"Are You a CEO Interested in a Feature Interview?"
All Interviews are 100% FREE of Charge
Cybersecurity firm Dragos has pointed to the existence of malware that attacks industrial control systems (ICS) and causes them to perform malicious actions, such as turning off heating and hot water in the middle of winter. TechCrunch Reports This January, malware called FrostyGoop caused exactly that in Lviv, Ukraine, leaving residents of more than 600 apartment blocks without heat for two days in sub-freezing temperatures.
Dragos To tell FrostyGoop is the ninth known malware designed to target industrial controllers, and the first to take specific aim at Modbus, a widely used communications protocol invented in 1979 that is frequently used in industrial environments like Ukraine, which FrostyGoop attacked in January.
Ukrainian Cybersecurity Situation Center The Cyber ​​Security and Safety Commission (CSSC), the country’s government agency in charge of digital safety, discovered the malware several months after the attack in April this year and shared information about the attack with Dragos. The malicious code, written in Golang (the Go programming language designed by Google), communicates directly with industrial control systems through an open Internet port (502).
The attackers appear to have gained access to Lviv’s industrial network in April 2023. They did so by “exploiting an unconfirmed vulnerability in an external-facing Mikrotik router,” Dragos said. They then installed a remote access tool that eliminated the need to install malware locally, allowing them to avoid detection.
The attackers downgraded the controller’s firmware to a version that lacked monitoring capabilities to cover their tracks: instead of taking down the entire system, the hackers made the controller report inaccurate readings, causing heat to be lost in the middle of the frigid temperatures.
Dragos has long maintained a neutral stance on cyberattacks, focusing on education without assigning blame, but he noted that the attackers had opened a secure connection (using Layer 2 Tunneling Protocol) to a Moscow-based IP address.
“I think this was very much a psychological effort, perhaps facilitated by cyber means at a time when physical means were not the best choice,” said Mark “Magpie” Graham, a researcher at Dragos. TechCrunchLviv is located in western Ukraine and will be much more difficult for Russia to attack than eastern cities.
Dragos warns that FrostyGoop could be used to disrupt similar systems around the world, given the widespread use of the Modbus protocol in industrial environments. The security firm recommends continuous monitoring, noting that FrostyGoop evaded virus detection and highlighting the need for network monitoring to warn of future threats before they strike. Specifically, Dragos advises ICS operators to use the SANS 5 Critical Controls for World-Class OT Cybersecurity, a security framework for their operational environments.