Loading story…
Palo Alto Networks' Unit 42 detailed FrostyGoop, a Go-based malware family built to interact directly with industrial control systems and used in an attack that knocked out heating for two days across more than 600 apartment buildings in Ukraine during sub-zero temperatures. The malware targeted ENCO control devices over Modbus TCP, sending malicious commands that led to inaccurate measurements and operational failures in the heating environment, underscoring its focus on OT disruption rather than conventional IT compromise.
The report said FrostyGoop supports Modbus read, write, and multi-write functions through command-line arguments or JSON configuration files, and includes anti-debugging checks against the Windows BeingDebugged flag in the PEB. Investigators also examined a related Go utility, go-encrypt.exe, which can encrypt and decrypt JSON files with AES-256 CFB and may have been used to hide FrostyGoop configuration data, although that link remains unconfirmed. Unit 42 said possible initial access vectors included an unconfirmed MikroTik router vulnerability and internet-exposed OT assets; exposed ENCO devices were observed with services such as Telnet, Modbus, web interfaces, and ENCO-specific ports accessible from the internet, while VirusTotal and infrastructure pivots tied FrostyGoop samples, go-encrypt.exe, and a task_test.json file to the same first-seen date and a sample configuration referencing an ENCO device in Romania.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
The report states that Dragos discovered FrostyGoop in April 2024. This marks the malware's reported discovery prior to the later public technical analysis.
A FrostyGoop configuration file named task_test.json was first seen on VirusTotal, and pivoting from it led to FrostyGoop Windows executables and go-encrypt.exe with the same first-seen date. The sample configuration referenced an ENCO device in Romania.
FrostyGoop was used in a cyberattack on Ukrainian heating infrastructure, where adversaries sent malicious Modbus commands to ENCO control devices. The incident caused inaccurate measurements and operational malfunctions, leading to a two-day outage affecting more than 600 apartment buildings during sub-zero temperatures.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Government and industry reporting warns that operational technology and industrial control systems remain dangerously exposed through weak remote access, poor segmentation, and internet-facing devices, giving both state-backed and criminal actors paths into critical infrastructure. A joint **CISA/NSA** advisory said adversaries routinely exploit legacy OT environments, public system information, and insecure remote connections to move from reconnaissance to manipulation of physical processes, while a separate **CISA/FBI** alert tied Chinese state-sponsored intrusions to U.S. natural gas pipeline operators and said the actors stole SCADA and ICS information to build capabilities for future disruption. Recent exposure research also found **6,300** internet-reachable industrial-control and building-automation devices near U.S. data centers, including **BACnet**, **Fox/Niagara**, **Modbus**, and Vertiv/Liebert systems that could affect cooling and power operations. The threat has already translated into real-world disruptive activity and increasingly specialized tooling. Dragos reported **FrostyGoop**, a Golang-based ICS malware that communicates over **Modbus TCP** and was likely used to disrupt heating services in Lviv, Ukraine, after attackers apparently entered through an internet-facing router and traversed poorly segmented networks. Other cited incidents and assessments include Israel’s thwarted attempt against water facilities, persistent Russian probing of U.S. power infrastructure, and leaked-document analysis describing a Russian capability designed to attack rail and petrochemical control systems through telecommunications access. Across the reporting, the common defensive priorities were to eliminate direct public exposure, harden and inventory remote access, enforce MFA, replace default credentials, patch supported systems, restrict engineering tools, and closely monitor OT network and protocol activity.
Aug 15, 2026
Security researchers reported that malware targeting operational technology is broader than rare, bespoke ICS implants alone. Mandiant detailed **COSMICENERGY**, an OT-focused malware framework with similarities to **INDUSTROYER**, **TRITON**, and **INCONTROLLER**, built around insecure industrial protocols such as `IEC-104` and packaged with common Python tooling. Separate Mandiant reporting on **INCONTROLLER** described modular tools including **TAGRUN** for OPC UA reconnaissance, **CODECALL** for Modbus and Schneider Electric PLC interaction, and **OMSHELL** for gaining shell access to Omron PLC environments, enabling actions ranging from tag manipulation and credential attacks to file transfer, traffic capture, and program-memory wiping. At the same time, Forescout found that generic malware families are increasingly reaching into OT environments through exposed devices and weak credentials rather than highly tailored tradecraft. In a VirusTotal hunt, researchers identified botnet-linked samples tied to **Aisuru**, **Kaiten**, and **Gafgyt** that attempted logins against PLCs and other OT products using default credentials, with some samples trying to wipe directories such as `/mnt/modbus_rtu`; affected technologies included devices from Modicon, Siemens, Emerson, Avocent, and Sierra Wireless. Dragos also documented trojanized "password recovery" tools for industrial assets, including one for Automation Direct DirectLogic 06 PLCs that exploited **CVE-2022-2003** to retrieve passwords while infecting engineering workstations with **Sality**, underscoring that OT operators face both purpose-built ICS malware and commodity malware abusing industrial access paths.
Aug 15, 2026
Claroty’s Team82 reported that **IOCONTROL**, a custom malware attributed to Iran-affiliated actors and linked to **CyberAv3ngers**, was used against civilian critical infrastructure in Israel and the United States. The malware was recovered from a **Gasboy** fuel control system payment terminal and is designed to compromise a broad range of Linux-based IoT and OT assets, including **Orpak** and Gasboy fuel management systems, routers, PLCs, HMIs, firewalls, and IP cameras. Researchers said the activity aligns with prior CyberAv3ngers operations against **Unitronics** devices at water facilities and with the group’s claims of compromising hundreds of gas stations. The malware was described as a modular cyberweapon built for stealth and persistence. Team82 said IOCONTROL uses modified **UPX-style packing**, an **AES-256-CBC** encrypted configuration derived from a hardcoded GUID, **DNS over HTTPS** via Cloudflare for command-and-control resolution, and secure **MQTT** over port `8883` for communications. It establishes persistence through an `rc3.d` boot script, sends a JSON-based "hello" beacon to identify infected devices, and supports arbitrary command execution, self-deletion, executable verification, and port scanning. Researchers also noted that, as of December 10, 2024, the analyzed IOCONTROL sample reportedly evaded detection by all 66 antivirus engines on VirusTotal.
Aug 15, 2026