The Demon Industroyer, Who Switched Off Kyiv

Legend

Built on purpose to attack electrical substations, it spoke industrial protocols such as IEC 101, IEC 104, IEC 61850 and OPC DA directly. In December 2016 it caused a blackout in part of Kyiv. A variant, Industroyer2, was used in 2022 and stopped before it did damage.

Exorcism

Cast it out by separating control networks, watching for anomalous commands in industrial protocols and keeping manual procedures ready. In substations, being able to operate by hand is the best defence.

Technical record

Also known as: CrashOverride, Win32/Industroyer, Industroyer2
Circle: Circle V · State espionage · Circle IV · Destroyers (wipers)
First seen: 2016
Status: Dormant
Works: The Scourge of Industroyer

Malware purpose-built to attack electrical substations by speaking industrial protocols such as IEC 101, IEC 104, IEC 61850 and OPC DA directly. It caused a power outage in part of Kyiv in December 2016. A variant, Industroyer2, was used in a foiled attack on a Ukrainian energy company in April 2022; both are attributed to Sandworm.

Sources: attack.mitre.org · attack.mitre.org · attack.mitre.org · MITRE ATT&CK reference S0604