Industroyer

Malware & Tools · Industroyer

· MalwareS0604 · Zararlı Yazılım

Type

malware

Techniques

Used By

1 groups

Platforms

Windows

Description

Industroyer is a sophisticated malware framework designed to cause an impact to the working processes of Industrial Control Systems (ICS), specifically components used in electrical substations.(Citation: ESET Industroyer) Industroyer was used in the attacks on the Ukrainian power grid in December 2016.(Citation: Dragos Crashoverride 2017) This is the first publicly known malware specifically designed to target and impact operations in the electric grid.(Citation: Dragos Crashoverride 2018)

Tactic Coverage

discovery (6)command and control (4)stealth (3)persistence (3)impact (3)privilege escalation (2)exfiltration (1)initial access (1)

Used By (1 groups)

G0034Sandworm TeamELECTRUM, Telebots

Techniques (19)

T1012Query Registry

discovery

T1016System Network Configuration Discovery

discovery

T1018Remote System Discovery

discovery

T1027Obfuscated Files or Information

stealth

T1041Exfiltration Over C2 Channel

exfiltration

T1046Network Service Discovery

discovery

T1071.001Web Protocols

References

https://attack.mitre.org/software/S0604 https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf https://dragos.com/blog/crashoverride/CrashOverride-01.pdf https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf