Confirmed attacks and the timeline of escalation
We begin with events that are on the public record. In December 2015 a coordinated campaign cut power to parts of western Ukraine. Cybersecurity firms ESET and SANS ICS documented malware families known as BlackEnergy and KillDisk used against local utilities. In 2016 follow up operations again disrupted services and targeted substations. Analysts at Dragos and others later identified Industroyer, also called CrashOverride, as a specialised set of tools capable of directly controlling protection relays in substations. Sources include the ESET report on the 2015 incidents and Dragos analysis of Industroyer. We link to US and international advisories from CERT teams that followed these breakouts.
Why legacy systems are an open door
Our analysis shows cause and effect in clear sequence. First, utilities run industrial control systems that predate modern security practices. Second, those systems were gradually connected to corporate and vendor networks for convenience and remote management. Third, when those bridges are poorly segmented attackers gain an inland route to operational controls. Older SCADA devices often run unsupported operating systems and rely on default credentials or unencrypted protocols. The result is a widespread attack surface that can be exploited by well resourced actors seeking political leverage.
Geopolitics, intelligence agencies and military strategy
We must separate what is confirmed from what we infer. It is confirmed that state actors have targeted energy infrastructure in conflict zones and that some malware linked to nation state campaigns was used against Ukraine. It is informed speculation that similar techniques are considered in broader strategic playbooks where energy denial can create political pressure without open kinetic warfare. Intelligence agencies perceive cyber operations against grids as an asymmetric tool that can destabilise an adversary, disrupt supply chains and shift diplomatic bargaining. Historical scholarship and recent governmental briefings show that cyber campaigns are integrated into wider hybrid operations that combine disinformation, economic pressure and conventional military moves.
Diplomatic pressure, supply chains and resource conflict
We track how attacks translate into influence. A successful disruption forces states to divert resources to restoration and hardening. That creates windows for diplomatic pressure and negotiation over fuel, contracts and strategic assets. Parliamentary records and government reports in several countries have warned that supply chain dependencies for specialised grid components grant geopolitical leverage to supplier states. Our team notes how trade embargoes, export controls and targeted sanctions are both responses to and causes of shifts in supply chain resilience.
What to watch and the strategic responses
We recommend watching three timelines. First, the pace of patching and network segmentation within utilities. Second, diplomatic moves such as cyber norms negotiations and mutual restraint agreements. Third, military and intelligence postures that include both defensive deployments and offensive cyber deterrence. Agencies like NERC and national energy departments publish guidance and incident reports. Parliamentary inquiries and investigative journalists provide oversight. These strands together shape whether ageing grids remain an exploitable vulnerability or become robust strategic infrastructure.
Below are selected references from cybersecurity firms, government advisories, parliamentary analysis and investigative reporting that informed our briefing. We clearly separate the documented incidents above from broader strategic inferences that remain informed speculation rather than proven fact.
References and sources
- ESET analysis of the 2015 Ukraine power outage
- US ICS-CERT advisories and alerts
- Dragos analysis of Industroyer CrashOverride
- Reuters reporting on the Ukraine grid incidents
- UK House of Commons Library briefing on cyber security
- US Department of Energy on grid modernisation
- NERC guidance on critical infrastructure protection
Sign up to our newsletter for daily briefs.