Industroyer

Industroyer, also known as CrashOverride, is a potent malware specifically designed to target Industrial Control Systems (ICS) used in electrical substations. It first gained notoriety for its role in the 2016 cyberattack on Ukraine's power grid, which resulted in a six-hour blackout in Kyiv. The malware, attributed to the Russia-backed Sandworm group, was later leveraged in 2018 against Ukrainian government agencies and in a highly destructive attack prior to Russia's invasion of Ukraine in 2022. This version of Industroyer was customized to target high-voltage electrical substations, though it remains unclear how initial access was achieved. ESET's analysis of a backdoor utilized by TeleBots, the group responsible for the widespread NotPetya ransomware outbreak, revealed strong code similarities with the main Industroyer backdoor. This provided the first public evidence linking Industroyer to TeleBots, and consequently to NotPetya and BlackEnergy. The primary difference between the Industroyer toolset's backdoor and the new TeleBots backdoor is that the latter uses XML format for communication and configuration, rather than a custom binary format. In conjunction with the deployment of Industroyer 2 within the ICS network during the 2022 attacks, an updated variant of CaddyWiper malware was introduced. Both Industroyer 2 and CaddyWiper have been used by Russia-backed state groups in destructive attacks on organizations in Ukraine. Additionally, Industroyer shares similarities with CosmicEnergy, another operational technology malware that targets ICS and primarily focuses on disrupting electrical grids by interacting with the IEC-104 protocol.