Industroyer2

Executive Summary

Industroyer 2 is a statically compiled malware targeting field controllers in high‑voltage substations via the IEC‑104 protocol. It schedules destructive commands that could physically trip breakers or reset protection devices, potentially causing wide‑scale power outages. The sample was caught before deployment, but its capabilities mirror those of the original Industroyer, marking it as a credible threat to critical infrastructure.

Industroyer 2 is a statically compiled malware payload that targets industrial control system (ICS) devices, specifically field controllers, remote terminal units (RTUs), programmable logic controllers (PLCs), and other IEDs used in high‑voltage electrical substations. The binary contains an embedded IEC‑104 protocol module – the same communication stack used by the original Industroyer kit – enabling it to send well‑structured command sequences directly to substation equipment such as breakers, circuit regulators, and protective relays. When executed it attempts to trigger a pre‑defined schedule (e.g., a cron or Windows Scheduled Task) that activates its destructive logic at a predetermined date. The code is designed to manipulate IEC‑104 register values to induce physical effects such as tripping protection devices or resetting breakers, thereby causing service disruption or cascading failures across the substation network. Although the first known sample was compiled in March 2022 and slated for deployment on April 8 2022, it was seized prior to activation, so there are no publicly documented impact incidents. The malware’s footprint is relatively light; it contains a hard‑coded command sequence and minimal outbound traffic aside from initial communication with the victim's IEC‑104 channel. No evident persistence mechanisms beyond scheduled execution or exploitation of known vulnerabilities were observed in the single sample analyzed. However, its reliance on an industrial protocol places it within the small but highly damaging set of “ICS‑specific” attacks that can cause physical damage and extensive downtime. Given its design lineage from Industroyer, analysts anticipate similar capabilities: the ability to read/write key registers, bypassing traditional IT security controls by operating within a protected operational network segment. The static nature and lack of dynamic encryption might limit stealth, but the protocol‑level operations can remain invisible on conventional SIEMs that are tuned for corporate traffic. Overall, Industroyer 2 exemplifies a sophisticated weaponized tool aimed at critical infrastructure actors – a threat that would be of high concern to utilities, grid operators, and any organization hosting legacy PLC/RTU environments that rely on IEC‑104 communications.

Key Capabilities

• Implements IEC-104 protocol for command injection
• Schedules execution via operating system scheduler
• Targets field controllers, RTUs, PLCs and IEDs in substations
• Uses static binary with hard‑coded destructive logic
• Capable of manipulating protection device register values

ATT&CK Techniques

Recommended Actions

• Implement network segmentation to isolate industrial networks from corporate IT traffic
• Deploy deep packet inspection for IEC-104 traffic and flag anomalous commands
• Block inbound/outbound traffic on the standard IEC-104 ports (port 2404) except for authorized equipment
• Configure firewalls to reject unexpected connections from untrusted sources that appear to use IEC-104
• Use endpoint detection on field controllers to alert on scheduled task changes and unknown binaries
• Regularly update PLC/RTU firmware with vendor patches
• Conduct penetration tests focused on IEC-104 command injection scenarios

Suggested Tags