Since dispersed renewable energy sources are increasingly being integrated into the grid, developing a cyber security plan for active distribution systems has become more difficult. This article describes an approach to using electrical waveform analysis to identify and localise cyberattacks in distributed active distribution systems. The cornerstone for cyber attack detection is a sequential deep learning model, which allows the identification of even the slightest intrusions. The targeted cyberattack is initially localised inside the estimated cyberattack sub-region in a two-stage process. We present a network splitting approach based on a modified form of spectral clustering for "coarse" localisation of hierarchical cyber-attacks. To further localise the origin of a cyber assault, it is advised to define a number of waveform parameters and apply a normalised effect score based on statistical metrics of the waves themselves. Finally, a thorough quantitative assessment based on two case studies demonstrates that the proposed framework yields accurate estimations in contrast to both classic and state-of-the-art methods.