russian_nation_state_cyber_actors

Russian nation-state cyber actors were attributed by the U.S. Government in a July 20, 2021 update to activity involving deployment of CrashOverRide malware, also referred to in public reporting as Industroyer, in a cyberattack against Ukrainian critical infrastructure. The reported operation targeted industrial control system environments in the electric power sector in Ukraine. CrashOverRide was described as a scalable, extensible second-stage ICS attack platform that can operate independently of initial command-and-control. Reported capabilities include modules for IEC101, IEC104, and IEC61850; issuing valid commands directly to remote terminal units; rapid breaker open-close toggling; denial of service against local serial COM ports on Windows devices; scanning and mapping ICS environments including via OPC; potential exploitation of a Siemens relay denial-of-service condition requiring manual reset; and a wiper component that can render Windows systems unusable. The malware fundamentally abuses legitimate control system functionality, and the associated tactics, techniques, and procedures were assessed as adaptable to other critical infrastructure environments. No additional aliases or sub-groups were provided in the content.