During the 2016 Ukraine Electric Power Attack, It created two new accounts, "admin" and "система" (System). The accounts were then assigned to a domain matching local operation and were delegated new privileges.