Categories: Malware

Dangerous Malware detected that is capable of Controlling Electric Power Systems

In 2016 A power lockout in Ukraine’s capital Kiev last was caused by a cyber attack and this malware can do the same. Security specialists say it is highly feasible that Industroyer was utilized in the December 2016 attack on the Ukrainian power system.

This Dangerous malware, recognized by ESET security specialists and Dragons Inc named as Win32/Industroyer, this malware can do enormous damage to electric power systems and furthermore capable of targeting other Critical infrastructures.

Industroyer is proficient for controlling power substation switches and circuit breakers specifically. By having control over the switches they can dispatch scope of attacks beginning from turning of energy circulation to serious damages.

Credits: ESET

Industroyer not using any vulnerabilities or exploiting Zero days to do these malicious activities. It lies in the way that it utilizes protocols in the way they were intended to be used.

Also read Ukrainian Artillery Tracked Using Android Malware implant By Russian Hackers

The issue is that these protocols were designed decades back and their correspondence protocols were not designed security as a primary concern.

What’s special with Industroyer apart from other infrastructure Malware’s

It consists of a backdoor utilized by attackers to speak with command and control servers and to manage the attack.

Security experts say “Industroyer installs four payloads to get direct control of switches and circuit breakers. Each of these components targets particular communication protocols specified in the following standards: IEC 60870-5-101, IEC 60870-5-104, IEC 61850, and OLE for Process Control Data Access (OPC DA)”.

                                                      Module overview  Credits: ESET

These payloads objective is to map the network and then to attack specific industrial control devices. This shows the in-depth knowledge of the payload developer.

You can refer to the Whitepaper published by ESET for Technical Analysis.

This malware suspects to have some advanced features and experts suspect what happened is a trial run before a major attack.

The most attractive feature of this backdoor is that attackers can define a particular hour of the day when the backdoor will be active.

All the C&C servers utilized by this backdoor are running Tor Software to guarantee their Anonymity.This makes network analysis more complex.

Shodan founder John Matherly‏ says More than 100,000 industrial control systems are connected to the Internet at the moment.

Also Read Your Heart Beat As a Password -Smart or Stupid?

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Hack The box “Ghost” Challenge Cracked – A Detailed Technical Exploit

Cybersecurity researcher "0xdf" has cracked the "Ghost" challenge on Hack The Box (HTB), a premier…

13 hours ago

Sec-Gemini v1 – Google’s New AI Model for Cybersecurity Threat Intelligence

Google has unveiled Sec-Gemini v1, an AI model designed to redefine cybersecurity operations by empowering…

13 hours ago

U.S. Secures Extradition of Rydox Cybercrime Marketplace Admins from Kosovo in Major International Operation

The United States has successfully extradited two Kosovo nationals, Ardit Kutleshi, 26, and Jetmir Kutleshi,…

19 hours ago

Ivanti Fully Patched Connect Secure RCE Vulnerability That Actively Exploited in the Wild

Ivanti has issued an urgent security advisory for CVE-2025-22457, a critical vulnerability impacting Ivanti Connect…

2 days ago

Beware! Weaponized Job Recruitment Emails Spreading BeaverTail and Tropidoor Malware

A concerning malware campaign was disclosed by the AhnLab Security Intelligence Center (ASEC), revealing how…

2 days ago

EncryptHub Ransomware Uncovered Through ChatGPT Use and OPSEC Failures

EncryptHub, a rapidly evolving cybercriminal entity, has come under intense scrutiny following revelations of operational…

2 days ago