MITRE ATT&CKsoftware (malware)

S1165 FrostyGoop

Published 2024-11-20 Modified 2024-11-20 Official page ↗
Domain
ics
Platforms
Control Server, Field Controller/RTU/PLC/IED
Aliases
BUSTLEBERM
Version
1.0
Created
2024-11-20

Description

FrostyGoop is a Windows-based binary written in Golang that allows for interaction with industrial control system (ICS) equipment via Modbus TCP over port 502. FrostyGoop allows for reading and writing data to holding registers on targeted devices, manipulating the operation of systems for malicious purposes. FrostyGoop is associated with the FrostyGoop Incident in Ukraine.

Related

Uses · MITRE ATT&CK (5)

  • T1701 Command and Scripting Interpreter technique
  • T0801 Monitor Process State technique
  • T0836 Modify Parameter technique
  • T0869 Standard Application Layer Protocol technique
  • T0885 Commonly Used Port technique

Referenced by MITRE ATT&CK · uses (1)

  • C0041 FrostyGoop Incident campaign

References