How Russian hackers made Ukraine a cyberweapon lab

1

Years of quiet reconnaissance

State hacking units can live inside industrial control systems for years before outsiders even name them.

Greenberg opens with analysts at iSight Partners who, in 2014, chased a zero-day inside Microsoft PowerPoint. The phishing hit NATO staff, Ukrainian officials, and energy engineers. Digging into the command servers, they found Dune references and the sandworm nickname stuck.

What stood out was not the phishing. The group showed a researcher’s curiosity about the specialized software that runs power plants, water systems, and factory floors. This looked like preparation for physical effects, not document theft.

Greenberg uses the episode to show how attribution actually works: reused infrastructure, coding habits, and target patterns accumulate slowly. No single smoking gun appeared, yet the sophistication and focus already pointed past ordinary criminals toward a well-resourced state actor. Ukraine kept surfacing as the common thread.

In practice: The same campaign that phished energy-sector engineers left folder paths and file names drawn straight from Frank Herbert’s Dune, giving researchers the handle they still use.

2

First confirmed blackout

The December 2015 attack proved a purely digital intrusion could physically cut electricity to hundreds of thousands of people.

On December 23, 2015, operators at three Ukrainian power distributors watched breakers open by themselves. Power dropped for roughly 230,000 customers in the Ivano-Frankivsk region. The intruders had spent months harvesting credentials and mapping the networks with BlackEnergy malware.

They seized the utilities’ own SCADA software, opened the breakers, and jammed call centers with fake outage reports so customers could not get through. A wiper called KillDisk then erased logs and slowed any digital recovery.

Ukrainian crews restored service the only way left: driving to substations in winter and closing breakers by hand. Greenberg treats that manual fix as the real lesson. Automation itself had become the weapon. The event forced utilities worldwide to stop treating grid cyberattacks as theoretical.

In practice: After KillDisk wiped their screens, engineers had to motor out to remote substations and physically throw the switches the attackers had opened remotely.

3

Automated grid weapon

The 2016 Kyiv attack showed Sandworm had moved from keyboard-driven sabotage to a reusable, protocol-fluent framework.

Almost a year later, on December 17, 2016, a transmission substation outside Kyiv went dark for about an hour. The outage was smaller than 2015, yet the tooling was far more advanced. Researchers at ESET and Dragos dissected malware they named Industroyer or Crash Override.

Unlike BlackEnergy, which needed operators clicking through interfaces in real time, Crash Override spoke the actual communication protocols used by European grid equipment. It could open breakers on a programmed sequence with far less human babysitting.

Greenberg presents the short outage as deliberate restraint: a live-fire test of a modular weapon that could be retargeted at other countries once the protocol modules were swapped. Ukraine had become the rehearsal space.

In practice: Crash Override did not need an attacker watching every screen; it independently issued legitimate-looking commands that grid hardware already understood.

4

Poisoned trusted update

NotPetya turned a single country’s tax software into a worm that could not be contained once released.

On June 27, 2017, malware dressed as ransomware began racing through Ukrainian networks. It arrived inside a routine update to M.E.Doc, the accounting program almost every business in the country used to file taxes. Supply-chain trust became the entry point.

Inside each network the code deployed EternalBlue, the NSA exploit leaked by the Shadow Brokers, plus Mimikatz to steal admin passwords. It then spread to every reachable machine. A ransom note demanded Bitcoin and mimicked earlier Petya ransomware, yet the encryption permanently destroyed the recovery keys.

Greenberg stresses the design choice: this was a wiper built to look like crimeware so its origin and purpose would stay muddy. Because global firms kept M.E.Doc on machines tied to Ukrainian subsidiaries or partners, the worm crossed borders in hours with no reliable kill switch.

In practice: A company that ran M.E.Doc on one regional office PC watched the worm jump from that single foothold into its entire global Windows domain.

5

Uncontained global cost

The economic damage of a cyberweapon can fall mainly on parties who were never the intended target.

Within seventy-two hours NotPetya had halted firms with no stake in the Ukraine conflict. Maersk, moving close to a fifth of global container freight, lost its entire IT stack including port terminals worldwide. The company later estimated losses between $250 and $300 million and had to rebuild tens of thousands of devices from scratch.

