MITRE ATT&CKcampaign
C0041 FrostyGoop Incident
- Domain
- enterprise, ics
- Version
- 1.0
- Created
- 2024-11-20
Description
FrostyGoop Incident took place in January 2024 against a municipal district heating company in Ukraine. Following initial access via likely exploitation of external facing services, FrostyGoop was used to manipulate ENCO control systems via legitimate Modbus commands to impact the delivery of heating services to Ukrainian civilians.
Related
Uses · MITRE ATT&CK (10)
- T1693.001 System Firmware sub-technique
- T1689 Downgrade Attack technique
- S1165 FrostyGoop software (malware)
- T0826 Loss of Availability technique
- T0829 Loss of View technique
- T0836 Modify Parameter technique
- T1003.002 Security Account Manager sub-technique
- T1505.003 Web Shell sub-technique
- T1190 Exploit Public-Facing Application technique
- T1071 Application Layer Protocol technique
References
- https://hub.dragos.com/hubfs/Reports/Dragos-FrostyGoop-ICS-Malware-Intel-Brief-0724_r2.pdf Dragos FROSTYGOOP 2024
- https://www.nozominetworks.com/blog/protecting-against-frostygoop-bustleberm-malware Nozomi BUSTLEBERM 2024