Introduction
Overview
Industroyer2 is a specialized industrial control system (ICS) malware designed to disrupt power infrastructure. It was built upon the capabilities of its predecessor, Industroyer, which was previously used in another major power grid attack. Industroyer2 uses the IEC-104 protocol to issue commands to power substations to cause outages. The attack in April 2022 was ultimately thwarted before it could cause significant disruption.
Vulnerability Details
The malware Industroyer malware operates in three phases: infection, network discovery, and attack execution. It first infiltrates the target system, establishes communication with a command and control (C&C) server, and then maps the industrial environment using standard protocols. Once information is gathered, it executes tailored commands to disrupt the power distribution. Industroyer2 has an updated codebase that enhances its ability to exploit the IEC 104 protocol, making it easily adaptable for different industrial environments