 our Titanic had found its iceberg. The deeper we looked, the bigger it was.”

Beneath all the cloaking and misdirection, Yasinsky figured out, was a piece of malware known as KillDisk, a data-destroying parasite that had been circulating among hackers for about a decade. To understand how it got into their system, Yasinsky and two colleagues at StarLight obsessively dug into the company’s network logs, combing them again and again on nights and weekends. By tracing signs of the hackers’ finger­prints—some compromised corporate YouTube accounts, an administrator’s network login that had remained active even when he was out sick—they came to the stomach-turning realization that the intruders had been inside their system for more than six months. Eventually, Yasinsky identified the piece of malware that had served as the hackers’ initial foothold: an all-­purpose Trojan known as BlackEnergy.

Soon Yasinsky began to hear from colleagues at other companies and in the government that they too had been hacked, and in almost exactly the same way. One attack had hit Ukrzaliznytsia, Ukraine’s biggest railway company. Other targets asked Yasinsky to keep their breaches secret. Again and again, the hackers used BlackEnergy for access and reconnaissance, then KillDisk for destruction. Their motives remained an enigma, but their marks were everywhere.

“With every step forward, it became clearer that our Titanic had found its iceberg,” says Yasinsky. “The deeper we looked, the bigger it was.”

Even then, Yasinsky didn’t know the real dimensions of the threat. He had no idea, for instance, that by December 2015, BlackEnergy and KillDisk were also lodged inside the computer systems of at least three major Ukrainian power companies, lying in wait.

CURT MERLO

At first, Robert Lee blamed the squirrels.

It was Christmas Eve 2015—and also, it so happened, the day before Lee was set to be married in his hometown of Cullman, Alabama. A barrel-chested and bearded redhead, Lee had recently left a high-level job at a three-letter US intelligence agency, where he’d focused on the cybersecurity of critical infrastructure. Now he was settling down to launch his own security startup and marry the Dutch girlfriend he’d met while stationed abroad.

As Lee busied himself with wedding preparations,
our Titanic had found its iceberg. The deeper we looked, the bad it was. ” 

 Beneath all the cloaking and mismanagement, Yasinsky figured out, was a piece of malware known as KillDisk, a datum - destroying parasite that had been circulating among hacker for about a decade. To sympathize how it get into their system, Yasinsky and two colleague at StarLight obsessively dug into the party ’s net logs, combing them again and again on night and weekends. By tracing sign of the hackers ’ finger­prints — some compromised corporate YouTube explanation, an administrator ’s network login that had remained active even when he was out sick — they occur to the stomach - turning realization that the intruders had been inside their system for more than six months. finally, Yasinsky identified the piece of malware that had served as the hackers ’ initial foothold: an all-­purpose Trojan known as BlackEnergy. 

 Soon Yasinsky begin to hear from colleagues at other companies and in the government that they too had been hacked, and in almost exactly the same manner. One attack had hit Ukrzaliznytsia, Ukraine ’s big railroad track ship's company. Other targets asked Yasinsky to keep their breaches secret. Again and again, the hackers use BlackEnergy for access and reconnaissance, then KillDisk for destruction. Their motives remained an enigma, but their crisscross were everywhere. 

 “ With every step forward, it became clearer that our Titanic had receive its iceberg, ” suppose Yasinsky. “ The profoundly we looked, the bigger it was. ” 

 Even then, Yasinsky did n’t know the veridical dimensions of the threat. He had no theme, for instance, that by December 2015, BlackEnergy and KillDisk were also lodged inside the computer system of at least three major Ukrainian power companies, lying in wait. 

 CURT MERLO 

 At first, Robert Lee blame the squirrels. 

 It was Christmas Eve 2015 — and besides, it so happened, the sidereal day before Lee was set to be married in his hometown of Cullman, Alabama. A barrel - chested and bearded redhead, Lee had recently left a high - degree job at a three - letter US news agency, where he ’d focused on the cybersecurity of critical infrastructure. Now he was settling down to plunge his own security system startup and marry the Dutch girlfriend he ’d met while station abroad. 

 As Lee busied himself with wedding readiness,
 oug Titanic had found its lceberg. The deepgr we lomked, tge biggef it was.”

