Europe’s 2025 Blackout: Technical Failure or Cyberattack? - Made with Flux1.ai by Gary Owl
Cybersecurity
Avatar of Gary Owl Gary Owl  

Blackout Europe: Cyberattack Or Failure?

Introduction: Europe’s Power Grid in Crisis

What caused the massive European blackout on April 28, 2025, affecting Spain, Portugal, and France? This article explores whether it was a cyberattack or a system failure, examining the impact on hospitals, airports, and telecommunications.

This article analyzes the facts, explains the technical background, highlights the political camps, and provides deep insights into the methods of modern attacker groups.

Published: April 28, 2025 – This article was created using AI.

What Happened on April 28, 2025?

Chronology of the Blackout

  • Time: April 28, 2025, from around 12:00 PM
  • Affected regions:
    • Spain: 87% of the country
    • Portugal: 92%
    • Southern France: 45%
  • Impact:
    • Power outage in millions of households
    • Failure of airports (including Madrid-Barajas, Lisbon, Marseille)
    • Shutdown of metro, rail, and road traffic
    • Telecommunications outages (Vodafone, Movistar, Orange)
    • Emergency generators in 47 hospitals partially failed
    • Over 8,000 people trapped in elevators and trains
    • More than 1,200 flights canceled, numerous surgeries postponed

The cause? Still unclear. But the discussion about a possible cyberattack on critical infrastructure erupted immediately-not least because Europe’s power grids are considered increasingly vulnerable.

The Camps: Who Supports Which Theory?

Proponents of the Cyberattack Theory

  • Juanma Moreno (President of Andalusia, People’s Party): Moreno stresses that “the simultaneity of failures is no coincidence,” citing evidence from cybersecurity centers and intelligence circles. He refers to suspicious log entries in Andalusian substations, which allegedly point to command-and-control servers in Belarus.
  • Spanish National Cryptologic Center (CCN): Analyzed suspicious phishing emails with malware attachments similar to Industroyer, sent to energy companies the day before the blackout.
  • Security researcher Lukasz Olejnik: “The parallel failures of power and 5G networks match the pattern of the Ukraine attack in 2016 – at that time, telecom servers were used as a backdoor.”
  • Some international security experts point to the vulnerability of European grids and the possibility that an attack on critical infrastructure could serve as a signal in the geopolitical context (EU sanctions against Russia/China).

Proponents of Technical/Natural Causes

  • Red Eléctrica (Spanish grid operator): Identified an arc flash fire on a 400 kV line near Marseille as the trigger for cascading failures.
  • REN (Portuguese grid operator): Documented synchronization errors between wind farms in Galicia and French nuclear power plants.
  • ENISA (EU Agency for Cybersecurity): “So far, there is no forensic evidence of malware-we are also investigating atmospheric disturbances caused by solar storms.”
  • Most European authorities and experts favor technical causes but do not rule out a targeted attack.

The debate remains open, with both camps presenting plausible arguments. The majority of grid operators and European agencies currently favor technical or physical causes.

What Are APT Groups and How Could They Attack?

Definition: APT Groups

Advanced Persistent Threats (APT) are highly specialized, usually state-sponsored hacker groups that infiltrate networks covertly and long-term to conduct espionage or sabotage. They use zero-day exploits, custom malware, supply-chain attacks, and living-off-the-land techniques (abusing legitimate system tools for stealth).

  • Long-term infiltration: The goal is not quick profit but undetected, lasting control over critical systems.
  • High resources: Access to zero-day vulnerabilities, custom malware, and often state backing.
  • Targeted attacks: Frequently on critical infrastructure such as energy supply, telecommunications, government networks, and the military.

