How Russian-linked malware shut down heating in 600 Ukrainian buildings this winter

Enlarge / The cityscape from the tower of Lviv City Hall in winter. (Photo: Anastasiia Smolienko / Ukrinform/Future Publishing via Getty Images)

While Russia has tested every form of attack on Ukrainian citizens over the past decade, both digital and physical, it has often used winter as one of its weapons: launching cyberattacks on electricity companies to cause blackouts in December and relentlessly bombing heating infrastructure. Now, it appears that Russian hackers tried yet another approach to leave Ukrainians out in the cold this past January: a piece of malicious software that allowed hackers to gain direct access to a Ukrainian heating company for the first time, shutting down the heat and hot water in hundreds of buildings during a winter freeze.

Industrial cybersecurity firm Dragos on Tuesday revealed a newly discovered sample of Russia-linked malware that it believes was used in a cyberattack on a heating company in Lviv, Ukraine in late January that knocked out service to 600 buildings for about 48 hours. The attack, in which the malware altered temperature readings to trick control systems into cooling hot water flowing through buildings’ pipes, marks the first confirmed case in which hackers have directly sabotaged a heating company.

Dragos' report on the malware notes that the attack came at a time when Lviv was experiencing typical January freezing temperatures, close to the coldest time of year in the region, and “the civilian population had to endure subzero temperatures [Celsius] temperatures.” As Dragos analyst Kyle O'Meara puts it more bluntly: “It sucks when someone turns off your heat in the middle of winter.”