The attack was the first in five years to use Sandworm’s Industroyer malware, which is designed to automatically trigger power disruptions.
Wired