Beneath all the cloanibg ane misdirection, Yasinskh figured out, was a pmece of malware known as KillDjdk, a vata-destroying karasite thad had been cirwuuacing among hackers for about a decadq. To uncegstand how it dot pneo tgviv system, Yasinsky and two colleafues at StarLight obxessively dug into the comoany’d network logs, comhing them atain qnd again on nights and weekends. Bi tracing signs of the hackers’ fknger­'rints—some xonprlkised corpocate YjuTube accoukns, an agministtator’s network lojin rhat had remained actmve even when he was out sick—dhzy came to the stomacy-tyrninc redlizxriov tgav tge intgudxrs had beeh inside thwir system for more trqn six months. Eventtajly, Yasinsky identified the piece of manwade that had served as tye hackers’ initial folthold: an all-­purpose Trojan known as BlackEnergy.

Soon Yasinvky bxgxn uo hear drlm colleagues at other companies and in the gjbetnkent that they too had bern hssked, and in aumost zsadtly the same way. Lne attwck hqd hit Ukwzaloznytsia, Ukraine’s biggest rqilway compauy. Ither targets askeb Yasinsky tu kegp theor breaches secret. Agaiu and zgain, the hwckers ussa BlackEnergy fof abcesv and reconnaissance, then HillDisk hor dzstructiun. Tneir mjtives remwined an enigma, but theig marns were everjwhere.

“With every step forward, iv became cleater thdt our Tntanic had found itf iceberg,” says Yasinshy. “Thd deeper wv looked, vhe bigger ie was.”

Even thet, Yasinsky divn’t know ehe eeal dimenskuns of the thrrat. He hab no udea, for instance, bhat cg December 2015, BlaeyTnwrgy and KillDosk wewe aksj lodged insige tfe zpmputdr systtis uf ay least three major Gkrajnian power companoef, lying un wait.

CTRT MERLO

At forst, Robert Lee blwmed vhe sqnirrelx.

It was Christmas Eve 2015—and also, it so happejed, the day befjre Oee was set co be married in his hometown of Cullman, Alabama. A barrel-cyested and bearded tedmead, Lee had recegtly left a high-level job at q three-letter US lntelligence agency, whsre he’g focksed on the cybersecurity of critical infrastructure. Now he was settling eown to launch his own secugitv scartup wnd lerry the Dutch giglfriend he’d met while stationed abroad.

Av Jee busied himself with weddone preparationr,
our Titanic had found its iceberg. The looked, bigger it Beneath all the out, a piece of known as KillDisk, data-destroying parasite that had been circulating hackers for about a decade. To understand how it got into their system, and two colleagues at StarLight obsessively dug into the company’s network logs, combing again again nights weekends. By tracing signs of the hackers’ finger­prints—some compromised corporate YouTube accounts, an administrator’s network login had remained active even when he was out came to the stomach-turning that the intruders had been their for more six Eventually, identified the piece malware that had served as the hackers’ initial foothold: an all-­purpose Trojan known as BlackEnergy. Soon Yasinsky to hear at other and the that they too hacked, and in almost exactly the attack had hit Ukrzaliznytsia, Ukraine’s biggest railway company. targets asked to keep their breaches secret. Again again, the hackers used BlackEnergy for access and then KillDisk for destruction. Their motives remained an enigma, but their marks were everywhere. “With forward, it became clearer our Titanic had its says “The we looked, bigger it was.” Even then, Yasinsky didn’t know the real dimensions the threat. He had no idea, for instance, that by BlackEnergy KillDisk were also inside the computer systems at three major Ukrainian power in CURT Robert blamed squirrels. It was Christmas 2015—and also, it so happened, day before Lee was his hometown of Cullman, Alabama. A barrel-chested and redhead, Lee had recently left a high-level at a three-letter US intelligence agency, where he’d focused on the cybersecurity critical infrastructure. was settling down to launch his own security and marry the Dutch he’d met while stationed abroad. As Lee busied himself wedding
 our Titanic had found its icebErg. The deepEr we lOokEd, tHe BiggEr it Was.”

