Modern cyber-physical power systems are vulnerable to cyber attacks. Given that cyber and physical networks are coupled tightly, attacks in the cyber layer can penetrate the physical layer, causing the outage of transmission lines and other physical equipment, thus changing the topology of the grid. In some extreme scenarios, the topological change will disrupt the emergency response of the grid, eventually causing cascading outages along with a blackout. Therefore, as the defender, the operator of a cyber-physical power system should identify critical cyber attacks. In this paper, patterns of sequential cyber topological attacks are analyzed. Firstly, a coordinated attack process is established, including mechanism and probability analysis considering the different timescales. Secondly, the concept of patterns is defined as minimal attack sequences aimed at causing blackouts. Furthermore, the representativeness of patterns is illustrated, which can significantly reduce the storage of risky attack sequences. Thirdly, to address the problem that the identification of patterns is computationally intensive, a search strategy that selects the next attack target dynamically and increases the search depth gradually is proposed to avoid unnecessary search trials. Lastly, tests are carried out on the IEEE 39-node system using the AC power flow model, which validates the representativeness of patterns and the performance of the proposed search strategy.