Attributing an attack on a power grid
A power grid operator suffers an outage caused by industrial malware, followed by the wiping of its servers. Assess capabilities, intent, context and technical overlaps, then write a careful attribution.
Briefing
Valdoria (fictional country), November 3, 2026, 9:47 pm: 11 substations of VELNET, the distribution grid operator, open their breakers. 240,000 households lose power for 4 hours. Two hours later, the supervision servers become unusable. The government is due to vote the next day on joining a defense alliance. As an analyst at the national CERT, the ministry asks you for an attribution assessment for an 8 am meeting.
Fictional scenario and data, built on real techniques. .example domains and documentation IP ranges.
Objectives
- Assess the attacker’s capability level
- Infer intent from the sequence of actions
- Weigh the geopolitical context
- Assess technical overlaps and false flag risk
- State an attribution in estimative language
Tools used in real investigations
Ready to put it into practice?
CyberXTEL is our free platform to train hands-on: certifications, CTFs and a dedicated cyber awareness space.