In December 2016, Ukraine faced a second debilitating cyberattack on its power grid, orchestrated by the notorious Sandworm group. Using the sophisticated Industroyer framework, this operation marked the first deployment of malware specifically tailored for electric grid systems. Your mission is to unravel the complexities of this attack, focusing on the threat actor's deep understanding of critical ICS protocols like IEC 101, IEC 104, and OPC, and the seamless coordination of multi-substation assaults.