Loading malware…
Industroyer, also known as CrashOverride, is a modular Windows malware framework built for disruptive operations against electric power infrastructure. It is notable for interacting directly with industrial control system protocols rather than behaving as generic enterprise malware, enabling operators to send legitimate control commands to substation equipment and cause power outages. Documented protocol-focused components support IEC 60870-5-101, IEC 60870-5-104, IEC 61850, and OPC DA, allowing the malware to communicate natively with industrial environments used in electrical transmission and distribution.
The malware is closely associated with Sandworm, the Russian GRU unit commonly tracked as Unit 74455, and has been linked to destructive campaigns against Ukraine’s energy sector. In the 2016 Ukraine electric power incident, Industroyer was used to automate substation disruption by issuing valid industrial commands to open breakers. A later variant, commonly referred to as Industroyer2, was identified in 2022 in another attempted attack on Ukrainian power infrastructure.
Industroyer includes a backdoor component for remote control over HTTPS and supports persistence on compromised Windows systems through abuse of Windows services, including modifying service configuration so malicious binaries load at boot. Reported functionality also includes a destructive component that enumerates Windows service-related registry data and a denial-of-service capability aimed at protective relay equipment through exploitation of CVE-2015-5374. The framework exemplifies purpose-built ICS malware designed for cyber-physical impact against electric utilities and related operational technology environments.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Дополнительный DoS-модуль эксплуатировал CVE-2015-5374 в Siemens SIPROTEC - специально сформированные пакеты на порт 50000/UDP вызывали отказ защитных реле (CWE-19, затронуты SIPROTEC 4, SIPROTEC Compact, EN100 Ethernet module). | Industroyer (2016) использовал легитимные function codes промышленных протоколов (IEC 60870-5-101/104, IEC 61850, OPC DA) для размыкания выключателей украинских подстанций. Дополнительный DoS-модуль эксплуатировал CVE-2015-5374 в Siemens SIPROTEC.
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Sandworm (GRU Unit 74455) известен деструктивными атаками на энергосектор Украины (Industroyer)
DOJ’s 2020 GRU Unit 74455 indictment describes destructive malware operations against Ukraine’s power grid, Ministry of Finance, and State Treasury Service, including BlackEnergy, Industroyer, and KillDisk, as part of a wider destabilization campaign.
For example, industrial attack techniques employed by Triton and Industroyer were used by actors ranging from FIN11 to FIN6 during ransomware deployment, extortion and other activities.
For example, industrial attack techniques employed by Triton and Industroyer were used by actors ranging from FIN11 to FIN6 during ransomware deployment, extortion and other activities.
Signature Malware: Custom wipers (e.g. “Av3ngers” family), Industroyer-like ICS tools, Rust-enhanced payloads.
32 distinct techniques documented for this family, organized by ATT&CK tactic.
The content repeatedly describes malware and threat actors using obfuscated code, encrypted strings, Base64/XOR/RC4/AES encoding, VMProtect/ConfuserEx/SmartAssembly, stack strings, control-flow flattening, opaque predicates, and hidden payloads to evade analysis and detection.
‘Kills’ legitimate the master process on the victim host • Masquerades as the new master
The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.
Malware families such as CrashOverride and BlackEnergy, among others, demonstrate the ability to disrupt physical processes, while living-off-the-land (LOTL) techniques allow attackers to blend into normal operations.
The content repeatedly describes malware and threat actors querying, enumerating, opening, and reading Windows Registry keys and values, e.g., "APT41 queried registry values to determine items such as configured RDP ports and network configurations" and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."
The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.
without a configuration file it enumerates the local network to identify potential targets
The command sequence polls the target device for the appropriate addresses.
The first action is to try to kill the communications service process which acts as the master process.
The content is a long ATT&CK-style listing of malware and threat actors that collect host details such as OS version, hostname, architecture, CPU, memory, BIOS, language, and other basic system characteristics; examples include use of commands like systeminfo, ver, uname, sw_vers, and WMI queries.
The content repeatedly describes malware and threat actors listing files and directories, enumerating drives, searching for files by extension/name/path, retrieving file metadata, and browsing file systems (for example: "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection" and "cmd can be used to find files and directories with native functionality such as dir commands").
AsyncRAT can proxy C2 through a Tor client. Attor has used Tor for C2 communication. Cyclops Blink has used Tor nodes for C2 traffic. GreyEnergy has used Tor relays for Command and Control servers. Siloscape uses Tor to communicate with C2. WannaCry uses Tor for command and control traffic.
The content repeatedly describes threat actors and malware using HTTP and HTTPS for command and control, such as: "Sandworm Team used BlackEnergy to communicate between compromised hosts and their command-and-control servers via HTTP post requests."
On execution, the malware attempts to contact a hard-coded proxy address located within the local network. ELECTRUM must establish the internal proxy before the installation of the backdoor.
During the 2025 Poland Wiper Attacks, the adversaries utilized Tor nodes for C2. APT28 has routed traffic over Tor and VPN servers to obfuscate their activities. A backdoor used by APT29 created a Tor hidden service to forward traffic from the Tor client to local ports 3389 (RDP), 139 (Netbios), and 445 (SMB) enabling full remote access from outside the network.
ADVSTORESHELL exfiltrates data over the same channel used for C2... Agrius exfiltrated staged data using tools such as Putty and WinSCP, communicating with command and control servers... numerous malware and groups sent victim data, files, credentials, or host information over existing C2 channels.
Overwrites all ICS configuration files across the hard drives and all mapped network drives specifically targeting ABB PCM600 configuration files in this sample
The first action is to try to kill the communications service process which acts as the master process.
the module sends UDP packets to port 50000 exploiting CVE-2015-5374 causing the SIPROTEC digital relay to fall into an unresponsive state
The first task of the wiper writes zeros into all of the registry keys in: SYSTEM\CurrentControlSet\Services
13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
82 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Destructive ICS malware associated with Sandworm attacks on the energy sector.
Industrial-control-focused malware designed to interact directly with industrial control protocols to disrupt electrical distribution and operational technology.
ICS malware cited as a historical example of attacks on electric power infrastructure that required compromise of OT devices such as RTUs, HMIs, and SCADA servers.
ICS malware used against electric power infrastructure; mentioned here only as precedent for OT attacks with physical impact.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.