One electricity grid operator used is iPhone to record video of the hack real-time. He watched helplessly (not touching his computer) as someone else moved the cursor about the screen, turning off breakers and causing a regional blackout.

---

The hackers hadn’t sent their blackout commands from automated malware, or even a cloned machine as they’d done at Kyivoblenergo. Instead, the intruders had exploited the company’s IT helpdesk tool to take direct control of the mouse movements of the stations’ operators. They’d locked the operators out of their own user interface. And before their eyes, phantom hands had clicked through dozens of breakers—each serving power to a different swath of the region—and one by one by one, turned them cold.

---

It doesn't take a careful eye to notice the computer involved appears to be running Windows XP.