PowerHammer treats the protected computer's power feed as the communications medium. Malware varies CPU utilization in a deliberate pattern, causing corresponding changes in the machine's electrical current draw. Those fluctuations are conducted onto the connected power wiring, where a measurement device can observe and decode them. The channel exists…
Inspect the ClaimsCase · DiggingBeagle record
PowerHammer carried covert data through electrical power lines
PowerHammer research controlled CPU utilization to modulate system power consumption, creating conducted emissions that could be measured from electrical wiring and decoded as data.
Scope
Laboratory attack model requiring compromised code and attacker access to electrical wiring or a relevant measurement point.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
Basis and provenance
The CPU-current modulation and line/phase tap results describe a laboratory channel that presupposes both host compromise and receiver access. Assessment is a desk review of the retained canonical Claims and cited Source metadata at their recorded cutoff, not a new external verification. Impact remains ungraded.
Assessed Sep 24, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-POWERHAMMER-RATES · CLM-POWERHAMMER-MECHANISM · PowerHammer: Exfiltrating Data from Air-Gapped Computers through Power Lines
At a glance
PowerHammer shows that an air gap leaves conductive infrastructure intact. Its operational risk is bounded by the attacker's ability to measure the relevant electrical path and by signal quality in the facility. For high-assurance design, power feeds and panels are therefore part of the containment boundary rather than neutral utilities outside it.
Read the implicationsThe paper's reported rates come from specific line-level and phase-level measurement setups and should not be generalized to arbitrary buildings. Electrical noise, power-supply design, wiring topology and measurement placement materially affect the channel. The channel assumes prior host compromise and a prepared receiver on the power infrastructure.
Limits and uncertaintyFull account
PowerHammer treats the protected computer's power feed as the communications medium. Malware varies CPU utilization in a deliberate pattern, causing corresponding changes in the machine's electrical current draw. Those fluctuations are conducted onto the connected power wiring, where a measurement device can observe and decode them.
The channel exists because electrical isolation is different from network isolation. Every powered computer is physically connected to a conductive infrastructure, and software-controlled workloads change how much current the system consumes. In the researchers' tested setup, a line-level tap closer to the machine reached about 1,000 bit/s, while phase-level measurement at the electrical panel reached about 10 bit/s.
The receiver requirement is substantial: the attacker needs access to a suitable electrical measurement point. PowerHammer therefore does not create remote exfiltration by itself; it demonstrates that the power distribution system can become an unintended outbound conductor when both workload control and measurement access exist.
Mechanism and trust boundary
- 01
Execute code on the isolated computer
The transmitter is malware already running on the protected system.
Boundary: air-gapped host / attacker-controlled code
- 02
Encode data in CPU utilization
The malware raises and lowers processor load according to the bitstream.
Boundary: secret data / compute workload
- 03
Convert workload into current fluctuations
Changes in processor demand alter system power consumption and therefore current on the supply line.
Boundary: software activity / electrical current
- 04
Conduct the signal through power wiring
The data-dependent current pattern propagates along the connected electrical infrastructure.
Boundary: computer power input / building wiring
- 05
Measure and decode at a tap point
A prepared line-level or phase-level sensor records the fluctuations and reconstructs the transmitted data.
Boundary: power infrastructure / attacker receiver
Timeline
- Apr 10, 2018Event type unspecified
PowerHammer preprint released
The paper described line-level and phase-level power-line exfiltration and reported their tested bit rates.
Claims & evidence
CLM-POWERHAMMER-RATESThe paper reports about 1000 bit/s for a line-level tap and about 10 bit/s for a phase-level measurement in the tested configurations.supported
Basis: reported finding
- supportsPowerHammer: Exfiltrating Data from Air-Gapped Computers through Power Linesrole not specified
Abstract, reported bit rates
CLM-POWERHAMMER-MECHANISMPowerHammer demonstrated exfiltration by modulating CPU utilization so that data appeared as controlled fluctuations in current on connected power lines.supported
Basis: reported finding
- supportsPowerHammer: Exfiltrating Data from Air-Gapped Computers through Power Linesrole not specified
Abstract
Implications
PowerHammer shows that an air gap leaves conductive infrastructure intact. Its operational risk is bounded by the attacker's ability to measure the relevant electrical path and by signal quality in the facility. For high-assurance design, power feeds and panels are therefore part of the containment boundary rather than neutral utilities outside it.
Controls and mitigations
- Restrict physical access to line-level wiring, distribution panels and other useful current-measurement points.
- Use power filtering or isolation appropriate to the protected environment and verify effectiveness against the frequencies of concern.
- Monitor abnormal current signatures or patterned CPU-load behavior only where normal workload variability permits meaningful detection.
Unknowns and contradictions
- The paper's reported rates come from specific line-level and phase-level measurement setups and should not be generalized to arbitrary buildings.
- Electrical noise, power-supply design, wiring topology and measurement placement materially affect the channel.
- The channel assumes prior host compromise and a prepared receiver on the power infrastructure.
Sources and citation
Material revision history
- Sep 19, 2026 · Published version · first publication · revision 15
- Sep 19, 2026 · Published version · material revision · revision 20Public fields changed: attack_path, implications, mitigations, narrative, timeline, unknowns
- Sep 25, 2026 · Published version · material revision · revision 36Public fields changed: assessment_profile