Industroyer2

Industroyer2 is a sophisticated piece of malware designed to target Industrial Control Systems (ICS), developed and deployed by the Russian state-sponsored advanced persistent threat group, Sandworm. The group has been active since 2007 and used Industroyer2 in a significant attack against Ukraine's electrical substation. This malware is highly configurable and hard-coded, storing its configuration separately and allowing for a range of parameters to be adjusted to suit the network being targeted. It was deployed as a single executable "108_100.exe" file via a scheduled task, demonstrating an advanced level of cyber warfare. In addition to Industroyer2, Sandworm also utilized other types of malware including CaddyWiper, AWFULSHRED, SOLOSHRED, and ORCSHRED. CaddyWiper and Industroyer2 were specifically used for targeting ICS networks, while ORCSHRED, SOLOSHRED, and AWFULSHRED were deployed against Linux and Solaris networks. These attacks are attributed to Sandworm due to the nearly identical deployment of RansomBoggs’ PowerShell script with that of Industroyer2. The severity of these threats led to international concern, with the UK government specifically naming Sandworm’s 'Industroyer2' malware as a strain of concern in November 2022. In response, they pledged to provide Ukraine with £6.35 million for cyber defense, which has since been increased to up to £25 million. Industroyer2 is the seventh known ICS-specific malware, following STUXNET, HAVEX, BLACKENERGY2, CRASHOVERRIDE, TRISIS, and Industroyer. Its recent discovery, along with other strains such as Incontroller and CosmicEnergy, indicates the evolving nature of state-sponsored cyber threats.