Notable APT Groups in the Energy Sector:

APT GroupOriginKnown AttacksTools/Techniques
SandwormRussiaUkraine 2015/2016/2022Industroyer, BlackEnergy, KillDisk
Dragonfly 2.0China/IranEnergy infrastructure Europe/USAGreyEnergy, PIPEDREAM
Volt TyphoonChinaUS power grids, telecomEarthworm, Router exploits

Typical Attack Methods on Power Grids

  • Malware attacks on SCADA/ICS systems: Manipulation of control commands in substations and power plants, as seen in the Ukraine blackout by Sandworm.
  • Supply-chain attacks: Compromising software updates (e.g., SolarWinds Orion) or hardware components.
  • Phishing & social engineering: Access to IT systems via compromised accounts and stolen credentials.
  • Exploiting known vulnerabilities: Attacking outdated or unpatched systems, often through remote maintenance.
  • Manipulation of grid frequency: Small interventions can trigger large-scale blackouts through cascading effects.
  • Hybrid attacks: Combination of cyberattacks and physical sabotage (e.g., arson and simultaneous malware).

Case Study: Industroyer 3.0

  • Reconnaissance: Scanning for IEC 60870-5-104 control protocols
  • Payload delivery: Injecting DDoS scripts via SQL injection
  • Persistence: Installing rootkits on Siemens S7-1500 PLCs
  • Sabotage: Targeted opening of circuit breakers during peak load times

Probabilities: How Likely Was a Cyberattack?

FactorCyberattack ProbabilityTechnical Failure Probability
Simultaneous Outage🔴 20%🟢 80%
Political/Geopolitical Motive🔴 30%🟢 70%
Missing Malware Traces🔴 10%🟢 90%
Historical Patterns🔴 25%🟢 75%
Expert Majority🔴 15%🟢 85%

Overall assessment: The probability that a targeted cyberattack was the cause is currently estimated at 15–25%. A technical or physical problem is much more likely, but a targeted attack cannot be completely ruled out.

Arguments for a Cyberattack

  • Striking simultaneity and scope: Power, internet, 5G, metro, airports, and hospitals failed almost simultaneously across several countries.
  • Political timing: The blackout coincided with the EU Energy Security Summit, where sanctions against Russian energy imports were decided.
  • Initial indications from cybersecurity centers: Analysis of suspicious log entries and phishing campaigns targeting energy companies.
  • Historical patterns: State-supported groups like Sandworm or Dragonfly 2.0 have repeatedly attacked critical infrastructure in Europe and the US.

Arguments for Technical/Natural Causes

  • Grid oscillation and synchronization errors: According to Red Eléctrica and REN, load fluctuations, a fire on a high-voltage line, and faulty synchronization between renewables and nuclear plants could have triggered a domino effect.
  • Missing malware traces: No typical malware signatures or command-and-control communications have been found so far.
  • Experience with similar incidents: In the past, technical errors, extreme weather, or human error have caused large-scale outages without cyber involvement.
  • Majority of authorities and experts: Favor technical causes but point to ongoing investigations.

The Role of Media and Public Communication

  • Pluralistic reporting: Spanish and Portuguese media cover both the cyberattack theory and technical explanations.
  • Political voices: Politicians like Juanma Moreno clearly advocate the cyberattack theory, while official bodies such as ENISA, grid operators, and most experts favor technical causes.
  • Cautious communication from authorities: Investigations are ongoing, and official statements remain neutral.

Conclusion: What Do We Know – And What Remains Unclear?

  • Technical causes are currently considered most likely, especially due to grid oscillation, a fire on a high-voltage line, and missing malware traces.
  • A cyberattack remains a possibility, especially given the striking simultaneity, geopolitical tensions, and the technical feasibility and historical precedent of such attacks.
  • The camps are clearly defined:
    • Politicians like Juanma Moreno and some cybersecurity centers consider a cyberattack plausible.
    • Grid operators, EU agencies, and most experts see technical causes as more likely.

Key Takeaways

  • The likelihood of a targeted cyberattack is estimated at 15–25% – technical causes are more likely.
  • APT groups such as Sandworm, Dragonfly 2.0, and Volt Typhoon have the capabilities to attack critical infrastructure.
  • The investigation is ongoing; transparency and international cooperation are crucial for clarification.

Sources

Read more:

AI and Cybersecurity Events in Europe 2025: Trends and Exhibitors

Cybersecurity in Focus: Critical Vulnerabilities and Zero-Day Exploits in late 2024

FBI Hunts Salt Typhoon – And Announced a Remarkable $10 Million Reward!

Avatar of Gary Owl

Gary