Industroyer

What is Industroyer?

Industroyer, also known as CrashOverride, is a modular malware framework that directly operates switchgear in electrical substations through the industrial protocols of the power sector, and that caused a power cut in Kyiv on 17 December 2016. It was the first known malware designed and deployed specifically to attack an electricity grid. Whereas in 2015 the attackers still had to click through the victim’s own SCADA software, Industroyer could open circuit breakers on its own. The attack is attributed to Sandworm, a unit of the Russian military intelligence service GRU. A successor, Industroyer2, surfaced in 2022. For anyone running OT in the energy sector, Industroyer is therefore a reference scenario.

🗓️ What happened in December 2016?

On 17 December 2016, almost exactly a year after the BlackEnergy attack on three Ukrainian distribution companies, the Pivnichna substation of the national grid operator Ukrenergo near Kyiv went down. Part of Kyiv and the surrounding area lost power for just over an hour; the lost load is estimated at about one fifth of the city’s consumption at the time.

Dragos links the attack to the group it calls ELECTRUM, which is closely tied to Sandworm; ESET saw a strong link with the TeleBots group, also behind NotPetya. The difference with 2015 is fundamental: back then the attackers used existing SCADA workstations remotely, whereas this time the malware did the switching itself.

⚙️ How is Industroyer built?

Industroyer is not a single program but a toolkit of Windows components, each with one task. This let its authors swap parts without rewriting the whole.

The wiper and one of the payloads were tailored to ABB products, which shows the authors knew the victim’s specific installation. Because the protocols themselves are standard, however, the approach is not tied to Ukraine: the same protocols run in substations across Europe.

🌐 Why could Industroyer switch through standard protocols?

The protocols Industroyer abused were designed at a time when the network was considered trusted. An RTU or IED executes a valid command regardless of who sends it.

The core problem is that IEC 104 and similar protocols have no authentication or encryption. Anyone who is inside the network and knows the addressing plan can switch just like the control centre, or play back captured messages in a replay attack. The IEC 62351 security extensions add authentication, but are still far from universally deployed in existing substations. Security therefore has to come from the architecture: network segmentation, industrial firewalls with protocol inspection, and network monitoring.

🔐 Was Industroyer aimed at physical damage?

A striking element is the DoS tool against Siemens SIPROTEC relays. Protection relays trip a feeder during a short circuit or overcurrent to protect transformers and lines. In a 2019 reassessment, Dragos argued that the attackers probably wanted that protection to be missing at the moment operators re-energised the lines. That could have damaged high-voltage equipment and caused a far longer outage.

The DoS attack on the relays did not work, according to Dragos because of an error in converting IP addresses, so the packets reached the wrong targets. Dragos also stresses that it is unclear whether the intended effect would have been achieved, given the other safeguards in a substation, and it saw the 2016 attack as possibly a proof of concept. MITRE ATT&CK for ICS describes Industroyer as software S0604, with techniques such as Denial of Control, Denial of View, Loss of Protection and Manipulation of Control. This makes Industroyer a textbook example of an attack on cyber-physical systems.

🔄 What is the difference between Industroyer and Industroyer2?

On 8 April 2022, shortly after the Russian invasion, Sandworm again tried to cut power in Ukraine. ESET and CERT-UA found a new variant and named it Industroyer2. According to CERT-UA, the attack was foiled in time.

Industroyer2 was compiled on 23 March 2022, pointing to weeks of preparation; according to CERT-UA the attackers had been in the network since February 2022 at the latest. The binary contained eight device IP addresses and first terminated a legitimate process, then renamed that program so it would not restart automatically. In October 2022 Sandworm went a step further and cut power using the victim’s own MicroSCADA software, without any OT malware of its own, a form of Living Off The Land.

🧩 How does Industroyer compare with other ICS malware?

Industroyer belongs to a short list of malware genuinely aimed at industrial control. The table shows that they intervene at different levels of the Purdue Model: from PLC logic to the communication between control centre and field.

Where Stuxnet rewrote the logic inside a PLC, Industroyer abused the legitimate communication between control centre and field devices. That is cheaper and more widely applicable, because no vendor-specific code is needed.

