Industroyer
Also known as: CrashOverride, Industroyer2
Industroyer, also called CrashOverride, was used in the December 2016 attack that cut power in part of Kyiv. It was the first known malware designed to talk directly to electric grid equipment using the industry's own protocols to open circuit breakers. A newer variant, Industroyer2, was found in an attempted attack on a Ukrainian energy company in April 2022.
- Public attribution and associated actors
- In 2020 the US Department of Justice charged GRU officers over attacks that included the December 2016 attack on Ukraine's power grid. ESET and CERT-UA attributed the 2022 Industroyer2 attack to Sandworm.As publicly reported:Sandworm Team
- First seen
- 2016
- Platforms
- Windows, Electric grid protocols (IEC 101, IEC 104, IEC 61850, OPC DA)
- MITRE ATT&CK software entries
- S0604 IndustroyerS1072 Industroyer2
How it spreads or gets in
- Deployed by operators already inside the victim's network, not self-spreading.
Key behaviours
- Mapped grid devices and sent protocol commands to switch breakers.
- Included a wiper component to slow recovery.
- Included a component designed to make protective relays unresponsive.
ATT&CK techniques
- T0846Remote System Discovery
- T0888Remote System Information Discovery
- T0813Denial of Control
- T0815Denial of View
- T0816Device Restart/Shutdown
- T0881Service Stop
- T1485Data Destruction
- T1543.003Create or Modify System Process: Windows Service
Selected from the family's MITRE ATT&CK software entry.
Detection ideas
- Monitor OT networks for protocol commands from hosts that never normally send them.
- Alert on new hosts appearing on substation networks.
- Use OT-aware network monitoring that understands IEC 104 and IEC 61850.
Defences that work
- Segment OT networks and restrict which hosts may send control commands.
- Maintain manual operation capability and practise it.
- Keep offline backups of engineering configurations and HMI systems.
- Patch or isolate protective relays with known vulnerabilities.