In December 2015, the world witnessed the first confirmed cyberattack on a power grid. The notorious Sandworm group, a Russian cyber military unit, executed a meticulously planned attack that plunged 230,000 Ukrainians into darkness. Trainees will dissect the sophisticated use of BlackEnergy malware, the destructive KillDisk wiper, and the manipulation of SCADA systems, unraveling the methods behind this landmark cyber assault.