IndustroyerMalware
- crashoverride
- win32/industroyer
Industroyer is a malware framework considered to have been used in the cyberattack on Ukraine’s power grid on December 17, 2016. The attack cut a fifth of Kiev, the capital, off power for one hour. It is the first ever known malware specifically designed to attack electrical grids.From MISP Galaxy
Last reported 2 days ago, by ESET WeLiveSecurity (ES)5 reports
ATT&CK techniques
6 of 32 · each with the sentence it comes from- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter: Windows Command Shell”
- T1059.003Windows Command Shell
“T1059.003”
- T1105Ingress Tool Transfer
“T1105”
- T1485Data Destruction
“T1485”
- T1005Data from Local System
“T1005”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Encrypted/Encoded File”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
MythicRatatoskr: el backdoor que utilizó la red Yggdrasil antes de un ataque destructivo de Sandworm“El grupo Sandworm utiliza malware avanzado como Industroyer, capaz de comunicarse con equipos de empresas energéticas mediante protocolos de control industrial.”
-
MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration“The Sandworm group uses such advanced malware as Industroyer, which is able to communicate with equipment at energy companies via industrial control protocols.”
-
Proteger sistemas industriales desactualizados frente a las ciberamenazas modernas“…que provocó un corte de energía de entre 4 y 6 horas para 230.000 personas en Ucrania en 2015; su sucesor GreyEnergy, e Industroyer, un malware altamente personalizable que utiliza varios protocolos de comunicación industrial empleados en sistemas de infraest…”
-
Protecting legacy OT systems against modern cyberthreats“… – including BlackEnergy that triggered a 4–6 hour power outage for 230,000 people in Ukraine in 2015, its successor, GreyEnergy, and Industroyer, the highly customizable malware that speaks several industrial communication protocols used in critical infrastructure systems worldw…”
-
DynoWiper update: Technical analysis and attribution“The Sandworm group uses such advanced malware as Industroyer, which is able to communicate with equipment at energy companies via industrial control protocols.”
Indicators in its reports
named in the reports above- hxxps://uztickets[.]comin 2 reports
- uztickets[.]comin 2 reports
- hxxps://egyptanimals[.]com/animals/photoalbumin 2 reports
- egyptanimals[.]comin 2 reports
- adomd[.]netin 2 reports
- hxxp://51.15.204[.]214/in 2 reports
- 51.15.204[.]214in 2 reports
- d5f9288daebf87ae…cf235b093cfdin 2 reports
- b69ef0e45b401440…5d0c57e87415in 2 reports
- 4e3e6577866e4ce2…ae04230e768fin 2 reports
- 69969eeb7e0a3d84…cf934c6aa388in 2 reports
- 01855153ca7a33ad…12dfba0dd2cain 2 reports
- e29af83a07fb32eb…2e766d53f704in 2 reports
- 028ca11f3f0d8396…31fc2f50f829in 2 reports
- 9085896989947c09…f6b233fc645bin 2 reports
- d7e6a5a46c6ed351…1be0250fd2a2in 2 reports
- 131a371a1e4ee78e…9290ec3b58a6in 2 reports
- 09c816697c0c2aff…8ca30d04c9cdin 2 reports
- 8ceb5f8bcdf4995b…d682613bb17bin 2 reports
- 37.205.14[.]171in 2 reports
Copy these 20 indicators · defanged
Thanks — we review every report.