Cyber Incident Victim: Ukrenergo
Date:
Jun 2017
Location:
Ukraine
Summary
A cyber attack employing Petrwrap ransomware targeted multiple Ukrainian critical infrastructure entities, including a state power distributor, national bank, and largest airport, causing widespread disruptions. Government systems were rendered inoperable, displaying ransom demands for $300 in Bitcoin to restore access, while financial services, airport operations, and retail payment systems faced outages. The malware shared similarities with WannaCry and also affected international firms, though power supplies remained unaffected. The incident occurred amid heightened tensions following prior infrastructure attacks attributed to Russian-linked actors, though direct attribution for this event was unspecified.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On June 27, 2017, a widespread cyber attack disrupted Ukrainian government and corporate systems, including state power distributor Ukrenergo, the National Bank of Ukraine, Boryspil International Airport, state aircraft manufacturer Antonov, and state-owned lender Oschadbank. The attack began with government computers displaying error messages claiming disks contained errors and instructing users not to power down devices. Deputy Prime Minister Rozenko Pavlo confirmed the government network was down, with his computer and others showing identical ransom messages. Affected systems across multiple organizations displayed ransomware demands for $300 in Bitcoin to restore access to encrypted files. Analysts identified the malware as Petrwrap or Petya, noting similarities to the WannaCry ransomware that caused global disruptions the previous month.
The attack disabled critical infrastructure, including airport departure boards, ATMs, and supermarket payment systems. Ukrenergo confirmed its systems were compromised but stated power supplies remained unaffected. Oschadbank reported service disruptions but assured customer data security. The incident extended beyond Ukraine, affecting multinational companies like Maersk and Rosneft, though direct links to the Ukrainian attack were unconfirmed. The cyber strike occurred one day before Ukraine's Constitution Day and hours after the assassination of Ukrainian intelligence officer Colonel Maksim Shapoval in Kyiv. Ukrainian authorities historically attributed similar infrastructure attacks, including a 2015 power grid disruption, to Russian actors, though Russia consistently denied involvement. The attack exacerbated existing tensions stemming from Russia's 2014 annexation of Crimea and support for separatist forces in eastern Ukraine. No group claimed responsibility, and restoration timelines for affected systems were not disclosed in available reporting.