Since the Ukraine blackout in 2015, coordinated cyber-physical attacks (CCPAs) have been emerging and are used to mask line outages in the smart grid. In this paper, we investigate the features of CCPAs and constitute the mathematic formulation with respect to topologies and electric parameters of a power grid before and after attacks. With the objective of maximizing the number of overloaded lines, a bilevel programming model is developed to describe the interaction between the adversary and the control center. The most damaging CCPA can be determined by transforming the developed bilevel model to a single mixed-integer linear programming problem using the Karush-Kuhn-Tucker conditions. Based on the features of the bilevel model, the countermeasure is expressed as a trilevel model with one leader and multiple followers. The implicit enumeration-based searching strategy is proposed to solve the trilevel model to identify the protected meters. Both the implementation of CCPAs and the effectiveness of the developed countermeasure are verified on the modified IEEE 14-bus system. INDEX TERMS Bilevel programming, coordinated cyber physical attacks (CCPAs), trilevel programming, smart grid. NOMENCLATURE Sets and Indices: O/d Bus set / bus index. G/g Generation set / generation index. L/l Transmission line set / transmission line index.