The biggest vulnerabilities since 1995

In April 2024 a group calling itself Blackjack said it had wrecked Moscollector, a Moscow company that monitors the city’s underground water and sewage network. The malware, which the attackers called Fuxnet, ran on the network’s sensor gateways — small Linux computers that gather readings from thousands of underground sensors over a serial standard called M-Bus. On each gateway it cut off remote access, deleted parts of the file system, and rewrote the flash memory until it failed.

It also flooded the M-Bus wiring with junk, hoping to damage the sensors too. How Blackjack first got in is not documented; the group claimed access since June 2023. The attackers claimed 87,000 destroyed sensors and 30 terabytes wiped; the security firm Claroty, analysing the malware and the leaked data, estimates only a little over 500 gateways were bricked and the sensors likely survived. Claroty reports Blackjack as believed linked to Ukrainian intelligence, unconfirmed by any government.

In January 2024, during a sub-zero winter, heating went off for more than 600 apartment buildings in a Ukrainian city — Lviv, according to Dragos — for almost two days. The malware behind it, later named FrostyGoop, is a small program that talks to heating controllers over Modbus TCP — a plain, widely used protocol that sends commands on port 502, usually without a password. It read and changed the controllers’ holding registers, the memory slots that hold their settings, and downgraded their software so they could no longer report their status.

That left operators without a clear view while the controllers ran on wrong information. Dragos reconstructs the likely entry: months earlier the attackers exploited a flaw in an internet-facing router, planted a web tunnel reached over Tor, and stole Windows credentials; because the network was flat, nothing separated the controllers, so they could be reached directly. Dragos does not attribute the attack, noting only — without drawing a conclusion — connections to Moscow-based addresses during the incident.

On April 8, 2022, the group Sandworm tried to switch off part of Ukraine’s power grid. Its tool, named Industroyer2 by the security firm ESET, was a stripped-down successor to the Industroyer malware from 2016. It spoke only one industrial protocol, IEC 104, and carried the target substations’ addresses and switching commands inside the program itself, so it was built for one specific utility. Separate ‘wiper’ malware was lined up to destroy the utility’s Windows, Linux and Solaris servers at the same time.

How the attackers first entered is not public, but they already held administrator access: they pushed the malware out through Windows Group Policy and set a scheduled task to run it that evening. CERT-UA, Ukraine’s incident team, says the network had been compromised since at least February 2022, and that the plan was stopped in time — no outage occurred. CERT-UA attributes the attack to Sandworm (UAC-0082); ESET assesses this with high confidence.

PIPEDREAM is a case with no victim. In early 2022 the security firms Dragos and Mandiant analysed a complete attack toolkit — Dragos called it PIPEDREAM, Mandiant INCONTROLLER — built by a state-backed group to find and take over industrial controllers. It was caught before it was ever used. On April 13, 2022, four US agencies published a joint advisory, AA22-103A. By Dragos’s count it is the seventh known piece of ICS-specific malware, and the first found before an attack.

The toolkit is modular: some parts get a foothold on Windows and gain deep access through a signed-but-flawed driver, while others speak the industrial protocols CODESYS, Modbus, OPC UA and Omron FINS to scan, log into, reprogram or crash controllers. It came with modules for Schneider Electric and Omron equipment. Dragos assesses with high confidence that a state built it and tracks the developer as CHERNOVITE; no country was named, and Mandiant called its links to Russia circumstantial.

EKANS (the word ‘snake’ backwards) is ransomware that appeared in 2020. It runs on ordinary Windows computers, so it cannot reprogram the controllers that run machinery. Instead it goes after the Windows PCs operators use to watch and command a plant: the screens known as HMIs, the databases called historians, and licence servers. Before encrypting their files, it stops a hard-coded list of programs so the files are no longer locked.

The security firm FireEye found that list targets over 1,000 processes, some of them industrial software from vendors such as General Electric and Honeywell. EKANS also deletes the backup copies Windows keeps. How operators were first breached was never made public; EKANS is the payload dropped at the end. No group or state has been named. MITRE’s ATT&CK, citing press reports, links an EKANS infection to a temporary production loss at a Honda plant in June 2020.

