Spain's Power Blackout: An Analysis of Cyberattacks on Critical Energy Infrastructure
By Kike Gandia · Threats · 8 min read
The massive blackout that hit Spain and Portugal on April 28, 2025 has reopened the debate over how vulnerable critical infrastructure is to cyberattacks. With millions of people affected and essential services brought to a standstill, the incident is one of the biggest challenges to European energy security in recent years. This report analyzes the Spanish blackout, the types of cyberattacks aimed at power infrastructure, similar historical cases and the main actors behind these threats.
The Spanish blackout: an unprecedented incident
On April 28, 2025, at 12:32, Spain and Portugal suffered a massive blackout that cut power to much of the Iberian Peninsula. The incident began with a “very strong oscillation in power flows” that disconnected the Spanish power system from the European grid (the interconnection with France), leading to the collapse of the entire network (5). Within seconds, roughly 60% of the system's generation disappeared.
Island and non-peninsular territories such as the Canary Islands, the Balearic Islands, Ceuta and Melilla were not affected, because they are independent of the mainland grid (9). Red Eléctrica, the system operator, described the incident as “exceptional and totally extraordinary”, noting that nothing of the kind had happened in more than 40 years (52).
- 12:32
- on April 28, 2025 (Spain and Portugal go dark)
- 60%
- of power generation disappeared (within seconds)
- 40 years
- without an event of this kind (according to Red Eléctrica)
- 4
- island and non-peninsular territories unaffected (Canary Islands, Balearic Islands, Ceuta and Melilla)
The incident began with a “very strong oscillation in power flows” that disconnected the Spanish system from the European grid.
Investigating the causes
Although no official cause was established at first, several sources pointed to a possible cyberattack
- The National Cryptologic Center (CCN), part of Spain's National Intelligence Center (CNI), and the Ministry of Defense's Joint Cyberspace Command opened specific investigations to determine whether it was a cyberattack (2).
- The Policía Nacional (Spanish National Police), through its General Commissariat of Information, was working in coordination to establish whether the blackout was the result of a cyberattack (4).
- The CNI reported having detected “a large amount of unusual activity coming from North Africa” days before the blackout, coinciding with a high cyberthreat risk level (18).
- Sources in the power sector considered a cyberattack “the most likely cause” of the general blackout, arguing that a conventional short circuit would have been isolated by the protection systems without causing a total collapse (19).
Spanish Prime Minister Pedro Sánchez appeared in public after an extraordinary cabinet meeting and stated that “we are not ruling out any hypothesis”, adding to the uncertainty around this historic total blackout (15).
On the cause. This article covers the indicators that pointed to a cyberattack and the investigations opened by the CCN, the Joint Cyberspace Command and the Policía Nacional. None of those hypotheses had been confirmed at the time of publication: the Prime Minister stated that “we are not ruling out any hypothesis”.
Types of cyberattacks on critical power infrastructure
Modern power infrastructure is particularly vulnerable because of its growing digitalization and interconnection. The main types of cyberattacks that can affect it include:
Attacks on SCADA systems
Supervisory Control and Data Acquisition (SCADA) systems are at the heart of power grid operations. In the Spanish case, the observed pattern suggested “a denial-of-service attack aimed at the SCADA systems” that manage power distribution in real time 918.
Specialized malware
There is malware designed specifically to attack power infrastructure:
- 2015 BlackEnergy
- Used in the attacks on Ukraine. It gives attackers access to industrial control systems.
- 2016 Industroyer / Crashoverride
- The first malware designed specifically to attack power grids. It directly manipulates substation switches and circuit breakers.
Exploiting vulnerabilities in industrial protocols
The protocols used in power systems, such as IEC 60870-5-104, mentioned in the Spanish case, were not originally designed with cybersecurity in mind, which makes them vulnerable targets 9. Attackers can inject malicious commands that manipulate these protocols to destabilize the grid.
Initial access techniques
- Initial access Spear phishing
- Fraudulent emails sent to employees with access to critical systems.
- Initial access Known vulnerabilities
- Such as the Lazarus group exploiting Log4j flaws at energy companies.
- Initial access Social engineering
- Manipulating employees or contractors to obtain credentials or physical access.