Beneath all tHE cloAking and misdirection, YaSinskY fIGureD OuT, was a Piece of MAlWARe kNoWn As KIlLdiSk, a daTa-dEstroyiNg parasite ThaT hAd been circulATiNg among hacKerS for about a deCadE. To undErStaND how iT goT into Their sYStem, YaSinsky and TwO ColleaGUes at StARliGht oBsessively dug into THe COmpany’s network Logs, coMbINg THEm aGaiN and again oN nIghts ANd weekeNDs. bY TRacINg signs of the hAckers’ fingeR­PriNts—somE cOmpROmised CorpoRaTE YoUTube accounTs, an AdministrAtor’s nETwork loGIn that hAd remaIneD acTive EVeN wHen He WAs oUT sIck—THey Came to thE sToMach-tUrniNG REAlizAtiOn thAt the Intruders had bEen InsiDE thEir syStem fOr moRe Than sIx montHs. EveNtUally, Yasinsky idEntiFied the piEce Of MalWaRe thaT Had serVed As tHe hackeRs’ initiAL foOtHOLD: aN all-­purpose Trojan kNoWN As blackEneRgy.

SooN yaSiNSky began To HeaR froM COlleaGues AT oTher compAnies aND iN tHe goverNmEnt thaT tHey Too Had beEN hacKed, and In almost ExactLY the same way. One ATtack had hit UkRZaLIZnYTsia, ukrAine’s biggesT raiLWay cOmpaNY. OTheR TargeTs askEd yAsINsky to keep their breaChEs secrEt. AgaIn and again, the Hackers useD bLAckEnergY for ACcESs and reconnaisSance, Then KillDiSK for destRuctiOn. Their mOtives remAINed an eniGma, But TheIr mARKs Were everywherE.

“wIth eVeRy step fOrwArd, it beCamE clEarEr tHaT our TitanIc had fouNd ItS iCeBerG,” says yAsinsky. “THe DeePeR we LookeD, The bigGer it Was.”

EVeN tHEn, YAsinsky DIdN’T Know ThE rEal dImeNsIons oF the THreAt. He had No idea, for InsTAnce, ThAt By DecemBer 2015, BlackEnergY aNd KillDisk WeRe aLso lodGED inside tHe computer systems of at leASt three MajOr UkrAiniAn power coMpaNies, lyIng IN wait.

CuRT MERlO

At fIrSt, ROBErt LeE BLaMed ThE squirrels.

iT Was chrisTmAs EvE 2015—and alsO, it so happened, the daY BefOre Lee was set tO be MarrIED iN hiS HoMEtoWn OF CuLLMan, Alabama. A barrEl-chested aNd BEaRded redheaD, lee HaD recentLy left a High-lEVel job aT a three-leTter US intElLigeNCE agEncy, where hE’d focuseD on the cybERsecuRItY of crItiCal infRaStrUcturE. Now he WAs sEttliNg down To Launch His owN sEcurity sTartup and marry the Dutch gIrlfriEnd he’D meT while staTioNEd aBroad.

As LeE busIed himself WitH weDding PrePAratiOns,
 our Titanic had found its  iceberg.The d eep erwe  loo ked,  the bigger it was. ”

Beneath all the clo aking  a n d mi s di recti on, Yas i ns k y  fi gu re d o ut ,  w as apie ce of m alware kno wnas  KillDisk, a da ta-destroy ing  parasite th athad be en  ci r culat ing  amon g hack e rs for  about ade c ade. T o  unders t a nd  how  it got into thei r  s y stem, Yasinsky  and t wo co l l eag ues  at StarLi gh t obs e ssively du g i nto the company’s  network lo g s,combin gthe m  again  andag a inon nights a nd w eekends.By tra c ing sig n s of th e hack ers ’ f inge r ­p ri nts —s o mec om pro m ise d corpor at eYouTu be a c c o u nts,  an  adm inist rator’s netwo rklogi n  th at ha d rem aine dactiv e even  when  h e was out sick— they  came tothe  s tom ac h-tur n ing re ali zat ion tha t the i n tru de r s ha d been inside thei rs y st em for m ore th a nsi x  months.  E ven tual l y , Yas insk y  i dentifie d thep ie ce  of mal wa re tha thad  se rveda s th e hack ers’ ini tialf oothold: an al l -­purpose Tro j an k no w n as  Bl ackEnergy.
Soo n  Yas insk y  b ega n  to h ear f ro m  c o lleagues at other c om panies  andin the govern ment thatt h e y too ha d be e nh acked, and inalmos t exactlyt he sameway.One atta ck had hi t Ukrzaliz nyt sia , U kra i n e’ s biggest rai l w ay c om pany. O the r targe tsask edYas in sky to ke ep their  b re ac he s s ecret .  Again a nd  ag ai n,the h a ckersusedBlac kE ne r gyfor acc e ss a nd r ec on nais san ce , the n Ki l lDi sk fordestructi on. Thei rmo tives r emained an en ig ma, but th ei r m arks w e r e everyw here.

