INDUSTROYER2Malware
Industroyer2 is a compiled and static piece of malware that has the ability to communicate over the IEC-104 protocol. It is similar to the IEC-104 module found in Industroyer. Security researchers assess that Industroyer2 was designed to cause impact to high-voltage electrical substations.From MITRE ATT&CK
Last reported 2 days ago, by ESET WeLiveSecurity (ES)5 reports
ATT&CK techniques
6 of 32 · each with the sentence it comes from- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter: Windows Command Shell”
- T1059.003Windows Command Shell
“T1059.003”
- T1105Ingress Tool Transfer
“T1105”
- T1485Data Destruction
“T1485”
- T1005Data from Local System
“T1005”
- T1027Obfuscated Files or Information
“Obfuscated Files or Information: Encrypted/Encoded File”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
5 reports, newest first · the exact sentence from each-
MythicRatatoskr: el backdoor que utilizó la red Yggdrasil antes de un ataque destructivo de Sandworm“…a una empresa energética en Ucrania en el que Sandworm intentó desplegar una nueva variante de este malware, denominada Industroyer2.”
-
MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration“…RT‑UA thwarted an attack against an energy company in Ukraine where the Sandworm group tried to deploy a new variant of this malware, Industroyer2.”
-
Proteger sistemas industriales desactualizados frente a las ciberamenazas modernas“En 2022, investigadores de ESET identificaron Industroyer2, que volvió a apuntar a la infraestructura energética de Ucrania.”
-
Protecting legacy OT systems against modern cyberthreats“In 2022, ESET researchers also identified Industroyer2, which took aim at Ukraine’s energy infrastructure again.”
-
DynoWiper update: Technical analysis and attribution“…RT-UA thwarted an attack against an energy company in Ukraine where the Sandworm group tried to deploy a new variant of this malware, Industroyer2.”
Indicators in its reports
named in the reports above- hxxps://uztickets[.]comin 2 reports
- uztickets[.]comin 2 reports
- hxxps://egyptanimals[.]com/animals/photoalbumin 2 reports
- egyptanimals[.]comin 2 reports
- adomd[.]netin 2 reports
- hxxp://51.15.204[.]214/in 2 reports
- 51.15.204[.]214in 2 reports
- d5f9288daebf87ae…cf235b093cfdin 2 reports
- b69ef0e45b401440…5d0c57e87415in 2 reports
- 4e3e6577866e4ce2…ae04230e768fin 2 reports
- 69969eeb7e0a3d84…cf934c6aa388in 2 reports
- 01855153ca7a33ad…12dfba0dd2cain 2 reports
- e29af83a07fb32eb…2e766d53f704in 2 reports
- 028ca11f3f0d8396…31fc2f50f829in 2 reports
- 9085896989947c09…f6b233fc645bin 2 reports
- d7e6a5a46c6ed351…1be0250fd2a2in 2 reports
- 131a371a1e4ee78e…9290ec3b58a6in 2 reports
- 09c816697c0c2aff…8ca30d04c9cdin 2 reports
- 8ceb5f8bcdf4995b…d682613bb17bin 2 reports
- 37.205.14[.]171in 2 reports
Copy these 20 indicators · defanged
Thanks — we review every report.