Historical cases of cyberattacks on power grids
Ukraine 2015: the first confirmed case
On December 23, 2015, three Ukrainian power companies suffered the first confirmed cyberattack on a power grid. The attackers used the BlackEnergy 3 malware to compromise the control systems, leaving around 230,000 customers without power for 1 to 6 hours 1016. The attack set a historic precedent and showed how vulnerable critical infrastructure is to cyberthreats.
Ukraine 2016: growing sophistication
A year later, on December 17, 2016, a new attack hit the Kyiv power grid using the Industroyer/Crashoverride malware, designed specifically to attack power control systems 11. The malware could directly manipulate substation switches and circuit breakers, showing an unprecedented level of sophistication.
Ukraine 2022: the threat persists
After Russia's invasion of Ukraine, the Sandworm group attacked the power infrastructure again, this time using an improved variant called Industroyer2 1113. These attacks were built into the military strategy of the conflict, showing how cyberspace has become a new domain of warfare.
- Dec 23, 2015 — Ukraine · the first confirmed case
Three power companies compromised with BlackEnergy 3. Around 230,000 customers without power for 1 to 6 hours. The precedent that proved how vulnerable critical infrastructure is. - Dec 17, 2016 — Kyiv · growing sophistication
Industroyer/Crashoverride, designed to attack power control systems, directly manipulates substation switches. - 2022 — Ukraine · the threat persists
After the Russian invasion, the Sandworm group returns with Industroyer2. The attack becomes part of the conflict's military strategy. - Apr 28, 2025 — Spain and Portugal
A pattern consistent with denial of service against SCADA and command injection over industrial protocols, preceded by “unusual activity coming from North Africa” detected by the CNI.
The sequence reconstructed in this report. The technical similarities suggest a transfer of knowledge and capabilities between hostile actors.
Other significant incidents
- US, 2021 Colonial Pipeline
- It did not affect a power grid, but it showed the potential consequences of cyberattacks on energy infrastructure.
- South Africa, 2019 City Power
- An attack that affected the power supply in parts of Johannesburg.
- 2025 Cyber Av3ngers
- Linked to Iran, the group attacked water treatment systems in Ireland and Pennsylvania: the techniques used against power grids also work against other essential services.
Similarities between the Spanish case and earlier attacks
The Spanish blackout shares significant characteristics with earlier attacks on power infrastructure:
Similar technical patterns
The pattern observed in Spain suggests techniques similar to those used in Ukraine: denial-of-service attacks combined with malicious command injection over industrial protocols 911. These attacks require in-depth knowledge of both electrical engineering and industrial control systems.
Preparation and prior reconnaissance
Just as the Ukrainian attacks were preceded by extensive reconnaissance phases, the CNI detected “a large amount of unusual activity coming from North Africa” days before the Spanish blackout 18. This activity could correspond to the preparation phase typical of APT groups, which tend to study their targets in detail before attacking.
Scale and complexity
Both the Spanish blackout and the Ukrainian ones were characterized by:
- Affecting a large geographic area 516
- Requiring long recovery times 19
- Causing national and international power systems to disconnect from each other 5
The difficulty of attribution
As with the Ukrainian attacks, where definitive attribution to Russia took time, in the Spanish case the authorities were cautious about naming those responsible, despite the indicators pointing to North Africa 318.
The main actors behind cyberattacks on critical infrastructure
State-sponsored APT groups
Cyberattacks on critical infrastructure are usually the work of groups with advanced capabilities and state backing:
Sandworm (Russia)
Also known as ELECTRUM, Black Energy or VOODOO BEAR, it is an APT group linked to the GRU (Russian military intelligence). It is responsible for multiple attacks on critical infrastructure, including the blackouts in Ukraine in 2015, 2016 and 2022 111314. Its experience attacking power grids makes it one of the most dangerous actors in this field.
Lazarus Group (North Korea)
Also tracked as APT38 or Hidden Cobra, this North Korean group has run campaigns against energy companies in the US, Japan and Canada. In 2025, it was reported to be exploiting Log4j vulnerabilities in VMware Horizon deployments to compromise energy infrastructure 15.
APT-Mor and Sand Cobra (Morocco)
Mentioned in connection with the Spanish blackout, these groups have experience in sabotage and industrial espionage operations, with a history of attacks on energy grids, military facilities and strategic sectors in Western Europe 9.
