Loading malware…
Industroyer, also known as CrashOverride, is a modular ICS malware framework designed to disrupt electric power operations by interacting directly with industrial control protocols used in substations and grid environments. It is most closely associated with Sandworm, a Russian GRU-linked threat actor, and is known for its role in attacks against Ukraine’s power infrastructure, including the 2016 outage and a later 2022 variant often referred to as Industroyer2.
The malware is notable for native support for multiple industrial protocols, including IEC 60870-5-101, IEC 60870-5-104, IEC 61850, and OPC DA, allowing it to send legitimate-looking control commands to substation equipment. In operational use, it has been used to open breakers and disrupt power distribution by abusing normal protocol functionality rather than exploiting authentication bypasses in the target devices themselves. Industroyer also included a denial-of-service capability targeting protective relay equipment and a destructive component described as a data wiper.
On Windows systems, Industroyer has used a backdoor component that communicated with command-and-control infrastructure over HTTPS. It has also used Windows service abuse for persistence, including configuring execution at system boot by modifying service settings. Reported behavior includes enumeration of Windows service-related Registry data by its wiper component.
Industroyer is regarded as one of the clearest examples of malware purpose-built for OT disruption and cyber-physical impact in the electric sector. Its design reflects detailed knowledge of grid operations, substation communications, and the realities of IT-to-OT intrusion paths. The malware primarily targets Windows-based systems in electric utility environments and is associated with destructive, post-compromise operations against critical infrastructure.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Дополнительный DoS-модуль эксплуатировал CVE-2015-5374 в Siemens SIPROTEC - специально сформированные пакеты на порт 50000/UDP вызывали отказ защитных реле (CWE-19, затронуты SIPROTEC 4, SIPROTEC Compact, EN100 Ethernet module). | Industroyer (2016) использовал легитимные function codes промышленных протоколов (IEC 60870-5-101/104, IEC 61850, OPC DA) для размыкания выключателей украинских подстанций. Дополнительный DoS-модуль эксплуатировал CVE-2015-5374 в Siemens SIPROTEC.
6 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
DOJ’s 2020 GRU Unit 74455 indictment describes destructive malware operations against Ukraine’s power grid, Ministry of Finance, and State Treasury Service, including BlackEnergy, Industroyer, and KillDisk, as part of a wider destabilization campaign.
DOJ’s 2020 GRU Unit 74455 indictment describes destructive malware operations against Ukraine’s power grid, Ministry of Finance, and State Treasury Service, including BlackEnergy, Industroyer, and KillDisk, as part of a wider destabilization campaign.
For example, industrial attack techniques employed by Triton and Industroyer were used by actors ranging from FIN11 to FIN6 during ransomware deployment, extortion and other activities.
For example, industrial attack techniques employed by Triton and Industroyer were used by actors ranging from FIN11 to FIN6 during ransomware deployment, extortion and other activities.
Signature Malware: Custom wipers (e.g. “Av3ngers” family), Industroyer-like ICS tools, Rust-enhanced payloads.
Public reports from ESET and Dragos outlining a new, highly capable Industrial Controls Systems (ICS) attack platform that was reportedly used in 2016 against critical infrastructure in Ukraine... the CrashOverride malware is an extensible platform that could be used to target critical infrastructure sectors.
32 distinct techniques documented for this family, organized by ATT&CK tactic.
The content repeatedly describes malware and threat actors using obfuscated code, encrypted strings, Base64/XOR/RC4/AES encoding, VMProtect/ConfuserEx/SmartAssembly, stack strings, control-flow flattening, opaque predicates, and hidden payloads to evade analysis and detection.
‘Kills’ legitimate the master process on the victim host • Masquerades as the new master
The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.
Malware families such as CrashOverride and BlackEnergy, among others, demonstrate the ability to disrupt physical processes, while living-off-the-land (LOTL) techniques allow attackers to blend into normal operations.
The content repeatedly describes malware and threat actors querying, enumerating, opening, and reading Windows Registry keys and values, e.g., "APT41 queried registry values to determine items such as configured RDP ports and network configurations" and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."
The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.
without a configuration file it enumerates the local network to identify potential targets
The command sequence polls the target device for the appropriate addresses.
The first action is to try to kill the communications service process which acts as the master process.
The content is a long ATT&CK-style listing of malware and threat actors that collect host details such as OS version, hostname, architecture, CPU, memory, BIOS, language, and other basic system characteristics; examples include use of commands like systeminfo, ver, uname, sw_vers, and WMI queries.
The content repeatedly describes malware and threat actors listing files and directories, enumerating drives, searching for files by extension/name/path, retrieving file metadata, and browsing file systems (for example: "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection" and "cmd can be used to find files and directories with native functionality such as dir commands").
AsyncRAT can proxy C2 through a Tor client. Attor has used Tor for C2 communication. Cyclops Blink has used Tor nodes for C2 traffic. GreyEnergy has used Tor relays for Command and Control servers. Siloscape uses Tor to communicate with C2. WannaCry uses Tor for command and control traffic.
The content repeatedly describes threat actors and malware using HTTP and HTTPS for command and control, such as: "Sandworm Team used BlackEnergy to communicate between compromised hosts and their command-and-control servers via HTTP post requests."
On execution, the malware attempts to contact a hard-coded proxy address located within the local network. ELECTRUM must establish the internal proxy before the installation of the backdoor.
During the 2025 Poland Wiper Attacks, the adversaries utilized Tor nodes for C2. APT28 has routed traffic over Tor and VPN servers to obfuscate their activities. A backdoor used by APT29 created a Tor hidden service to forward traffic from the Tor client to local ports 3389 (RDP), 139 (Netbios), and 445 (SMB) enabling full remote access from outside the network.
ADVSTORESHELL exfiltrates data over the same channel used for C2... Agrius exfiltrated staged data using tools such as Putty and WinSCP, communicating with command and control servers... numerous malware and groups sent victim data, files, credentials, or host information over existing C2 channels.
Overwrites all ICS configuration files across the hard drives and all mapped network drives specifically targeting ABB PCM600 configuration files in this sample
The first action is to try to kill the communications service process which acts as the master process.
the module sends UDP packets to port 50000 exploiting CVE-2015-5374 causing the SIPROTEC digital relay to fall into an unresponsive state
The first task of the wiper writes zeros into all of the registry keys in: SYSTEM\CurrentControlSet\Services
13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
80 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
ICS malware cited as a historical example of attacks on electric power infrastructure that required compromise of OT devices such as RTUs, HMIs, and SCADA servers.
ICS malware used against electric power infrastructure; mentioned here only as precedent for OT attacks with physical impact.
ICS malware used in electric utility disruption; mentioned as historical context for OT/SCADA compromise impact.
ICS-specific malware used against power infrastructure that natively speaks industrial protocols such as IEC 60870-5-104 to interrogate RTUs and issue control commands to breakers, enabling disruption of process control and power outages.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.