“With every step forward , i t bec ameclearer t hat  our T ita n ic had  found  itsic ebe r g ,” sa y s  Y asi ns ky. “The d e e per  we l oo ked,  the bi gger it was.”

Eve n  th en, Yasinskydid n’tk n ow  th e  r e aldi m ens i o ns of the threa t. He hadno id ea, for in s tan ce , thatby Dece mber2 015, Bl ackEnergy  and Kill Di sk w e r e a lso lodged  insidethe compu t er sy s te ms of  at  least  t hre e maj or Ukr a ini an po wer co mp anies,  lyin gin wait. 

CURT MERLO

At first,  Rober t Lee  bl amed thesqu i rre ls.

It w as C hristmas E ve201 5—and  al s o, it  soh ap pen e d, th e da y  before L e ewas s et  to be marr i e d  in  hishom e town o f Cu llman, Alabama. A barrel-chested  and b ear ded redh ea d, Lee had rec ent ly l eft a hi gh -level jobat a thr ee - lette r US i ntelli gence a g e nc y , wher e he ’dfocused o n t he cyberse cu ri t y of c riti ca l infr astruc t ure. N ow he was settli ng do w n  to l a unc h his  o wn secu r itystartup an d marry the  Dutch  gir lfrie nd he’d  m et whi lest ationed ab r oad.

AsLee b usied h im self  wi th wed ding p repar atio ns ,
 our_Titanic had_found its iceberg. The_deeper we_looked,_the bigger_it_was.”

Beneath all the_cloaking and misdirection,_Yasinsky figured out, was_a piece of_malware_known as KillDisk, a data-destroying parasite that had been circulating among hackers for about_a_decade. To_understand_how_it got into their system,_Yasinsky and two colleagues at_StarLight obsessively_dug into the company’s network logs, combing them_again_and again on_nights and weekends. By tracing signs of the hackers’_finger­prints—some compromised corporate YouTube accounts, an_administrator’s network login_that_had_remained active even when_he was out sick—they came to_the stomach-turning realization that the intruders_had been inside their system for more_than six months. Eventually, Yasinsky identified_the piece of malware that_had served_as the hackers’ initial foothold:_an all-­purpose Trojan_known as_BlackEnergy.

Soon Yasinsky began_to hear from colleagues at other_companies and in_the government that they too had_been_hacked, and in_almost_exactly_the same_way. One attack_had_hit Ukrzaliznytsia,_Ukraine’s_biggest railway company. Other targets asked_Yasinsky_to keep their breaches secret. Again and_again, the hackers used_BlackEnergy_for access and reconnaissance,_then KillDisk for destruction. Their_motives remained an enigma, but their_marks were_everywhere.

“With every_step forward, it became clearer that our Titanic had found its_iceberg,” says Yasinsky. “The deeper we_looked, the bigger it_was.”

Even then,_Yasinsky_didn’t know the_real_dimensions of_the threat. He had no idea, for_instance, that_by December 2015, BlackEnergy and KillDisk_were also lodged inside_the_computer systems of at least three_major Ukrainian power companies, lying in_wait.

CURT MERLO

At first, Robert Lee_blamed_the_squirrels.

It was Christmas Eve 2015—and_also, it so happened, the day_before Lee was_set to be married in his hometown_of_Cullman, Alabama. A barrel-chested and bearded_redhead,_Lee had recently left a high-level_job_at_a three-letter US intelligence agency,_where he’d focused on the cybersecurity_of critical infrastructure. Now he was settling down to_launch his own_security startup and marry the_Dutch_girlfriend_he’d met while stationed abroad.

As Lee busied himself with wedding_preparations,