MITRE ATT&CKsoftware (malware)

S0604 Industroyer

Published 2021-01-04 Modified 2026-05-12 Official page ↗
Domain
enterprise, ics
Platforms
Windows
Aliases
CRASHOVERRIDE, Win32/Industroyer
Version
1.2
Created
2021-01-04

Description

Industroyer is a sophisticated malware framework designed to cause an impact to the working processes of Industrial Control Systems (ICS), specifically components used in electrical substations. Industroyer was used in the attacks on the Ukrainian power grid in December 2016. This is the first publicly known malware specifically designed to target and impact operations in the electric grid.

Related

Uses · MITRE ATT&CK (44)

  • T1701.002 Windows Command Shell sub-technique
  • T0846.001 Port Scan sub-technique
  • T1691.001 Command Message sub-technique
  • T1691.002 Reporting Message sub-technique
  • T1692.001 Command Message sub-technique
  • T1695.001 Serial COM sub-technique
  • T0888 Remote System Information Discovery technique
  • T0837 Loss of Protection technique
  • T0800 Activate Firmware Update Mode technique
  • T0801 Monitor Process State technique
  • T0802 Automated Collection technique
  • T0806 Brute Force I/O technique
  • T0809 Data Destruction technique
  • T0813 Denial of Control technique
  • T0814 Denial of Service technique
  • T0815 Denial of View technique
  • T0816 Device Restart/Shutdown technique
  • T0827 Loss of Control technique
  • T0829 Loss of View technique
  • T0831 Manipulation of Control technique
  • T0832 Manipulation of View technique
  • T0840 Network Connection Enumeration technique
  • T0846 Remote System Discovery technique
  • T0881 Service Stop technique
  • T0884 Connection Proxy technique
  • T1071.001 Web Protocols sub-technique
  • T1572 Protocol Tunneling technique
  • T1090.003 Multi-hop Proxy sub-technique
  • T1499.004 Application or System Exploitation sub-technique
  • T1554 Compromise Host Software Binary technique
Show all 44 ›

Referenced by MITRE ATT&CK · uses (2)

  • C0025 2016 Ukraine Electric Power Attack campaign
  • G0034 Sandworm Team group

References