Merck reported around $870 million and disruptions to vaccine production. FedEx’s European arm TNT Express lost approximately $400 million and never fully recovered its earlier systems. Mondelez, Saint-Gobain, and Reckitt Benckiser each took hits in the hundreds of millions. Greenberg cites a total above $10 billion, a figure the White House itself later used.

He argues this was not classic imprecise collateral. It was the predictable result of releasing a self-spreading worm into software channels that ignore national borders. No operator can fully cage such a tool once it is live.

In practice: Maersk’s global recovery hinged on one domain controller in Ghana that had stayed offline during a local power cut and therefore escaped the wipe.

6

Slow path to attribution

Pinning a cyberattack on a specific state unit is possible yet usually trails political needs and rarely meets courtroom standards.

No single lab named Sandworm overnight. Ukrainian cyber-police, energy regulators, ESET, Dragos, FireEye, and later U.S. and U.K. intelligence each added fragments. Early noise even pointed at North Korea’s Lazarus Group because of superficial overlap with WannaCry; deeper work killed that theory.

Researchers eventually matched infrastructure, coding style, and Moscow-time working hours to Unit 74455 of Russia’s GRU. In February 2018 the United States, United Kingdom, and partners publicly blamed Russia for NotPetya. Further indictments and sanctions followed in later years.

Greenberg treats the lag as structural. Technical confidence from private researchers is not the same as legal proof, and that gap itself lowers the cost of launching such operations.

In practice: Governments formally attributed NotPetya to Russia only in February 2018, months after the worm had already caused billions in damage.

7

Ukraine as proving ground

Russia treated Ukrainian grids, businesses, and agencies as a low-consequence lab for weapons it might later aim at richer targets.

Greenberg places every major strike inside Russia’s wider post-2014 pressure campaign: conventional force in the east, information ops, economic coercion, and cyber. Ukrainian researchers told him that nearly every new disruptive tool first showed up against their country.

Government offices, media, the election commission, railways, and airports all absorbed hits around the same years as the blackouts and NotPetya. Shared language, legacy infrastructure, Western reluctance to escalate, and the fog of an active shooting war gave Moscow cover and access.

The pattern, Greenberg argues, was deliberate practice. Techniques could be refined where international push-back stayed muted, then held ready for higher-value networks running the same industrial and enterprise software.

In practice: Oleksii Yasinsky and other Ukrainian defenders watched new attack methods appear on their networks first, then later recognized the same methods aimed elsewhere.

8

People kept the lights on

Manual skill and accidental redundancy, not polished cyber defense products, actually preserved Ukraine’s grid and global logistics.

Greenberg lingers with the operators who absorbed the blows. During both blackouts, utility crews drove through freezing weather to throw switches by hand once they could no longer trust the automated systems. That old-fashioned labor restored power.

At Maersk, IT staff worked rotating shifts for ten days to rebuild the whole domain from the single surviving controller. Yasinsky’s description of watching NotPetya detonate inside his own company captures the disorientation of simultaneous failure with no obvious patient zero.

Formal playbooks helped, yet Greenberg’s deeper point is that resilience came from improvisation, from backups that existed by luck, and from exhausted people willing to work with broken tools. Some Ukrainian defenders also voiced the bitter irony that their hard-won expertise existed only because their country had been the unwilling test range.

In practice: Maersk’s worldwide Active Directory rebuild succeeded only because a power outage in Ghana had left one domain controller offline and untouched by the worm.

9

Rules that never arrived

No workable legal or normative regime treats destructive cyberattacks as acts that trigger real consequence, so infrastructure everywhere stays exposed.

In the closing stretch Greenberg steps back from the case studies. International law knows armed conflict; NotPetya caused billions in damage and hit a NATO economy through its interconnections, yet the response stayed at sanctions and statements. No one treated it as war.

He argues the gray zone is convenient for states willing to sponsor such units. They keep plausible deniability and avoid conventional escalation risks. No binding cyber equivalent of the Geneva Conventions exists. Private firms, afraid of liability or reputation damage, often under-report losses, which further stalls shared norms.

Because civilian infrastructure worldwide runs on similar control systems and enterprise software, a tool proven against a Ukrainian substation or tax package is already a prototype for any grid, port, or hospital using the same technology. Deterrence, attribution speed, and legal cost have all lagged the offense. As of the book’s writing, Sandworm’s operators had paid essentially no meaningful price.

In practice: NotPetya disrupted global shipping and vaccine production yet produced no formal military response, only later public attribution and sanctions.