Gold Open Source
ExplorePackagesVulnerabilitiesMCP Servers
Login
Gold Open Source

The authoritative source for production-ready open-source components. Every package, container image, AI model, and MCP server undergoes rigorous verification for security, malware, and license compliance.

Explore Gold

  • Explore Everything
  • Packages
  • Gold Packages
  • Container Images
  • AI Models
  • MCP Servers
  • Agent Skills
  • Chip Manufacturers

Security Data & Tools

  • Scan Your Dependencies
  • Trending Threats
  • Threat RSS Feeds
  • CVE Database
  • Actively Exploited (KEV)
  • SGZ Zero-Days
  • CWE Index
  • MITRE ATT&CK
  • Malicious Packages
  • Security Glossary
  • Supply-Chain Report
  • Developers (API & Badge)
  • Chrome Extension
  • Credits & Data Sources

Products

  • The Platform
  • ESSCM
  • Portal
  • TPRM
  • OSM
  • Cowork
  • Code / Runner
  • Guard

Use Cases

  • Know Your Software
  • Auto-Fix Vulnerabilities
  • Asset Discovery
  • AI Governance
  • MCP Server Security
  • Supply Chain Compliance
  • Zero-Day Discovery
  • All Use Cases

Company

  • About
  • Pricing
  • Blog
  • Documentation
  • Safeguard Academy
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 Gold Open Source. All rights reserved.

Built with care bySafeguard
Home/ATT&CK/Campaigns/C0028
MITRE ATT&CK Campaign · 2015–2016

2015 Ukraine Electric Power Attack (C0028)

ShareXLinkedInRedditHN

[2015 Ukraine Electric Power Attack](https://attack.mitre.org/campaigns/C0028) was a [Sandworm Team](https://attack.mitre.org/groups/G0034) campaign during which they used [BlackEnergy](https://attack.mitre.org/software/S0089) (specifically BlackEnergy3) and [KillDisk](https://attack.mitre.org/software/S0607) to target and disrupt transmission and distribution substations within the Ukrainian power grid. This campaign was the first major public attack conducted against the Ukrainian power grid by Sandworm Team.

▪Attributed groups (1)

G0034Sandworm Team

▪Techniques used (37)

T1566.001Spearphishing AttachmentT1112Modify RegistryT1685Disable or Modify Tools

▪Software used (2)

S0607KillDiskmalwareS0089BlackEnergymalware
C0028 on MITRE ATT&CK →
T1070.004File Deletion
T1018Remote System Discovery
T1133External Remote Services
T1105Ingress Tool Transfer
T1204.002Malicious File
T1078Valid Accounts
T1040Network Sniffing
T1136.002Domain Account
T1218.011Rundll32
T1059.005Visual Basic
T1071.001Web Protocols
T1570Lateral Tool Transfer
T1056.001Keylogging
T1055Process Injection
T0822External Remote Services
T0884Connection Proxy
T0859Valid Accounts
T0886Remote Services
T0828Loss of Productivity and Revenue
T0831Manipulation of Control
T1693.001System Firmware
T0885Commonly Used Port
T1695.001Serial COM
T0814Denial of Service
T0867Lateral Tool Transfer
T0816Device Restart/Shutdown
T0823Graphical User Interface
T0813Denial of Control
T0846Remote System Discovery
T1691.001Command Message
T1692.001Command Message
T0827Loss of Control
T1691.002Reporting Message
T0826Loss of Availability

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.