d0d6365-7bc0-417d-9268-c7c31fcb0d91

Ukraine15 - EISAC - 201603

ATTACK:ics:C0028 → uses → ATTACK:ics:T0813

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--97756c8a-b702-472b-8d67-15464a73093e

Booz Allen Hamilton · Ukraine15 - EISAC - 201603

ATTACK:ics:C0028 → uses → ATTACK:ics:T0846

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a57b233b-6613-4f78-aa48-e85518aaa7cf

Booz Allen Hamilton · Charles McLellan March 2016

ATTACK:ics:C0028 → uses → ATTACK:ics:T1691.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ba9ebebf-d5dd-4a5c-b44f-a07cc3ccac8b

Ukraine15 - EISAC - 201603

ATTACK:ics:C0028 → uses → ATTACK:ics:S0089

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c8e78d6f-ac9d-4ad3-ae13-238f1eb4423a

Booz Allen Hamilton

ATTACK:ics:C0028 → uses → ATTACK:ics:T1692.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cdc5aea4-1aac-4e6b-86cd-39617629d96b

Ukraine15 - EISAC - 201603

ATTACK:ics:C0028 → uses → ATTACK:ics:T0827

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d1388bba-9869-4e3e-a6c9-430784ad924d

Ukraine15 - EISAC - 201603

ATTACK:ics:C0028 → uses → ATTACK:ics:T1691.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--da38a045-d29a-4c08-9951-c8e520229584

Ukraine15 - EISAC - 201603

ATTACK:ics:C0028 → uses → ATTACK:ics:T0826

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f7c5bd1b-c596-41b2-b415-2bf5179667df

Booz Allen Hamilton · Ukraine15 - EISAC - 201603

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.