In 2017, attackers reached the safety system of a petrochemical plant in the Middle East — the independent controllers meant to force a process into a safe state before it turns dangerous. The malware, known as TRISIS or TRITON, was built for the plant’s Schneider Electric Triconex controllers. It spoke TriStation, their undocumented protocol, which the attackers had reverse-engineered, and wrote a hidden backdoor into a controller’s memory to alter its safety logic.

US agencies have not said how the attackers first broke in; they reached the engineering workstation that programs the controllers and ran a tool disguised as the vendor’s own software. During the operation some controllers tripped and shut the plant down for several days, which is how the malware was found. In 2018 FireEye tied the intrusion to a Russian state institute, TsNIIKhM, with high confidence; the US sanctioned it in 2020. Dragos tracks the operator as XENOTIME.

On December 17, 2016, part of Kyiv lost power for about an hour. The malware behind it, analyzed in 2017, was named Industroyer by ESET and CRASHOVERRIDE by Dragos. It was the first malware built to control grid equipment directly: instead of a person clicking through remote-control tools, its own modules spoke the grid’s standard protocols (IEC 60870-5-101, IEC 60870-5-104, IEC 61850 and OPC DA) to open circuit breakers automatically. How the attackers first got in was never established.

A launcher set off the payload at a chosen time; one to two hours later a wiper destroyed files and settings to slow recovery, and a separate tool could disable Siemens SIPROTEC protection relays. The US government attributes the attack to Sandworm (Russia’s GRU); Dragos tracks the operators as ELECTRUM. In 2017, ESET found no code overlap with BlackEnergy and did not attribute it.

On December 23, 2015, three Ukrainian regional power companies lost control of their grids within about half an hour of each other, and about 225,000 customers lost power (ESET counted around 230,000 people). It is the first blackout confirmed to have been caused by a cyberattack. Months earlier, spear-phishing emails with macro-laden Office files had planted the BlackEnergy malware on the office networks.

The attackers harvested credentials, then used the utilities’ own VPN and remote-control tools to reach the SCADA systems, where they opened breakers at more than 50 substations by hand. They disabled serial-to-Ethernet converters, wiped PCs with KillDisk, and flooded a call center, so power had to be restored on site in about six hours. The US government later attributed the attack to Sandworm, a unit of Russia’s GRU.

Havex, made public in June 2014 and also tracked as Dragonfly or Energetic Bear, was a spying campaign against the energy sector. It reached victims three ways: phishing emails with booby-trapped PDF files, websites rigged to infect visitors, and, most notably, the hacked download pages of at least three small makers of industrial software, whose installers were swapped for versions that also carried Havex. Kaspersky counted more than 2,800 victims worldwide.

Havex was a backdoor that called home and downloaded extra modules. One module searched the network for OPC servers, the Windows middleware that lets software read live data from many controllers, and copied their details back to the attackers; the scanning alone crashed some servers. It stole information but had no sabotage payload. In 2014 analysts disagreed on the source; in 2022 the US government attributed the campaign to Russia’s FSB.

In its 2014 annual report, Germany’s Federal Office for Information Security (the BSI) described a targeted attack on a steel mill that caused heavy physical damage. The agency named no company, location, date, or attacker. The attackers used spear phishing and social engineering to reach the office network, then worked their way step by step into the production networks that run the plant.

After that, individual control components and whole installations failed more and more often, until a blast furnace could not be shut down in a controlled way and was left in an undefined state, causing what the BSI called massive damage. The agency named no products, protocols, or malware, and no cost figure is public. It rated the attackers as very advanced, with detailed knowledge of the control systems, but offered no attribution of any kind.

Stuxnet, found in June 2010, is the first malware known to have damaged physical machines. It spread to about 100,000 computers in more than 150 countries, but it was built to harm one target: an Iranian uranium-enrichment plant that researchers linked to Natanz. Because that plant’s control network had no internet connection, the worm was most likely carried in on a removable drive, then spread on its own using four unknown Windows flaws and the project files of Siemens Step 7 engineering software.

On the controllers, it loaded hidden code onto Siemens S7-300 PLCs and drove centrifuge motors far outside their normal speed, while replaying normal readings so operators saw nothing wrong. An institute estimated that about 1,000 of 8,692 installed centrifuges were taken out of service, though the link to Stuxnet is unproven. No government has confirmed who built it; press reports describe a joint US-Israeli operation, but that attribution is not official.