Categories: Malware

Dangerous Malware detected that is capable of Controlling Electric Power Systems

In 2016 A power lockout in Ukraine’s capital Kiev last was caused by a cyber attack and this malware can do the same. Security specialists say it is highly feasible that Industroyer was utilized in the December 2016 attack on the Ukrainian power system.

This Dangerous malware, recognized by ESET security specialists and Dragons Inc named as Win32/Industroyer, this malware can do enormous damage to electric power systems and furthermore capable of targeting other Critical infrastructures.

Industroyer is proficient for controlling power substation switches and circuit breakers specifically. By having control over the switches they can dispatch scope of attacks beginning from turning of energy circulation to serious damages.

Dangerous Malware Industroyer capable of Controlling Electric Power SystemsDangerous Malware Industroyer capable of Controlling Electric Power Systems
Credits: ESET

Industroyer not using any vulnerabilities or exploiting Zero days to do these malicious activities. It lies in the way that it utilizes protocols in the way they were intended to be used.

Also read Ukrainian Artillery Tracked Using Android Malware implant By Russian Hackers

The issue is that these protocols were designed decades back and their correspondence protocols were not designed security as a primary concern.

What’s special with Industroyer apart from other infrastructure Malware’s

It consists of a backdoor utilized by attackers to speak with command and control servers and to manage the attack.

Security experts say “Industroyer installs four payloads to get direct control of switches and circuit breakers. Each of these components targets particular communication protocols specified in the following standards: IEC 60870-5-101, IEC 60870-5-104, IEC 61850, and OLE for Process Control Data Access (OPC DA)”.

                                                      Module overview  Credits: ESET

These payloads objective is to map the network and then to attack specific industrial control devices. This shows the in-depth knowledge of the payload developer.

You can refer to the Whitepaper published by ESET for Technical Analysis.

This malware suspects to have some advanced features and experts suspect what happened is a trial run before a major attack.

The most attractive feature of this backdoor is that attackers can define a particular hour of the day when the backdoor will be active.

All the C&C servers utilized by this backdoor are running Tor Software to guarantee their Anonymity.This makes network analysis more complex.

Shodan founder John Matherly‏ says More than 100,000 industrial control systems are connected to the Internet at the moment.

Also Read Your Heart Beat As a Password -Smart or Stupid?

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Beware! Weaponized Job Recruitment Emails Spreading BeaverTail and Tropidoor Malware

A concerning malware campaign was disclosed by the AhnLab Security Intelligence Center (ASEC), revealing how…

1 hour ago

EncryptHub Ransomware Uncovered Through ChatGPT Use and OPSEC Failures

EncryptHub, a rapidly evolving cybercriminal entity, has come under intense scrutiny following revelations of operational…

1 hour ago

PoisonSeed Targets CRM and Bulk Email Providers in New Supply Chain Phishing Attack

A sophisticated phishing campaign, dubbed "PoisonSeed," has been identified targeting customer relationship management (CRM) and…

1 hour ago

Beware! Fake Unpaid Tolls Messages Used in Phishing Attack to Steal Login Credentials

A surge in phishing text messages claiming unpaid tolls has been linked to a massive…

1 hour ago

State Bar of Texas Confirms Data Breach, Begins Notifying Affected Consumers

The State Bar of Texas has confirmed a data breach following the detection of unauthorized…

2 hours ago

Hackers Use URL Shorteners and QR Codes in Tax-Themed Phishing Attacks

As the United States approaches Tax Day on April 15, cybersecurity experts have uncovered a…

2 hours ago