The biggest vulnerabilities

In April 2024 a group calling itself Blackjack said it had wrecked Moscollector. The Moscow company monitors the city’s underground water and sewage network. The malware, which the attackers called Fuxnet, ran on the network’s sensor gateways. These small Linux computers gather readings from thousands of underground sensors over a serial standard called M-Bus. On each gateway it cut off remote access, deleted parts of the file system, and rewrote the flash memory until it failed.

It also flooded the M-Bus wiring with junk, hoping to damage the sensors too. How Blackjack first got in is not documented. The group claimed access since June 2023. The attackers claimed 87,000 destroyed sensors and 30 terabytes wiped. The security firm Claroty analyzed the malware and the leaked data. It estimates that only a little over 500 gateways were bricked and that the sensors likely survived. Claroty reports that Blackjack is believed to be linked to Ukrainian intelligence. No government has confirmed this.

In January 2024, during a sub-zero winter, more than 600 apartment buildings in a Ukrainian city lost heating for almost two days. According to Dragos, the city was Lviv. The malware behind the outage, later named FrostyGoop, is a small program that talks to heating controllers over Modbus TCP. This plain, widely used protocol sends commands on port 502, usually without a password. FrostyGoop read and changed the controllers’ holding registers, the memory slots that hold their settings. It also downgraded their software so they could no longer report their status.

That left operators without a clear view while the controllers ran on wrong information. Dragos reconstructs the likely entry. Months earlier, the attackers exploited a flaw in an internet-facing router, planted a web tunnel reached over Tor, and stole Windows credentials. The network was flat, with nothing separating the controllers, so they could be reached directly. Dragos does not attribute the attack. It notes only connections to Moscow-based addresses during the incident.

On April 8, 2022, the group Sandworm tried to switch off part of Ukraine’s power grid. Its tool, named Industroyer2 by the security firm ESET, was a stripped-down successor to the Industroyer malware from 2016. It spoke only one industrial protocol, IEC 104. The target substations’ addresses and switching commands sat inside the program itself, so it was built for one specific utility. Separate ‘wiper’ malware was lined up to destroy the utility’s Windows, Linux and Solaris servers at the same time.

How the attackers first entered is not public, but they already held administrator access. They pushed the malware out through Windows Group Policy and set a scheduled task to run it that evening. CERT-UA, Ukraine’s incident team, says the network had been compromised since at least February 2022. It also says the plan was stopped in time and no outage occurred. CERT-UA attributes the attack to Sandworm (UAC-0082); ESET assesses this with high confidence.

PIPEDREAM is a case with no victim. In early 2022 the security firms Dragos and Mandiant analyzed a complete attack toolkit. A state-backed group had built it to find and take over industrial controllers. Dragos called it PIPEDREAM, Mandiant INCONTROLLER. On April 13, 2022, four US agencies published a joint advisory, AA22-103A. By Dragos’s count it is the seventh known piece of ICS-specific malware, and the first found before an attack.

The toolkit is modular. Some parts get a foothold on Windows and gain deep access through a signed-but-flawed driver. Others speak the industrial protocols CODESYS, Modbus, OPC UA and Omron FINS to scan, log into, reprogram or crash controllers. It came with modules for Schneider Electric and Omron equipment. Dragos assesses with high confidence that a state built it and tracks the developer as CHERNOVITE. No country was named, and Mandiant called its links to Russia circumstantial.

EKANS (the word ‘snake’ backwards) is ransomware that appeared in 2020. It runs on ordinary Windows computers, so it cannot reprogram the controllers that run machinery. Instead it goes after the Windows PCs operators use to watch and command a plant. These include the screens known as HMIs, the databases called historians, and license servers. Before encrypting their files, it stops a hard-coded list of programs so the files are no longer locked.

The security firm FireEye found that the list targets over 1,000 processes. Some of them are industrial software from vendors such as General Electric and Honeywell. EKANS also deletes the backup copies Windows keeps. How operators were first breached was never made public. EKANS is the payload dropped at the end. No group or state has been named. MITRE’s ATT&CK, citing press reports, links an EKANS infection to a temporary production loss at a Honda plant in June 2020.

