Power Grid

Viasat KA-SAT / Enercon wind fleet — AcidRain wiper spillover

24 February 2022

Germany (Enercon fleet); KA-SAT coverage across Europe

What happened

In the opening hour of Russia's invasion of Ukraine, a wiper later named AcidRain bricked tens of thousands of Viasat KA-SAT satellite modems across Europe. Spillover from the attack — aimed at Ukrainian communications — severed remote monitoring and control links to about 5,800 Enercon wind turbines in Germany, roughly 11 GW of capacity. The turbines kept generating in autonomous mode, but operators lost SCADA visibility, and restoring or replacing modems took weeks to months. The incident is a defining example of collateral cyber damage to energy infrastructure from an attack on a third-party communications provider. The marker is placed at Enercon's Aurich headquarters.

When cited sources give different casualty, damage or spill figures for this event, they’re reported side by side above rather than merged into one number. See how confidence levels work.

Evidence
Documented
Confidence
High
Infrastructure
Power Grid
Latitude
53.4700°
Longitude
7.4800°

Attribution

Attributed to Russia

The EU, UK and US formally attributed the KA-SAT attack to Russia in May 2022. SentinelLabs linked the AcidRain wiper to malware previously attributed to Russian actors.

Sources

  1. Satellite cyber attack paralyzes 11GW of German wind turbinespv magazine · Incident reporting