🛡️ How do you protect a substation against an Industroyer-style attack?

Industroyer shows that the attack does not start in the substation but in the IT network and on Windows systems. A practical approach based on Defense in Depth and IEC 62443:

1. Map your assets and connections - know which assets, RTUs and IEDs speak IEC 104 or IEC 61850 and which stations they may talk to.
2. Segment by zones and conduits - separate the control centre, the substations and the office network using the zones and conduits model, with an IDMZ between IT and OT and lateral movement blocked between substations.
3. Restrict remote access - route administration only through a jump server with MFA and secure Active Directory, because that is how the wipers spread in 2022.
4. Harden the Windows systems - use application whitelisting on SCADA servers and engineering stations, so unknown programs such as a fake Notepad cannot start.
5. Monitor the OT protocols - DPI and an OT IDS flag unexpected switching commands, new IEC 104 connections or port scans. Platforms such as Claroty, Nozomi and Dragos include detection rules for Industroyer.
6. Practise recovery without IT - keep offline backups of configurations and make sure the grid can be operated by hand; Ukrainian operators recovered quickly in 2015 and 2016 precisely by switching manually. Record in your incident response plan who may decide to switch to manual operation, because you cannot simply shut down OT systems the way you would a compromised laptop.

In the Netherlands, grid operators fall under NIS2 as transposed in the Cybersecurity Act, which sets a duty of care and incident reporting. In North America the NERC CIP standards serve the same purpose, and NIST SP 800-82 provides general guidance for ICS security. ISO 27001 covers the IT side of the same management system. A SOC with OT knowledge and threat intelligence on APT groups such as Sandworm is what makes monitoring truly effective.

❓ Frequently asked questions

Is Industroyer the same as CrashOverride?

Yes, Industroyer and CrashOverride are two names for the same malware. ESET named it Win32/Industroyer, while Dragos published an analysis at the same time under the name CRASHOVERRIDE. MITRE ATT&CK for ICS uses Industroyer as the primary name.

Who is behind Industroyer?

Industroyer is attributed to Sandworm, unit 74455 of the Russian military intelligence service GRU. Dragos tracks the related activity as ELECTRUM, a group closely tied to Sandworm. In October 2020 the United States indicted six officers of this unit, partly for the attack on the Ukrainian power grid.

Could Industroyer be used in the Netherlands or the EU?

Industroyer itself was tailored to its Ukrainian targets, but the protocols it uses, IEC 60870-5-104 and IEC 61850, are standard in European electricity grids. An attacker with access to the OT network and knowledge of the addressing plan could follow the same approach. That is why segmentation and protocol monitoring are essential for Dutch and European grid operators.

Why is Industroyer more dangerous than BlackEnergy?

In the 2015 BlackEnergy attack, the attackers switched by hand through the victim’s SCADA software. Industroyer automated that switching through industrial protocols and could strike on its own at a set time. This makes Industroyer more scalable and less dependent on human operators.

How do you detect Industroyer in an OT network?

Industroyer can be detected with OT network monitoring that inspects the content of IEC 104, IEC 61850 and OPC traffic. Warning signs are unexpected switching commands, connections from an unknown Windows system, port scans and traffic to the Tor network. Detection rules for Industroyer are included in most OT monitoring platforms and in public YARA and IDS rule sets.

Is Industroyer still a threat?

The original Industroyer is no longer used, but its approach lives on in Industroyer2 from 2022 and in attacks that abuse legitimate SCADA software. Sandworm has become more active since 2022 against targets including energy and telecoms companies. Industroyer therefore remains an important scenario for risk assessments in the energy sector.

📌 In summary

Industroyer (CrashOverride) is the first malware built specifically to attack a power grid: on 17 December 2016 it opened switches in a substation near Kyiv via IEC 104, IEC 101, IEC 61850 and OPC DA. The lesson for OT convergence and critical infrastructure is that protocols without authentication are only safe inside a well-segmented and monitored network. Security and cybersecurity in the energy sector therefore call for Defense in Depth, zero trust for access and monitoring that understands OT protocols, with IT, OT and the ICS team working together.