Experts warn that repeated cyberattacks on Ukraine, including mass power outages in Kiev, are evidence of Russia testing its offensive cyber capabilities
Andy Greenberg / Wired : Tweets: @wired and @zekejmiller . Thanks: @gfififi Tweets: @wired : “The people who understand the US power grid know that it can happen here.” http://www.wired.com/... http://twitter.com/... Zeke Miller / @zekejmiller : Blackouts in Ukraine were just a trial run. Russian hackers are learning to sabotage infrastructure http://www.wired.com/... via @WIRED Thanks: @gfififi
Context & Ripple Effects
This piece lands a week after researchers identified Crash Override as only the second known malware ever to attack physical infrastructure, and it reframes Ukraine's blackouts not as isolated incidents but as a rehearsal: the same country whose grid was breached in the unprecedented 2015 hack of Ukraine's power grid keeps getting hit, and each outage teaches the operators something new.
The stakes are framed as domestic for American readers — grid experts quoted argue the same sabotage is possible in the US — and the later corpus bears that out: the reconstruction of the US grid intrusion campaign from 2016 to 2018 showed attackers had spent years mapping contractors and trade publications, while Mandiant's finding of a third successful Sandworm strike on Ukraine's electric utility in October 2022 confirmed the testing never stopped.
First-order effects
- Ukrainian grid operators are absorbing repeated, successful attacks on the same target, making their utilities the world's most-attacked power infrastructure and forcing continuous defensive rebuilding between incidents.
- US power-grid operators move from theoretical concern to concrete threat model: the experts cited say the conditions for an equivalent blackout exist domestically.
Second-order effects
- Adversaries shift from attacking utilities directly to mapping them indirectly — the US grid campaign targeted contractors and energy trade publications rather than control systems themselves, exploiting the supply chain around critical infrastructure.
- Grid-defense economics come into focus: as reporting on why real disruptions remain rare explains, the multi-step difficulty of executing a physical attack makes defense investments concentrated at those choke points disproportionately valuable.
Third-order effects
- If the pattern holds, Ukraine functions as a permanent live-fire proving ground where offensive capabilities against industrial systems are refined and exported — a template later visible when Sandworm synchronized a cyberattack with missile strikes on the same utility.
- Critical-infrastructure security structurally separates into two tiers of nations: those learning from others' outages and those paying for the lessons directly, widening the defensive gap between grid operators exposed to state-grade attackers and those merely preparing for them.
The trend: State offensive cyber capability is being matured through repeated attacks on Ukrainian infrastructure before ever touching Western targets, turning one country's grid into the industry's ongoing case study in digital-to-physical sabotage.