Ukrainian energy companies are being targeted by Russian-linked threat actors with newly modified malware variants “Industroyer ICS,” and “CaddyWiper.” In recent days, threat actors from the Sandworm threat organization have targeted several high voltage power substations and deployed Industroyer ICS to compromise the substation, followed by CaddyWiper deployment on Windows-based systems and other payloads on Linux-based systems. Security researchers have noticed that the wipers utilized in this campaign have the capability to move laterally within the network, compromising additional assets of the substations. Once the malware is deployed on the system, a tasking is scheduled on the system for file destruction. Attacks on Ukraine’s power substations were identified by security teams and were stopped by government officials shortly after detection, lessening the potential impact of the attack. Security teams also noted a suspicious attack timeline due to the attack occurring around the time they were decommissioning components of their internal infrastructure. CTIX will continue to monitor the situation and will provide additional information accordingly.