During the 2015 Ukraine Electric Power Attack, It used BlackEnergy’s network sniffer module to discover user credentials being sent over the network between the local LAN and the power grid’s industrial control systems. 