Dragonfly (Russia)
Attributed to the Russian FSB, it has a track record of attacks on the energy sector in Europe and North America, using sophisticated techniques for the long-term compromise of critical infrastructure 13.
- Russia · GRU Sandworm
- Also ELECTRUM, Black Energy or VOODOO BEAR. Responsible for the Ukrainian blackouts in 2015, 2016 and 2022. Its experience with power grids makes it one of the most dangerous actors in the field.
- North Korea Lazarus Group
- Also APT38 or Hidden Cobra. Campaigns against energy companies in the US, Japan and Canada, exploiting Log4j in VMware Horizon deployments.
- Morocco APT-Mor and Sand Cobra
- Mentioned in connection with the Spanish blackout. Experience in sabotage and industrial espionage against energy grids, military facilities and strategic sectors in Western Europe.
- Russia · FSB Dragonfly
- A track record of attacks on the energy sector in Europe and North America, using long-term compromise techniques.
Motivations and objectives
- Motivation Political and economic destabilization
- Attacking power infrastructure can have a greater impact than attacking a state directly.
- Motivation Geopolitical pressure
- A tool of influence that stops short of direct military conflict.
- Motivation Demonstrating capabilities
- Showing off a country's cyber power to deter potential adversaries.
- Motivation Preparing for conflict
- Part of a broader strategy of preparing for conventional military escalation.
Specific vulnerabilities of modern power grids
Digitalization without enough security
Power grids are now “smart”, able to process large volumes of data and control electricity flows in real time. However, this modernization has opened new entry points into the energy management system 3. Integrating information technology with traditional industrial control systems creates new attack surfaces.
Vulnerable industrial protocols
The industrial communication protocols used in power grids, such as IEC 60870-5-104, mentioned in the Spanish case, were not originally designed with cybersecurity as a priority 9. They lack robust authentication and encryption mechanisms, which makes them easier for attackers to manipulate.
International interconnection
Interconnecting power grids across countries, like the Spain–France link mentioned in the blackout 5, improves efficiency but also creates dependencies that can magnify the impact of an attack. A failure at one point can spread quickly to connected systems.
Cascading impact
Power systems are designed to disconnect automatically when certain anomalies occur, as a protection mechanism. However, attackers can exploit this feature to trigger a “domino effect” in which multiple disconnections cause a general system collapse 519.
- Surface Digitalization without enough security
- Grids are now “smart” and control flows in real time, but integrating IT with traditional industrial control opens up new attack surfaces.
- Protocol IEC 60870-5-104 and the rest
- Industrial protocols were not designed with cybersecurity as a priority: they lack robust authentication and encryption mechanisms.
- Dependency International interconnection
- The Spain–France link improves efficiency, but it creates dependencies that magnify the impact: a failure at one point spreads to connected systems.
- Design Cascading impact
- Automatic disconnection when anomalies occur is a protection mechanism, but an attacker can exploit it to trigger a domino effect.
The four structural vulnerabilities shared by modern power grids.
Conclusions and outlook
The massive blackout in Spain marks a turning point for the security of Europe's critical infrastructure, whatever its ultimate cause. The growing sophistication of cyberattacks aimed at power systems, combined with the rapid digitalization of this infrastructure, creates a vulnerability landscape that demands an urgent response.
Historical cases, particularly the attacks on Ukraine, show that cyberattack-induced blackouts are no longer a theoretical threat but a tangible reality with serious economic and social consequences. The technical similarities between these incidents suggest a transfer of knowledge and capabilities between different hostile actors.
Attributing these attacks remains a significant challenge, which makes them attractive tools for states that want to apply geopolitical pressure without facing the consequences of a conventional attack. This cyber “gray zone” is a new field of international conflict where the lines between peace and war are blurring.
Looking ahead, it is essential to strengthen the security of critical infrastructure through approaches that combine technical and organizational measures with international cooperation. Once its causes have been fully established, the Spanish experience will probably act as a catalyst for reviewing security protocols across European energy infrastructure and for accelerating the rollout of systems that are more resilient to these growing threats.
Related service
Pentesting and ethical hacking services