In 2016 A power lockout in Ukraine’s capital Kiev last was caused by a cyber attack and this malware can do the same. Security specialists say it is highly feasible that Industroyer was utilized in the December 2016 attack on the Ukrainian power system.
This Dangerous malware, recognized by ESET security specialists and Dragons Inc named as Win32/Industroyer, this malware can do enormous damage to electric power systems and furthermore capable of targeting other Critical infrastructures.
Industroyer is proficient for controlling power substation switches and circuit breakers specifically. By having control over the switches they can dispatch scope of attacks beginning from turning of energy circulation to serious damages.
Industroyer not using any vulnerabilities or exploiting Zero days to do these malicious activities. It lies in the way that it utilizes protocols in the way they were intended to be used.
Also read Ukrainian Artillery Tracked Using Android Malware implant By Russian Hackers
The issue is that these protocols were designed decades back and their correspondence protocols were not designed security as a primary concern.
What’s special with Industroyer apart from other infrastructure Malware’s
It consists of a backdoor utilized by attackers to speak with command and control servers and to manage the attack.
Security experts say “Industroyer installs four payloads to get direct control of switches and circuit breakers. Each of these components targets particular communication protocols specified in the following standards: IEC 60870-5-101, IEC 60870-5-104, IEC 61850, and OLE for Process Control Data Access (OPC DA)”.
These payloads objective is to map the network and then to attack specific industrial control devices. This shows the in-depth knowledge of the payload developer.
You can refer to the Whitepaper published by ESET for Technical Analysis.
This malware suspects to have some advanced features and experts suspect what happened is a trial run before a major attack.
The most attractive feature of this backdoor is that attackers can define a particular hour of the day when the backdoor will be active.
All the C&C servers utilized by this backdoor are running Tor Software to guarantee their Anonymity.This makes network analysis more complex.
Shodan founder John Matherly says More than 100,000 industrial control systems are connected to the Internet at the moment.
More than 100,000 industrial control systems are connected to the Internet at the moment – most of them in the US: https://t.co/V1UBZDGTeq
— John Matherly (@achillean) June 9, 2017
