“Malware attack on Ukrainian airport comes from Russia”

A spokesman for the Ukrainian army told Reuters that a malware attack on Kiev airport came from Russia. The malware is said to resemble the BlackEnergy malware, which was previously used in the attacks on power plants.

The spokesman told Reuters news agency that the server used for the attacks is located in Russia. The malware attack targeted the Boryspil airport network, which also includes the air traffic control system. No damage would have been done, as the malware was identified at an early stage. The Ukrainian CERT warned of further attacks and advised all system administrators to “keep an eye on log files and information traffic.”

There are indications that the malware used resembles the BlackEnergy malware, which was used in December to shut down three power plants in Ukraine. According to a recent report from security firm iSight, these attacks were carried out by a group known as “Sandworm.” This group has been interested in critical infrastructure systems for some time, both in the US and in Europe. At the time, another investigation stated that the power plants had not been shut down as a direct result of the deployment of malware, but that the attack consisted of several components.