In 2017, attackers reached the safety system of a petrochemical plant in the Middle East. Its independent controllers are meant to force a process into a safe state before it turns dangerous. The malware, known as TRISIS or TRITON, was built for the plant’s Schneider Electric Triconex controllers. It spoke TriStation, their undocumented protocol, which the attackers had reverse-engineered. It wrote a hidden backdoor into a controller’s memory to alter its safety logic.

US agencies have not said how the attackers first broke in. Once inside, they reached the engineering workstation that programs the controllers and ran a tool disguised as the vendor’s own software. During the operation some controllers tripped and shut the plant down for several days, which is how the malware was found. In 2018 FireEye tied the intrusion to a Russian state institute, TsNIIKhM, with high confidence. The US sanctioned the institute in 2020. Dragos tracks the operator as XENOTIME.

On December 17, 2016, part of Kyiv lost power for about an hour. The malware behind it, analyzed in 2017, was named Industroyer by ESET and CRASHOVERRIDE by Dragos. It was the first malware built to control grid equipment directly. Instead of a person clicking through remote-control tools, its own modules opened circuit breakers automatically. They spoke the grid’s standard protocols: IEC 60870-5-101, IEC 60870-5-104, IEC 61850 and OPC DA. How the attackers first got in was never established.

A launcher set off the payload at a chosen time. One to two hours later, a wiper destroyed files and settings to slow recovery. A separate tool could disable Siemens SIPROTEC protection relays. The US government attributes the attack to Sandworm (Russia’s GRU); Dragos tracks the operators as ELECTRUM. In 2017, ESET found no code overlap with BlackEnergy and did not attribute it.

On December 23, 2015, three Ukrainian regional power companies lost control of their grids within about half an hour of each other. About 225,000 customers lost power (ESET counted around 230,000 people). It is the first blackout confirmed to have been caused by a cyberattack. Months earlier, spear-phishing emails with macro-laden Office files had planted the BlackEnergy malware on the office networks.

The attackers harvested credentials, then used the utilities’ own VPN and remote-control tools to reach the SCADA systems. There they opened breakers at more than 50 substations by hand. They disabled serial-to-Ethernet converters, wiped PCs with KillDisk, and flooded a call center. As a result, power had to be restored on site, which took about six hours. The US government later attributed the attack to Sandworm, a unit of Russia’s GRU.

Havex, made public in June 2014 and also tracked as Dragonfly or Energetic Bear, was a spying campaign against the energy sector. It reached victims three ways: phishing emails with booby-trapped PDF files, websites rigged to infect visitors, and, most notably, hacked download pages. At least three small makers of industrial software had their installers swapped for versions that also carried Havex. Kaspersky counted more than 2,800 victims worldwide.

Havex was a backdoor that called home and downloaded extra modules. One module searched the network for OPC servers, the Windows middleware that lets software read live data from many controllers. It copied their details back to the attackers. The scanning alone crashed some servers. Havex stole information but had no sabotage payload. In 2014 analysts disagreed on the source; in 2022 the US government attributed the campaign to Russia’s FSB.

Stuxnet, found in June 2010, is the first malware known to have damaged physical machines. It spread to about 100,000 computers in more than 150 countries. But it was built to harm one target: an Iranian uranium-enrichment plant that researchers linked to Natanz. Because the plant’s control network had no internet connection, the worm was most likely carried in on a removable drive. Then it spread on its own, using four unknown Windows flaws and the project files of Siemens Step 7 engineering software.

It loaded hidden code onto Siemens S7-300 PLCs and drove centrifuge motors far outside their normal speed. At the same time it replayed normal readings, so operators saw nothing wrong. An institute estimated that about 1,000 of 8,692 installed centrifuges were taken out of service, though the link to Stuxnet is unproven. Press reports describe a joint US-Israeli operation. No government has confirmed who built it.