LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0604: Industroyer

Industroyer is a sophisticated malware framework designed to cause an impact to the working processes of Industrial Control Systems (ICS), specifically components used in electrical substations.[1] Industroyer was used in the attacks on the Ukrainian power grid in December 2016.[2] This is the first publicly known malware specifically designed to target and impact operations in the electric grid.[3]

EnterpriseS0604MalwareObject v1.2Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

Industroyer matters because ATT&CK describes it as malware built to affect Industrial Control Systems, specifically electrical substation components, and links it to the 2016 Ukraine Electric Power Attack. For executives, the decision value is not ordinary endpoint malware coverage; it is whether the organization can detect and respond when Windows-based systems in or near operational technology are used to discover, monitor, manipulate, or disrupt industrial processes.

Executive priority

Treat this as a resilience and cyber-physical risk planning case. Leaders responsible for electric, utility, manufacturing, or other ICS-dependent operations should ask whether incident response plans, SOC escalation paths, engineering procedures, and audit evidence cover loss of view, loss of control, denial of control, device restart/shutdown, service stop, and protective-function degradation scenarios. Budget priority should focus on validated OT visibility, segmentation, response coordination with operations teams, and evidence that Windows assets supporting ICS functions are monitored and recoverable.

Technical view

ATT&CK lists the platform as Windows and provides no official detection text, so teams should validate coverage from the relationship context. Industroyer is associated with ICS techniques including process-state monitoring, automated collection, network and remote-system discovery, port scanning, command-line use, connection proxying, service stop, data destruction, firmware-update-mode abuse, manipulation/loss/denial of control and view, device restart/shutdown, and loss of protection. SOC and IR teams should map detections to Windows hosts that interact with ICS networks, then correlate endpoint activity with industrial network traffic and operator/engineering events rather than relying on IT telemetry alone.

Likely telemetry

  • Windows endpoint process execution and command-line logs from ICS-adjacent systems
  • Windows service start/stop and system restart/shutdown events
  • File creation, deletion, and other evidence relevant to data destruction or cleanup
  • Network connection metadata from Windows hosts communicating with ICS devices or substation networks
  • ICS network traffic showing discovery, port scanning, protocol use, command activity, or abnormal device communications

Detection direction

  • Confirm whether monitoring exists at the boundary between enterprise Windows systems and ICS environments; enterprise-only logging may miss the material behavior.
  • Tune for unusual command-line activity, service stops, restarts, proxy-like connections, file destruction, and discovery from Windows hosts with access to control-system networks.
  • Correlate IT events with OT symptoms such as unexpected loss of view, denial of control, manipulation of control values, device restarts, or protective-system impairment.
  • Baseline normal engineering and maintenance activity to reduce false positives, especially legitimate scans, service restarts, firmware work, and operator-initiated control actions.
  • Use the ATT&CK relationship set to build scenario-based detections, not just malware-name detections, because the supplied object has no official detection guidance.

Mitigation priorities

  • Prioritize asset inventory and network mapping for Windows systems that can reach ICS devices or substation components.
  • Limit and monitor pathways from enterprise networks into ICS networks; enforce least-privilege access for engineering and operator functions.
  • Establish OT-aware logging and retention for Windows hosts, network traffic, operator actions, device state changes, and service events.
  • Prepare IR playbooks for loss of view/control, device restart/shutdown, service stop, data destruction, and protection-function impairment scenarios.
  • Validate recovery procedures with operations teams, including manual operation, device restoration, and evidence preservation for compliance and post-incident review.
Additional notes and limits

ATT&CK identifies Industroyer as a sophisticated ICS-impact malware framework and links it to the 2016 Ukraine Electric Power Attack and Sandworm Team through relationships. The strongest defensive use is scenario planning across the listed ICS techniques and Windows-host telemetry, especially where business operations depend on reliable substation or control-system behavior.

The supplied ATT&CK object has no official detection text, no listed tactics, and only Windows as a platform. Many defensive conclusions require local architecture, device inventory, ICS protocol visibility, logging maturity, and operational procedures. This take does not assert current exploitation or environment-specific exposure.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Industroyer

Industroyer is a sophisticated malware framework designed to cause an impact to the working processes of Industrial Control Systems (ICS), specifically components used in electrical substations.[1] Industroyer was used in the attacks on the Ukrainian power grid in December 2016.[2] This is the first publicly known malware specifically designed to target and impact operations in the electric grid.[3]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

19 rows
DomainIDNameRelationship / procedure
EnterpriseT1543.003Windows ServiceSub-technique

Industroyer can use an arbitrary system service to load at system boot for persistence and replaces the ImagePath registry value of a Windows service with a new backdoor binary.[2]

EnterpriseT1485Data Destruction

Industroyer’s data wiper module clears registry keys and overwrites both ICS configuration and Windows files.[2]

EnterpriseT1046Network Service Discovery

Industroyer uses a custom port scanner to map out a network.[1]

EnterpriseT1078Valid Accounts

Industroyer can use supplied user credentials to execute processes and stop services.[1]

EnterpriseT1554Compromise Host Software Binary

Industroyer has used a Trojanized version of the Windows Notepad application for an additional backdoor persistence mechanism.[1]

EnterpriseT1105Ingress Tool Transfer

Industroyer downloads a shellcode payload from a remote C2 server and loads it into memory.[1]

EnterpriseT1018Remote System Discovery

Industroyer can enumerate remote computers in the compromised network.[1]

EnterpriseT1083File and Directory Discovery

Industroyer’s data wiper component enumerates specific files on all the Windows drives.[1]

EnterpriseT1572Protocol Tunneling

Industroyer attempts to perform an HTTP CONNECT via an internal proxy to establish a tunnel.[2]

EnterpriseT1016System Network Configuration Discovery

Industroyer’s 61850 payload component enumerates connected network adapters and their corresponding IP addresses.[1]

EnterpriseT1489Service Stop

Industroyer’s data wiper module writes zeros into the registry keys in SYSTEM\CurrentControlSet\Services to render a system inoperable.[2]

EnterpriseT1041Exfiltration Over C2 Channel

Industroyer sends information about hardware profiles and previously-received commands back to the C2 server in a POST-request.[1]

EnterpriseT1071.001Web ProtocolsSub-technique

Industroyer’s main backdoor connected to a remote C2 server using HTTPS.[1]

EnterpriseT1090.003Multi-hop ProxySub-technique

Industroyer used Tor nodes for C2.[2]

EnterpriseT1082System Information Discovery

Industroyer collects the victim machine’s Windows GUID.[2]

EnterpriseT1499.004Application or System ExploitationSub-technique

Industroyer uses a custom DoS tool that leverages CVE-2015-5374 and targets hardcoded IP addresses of Siemens SIPROTEC devices.[1]

EnterpriseT1140Deobfuscate/Decode Files or Information

Industroyer decrypts code to connect to a remote C2 server.[1]

EnterpriseT1012Query Registry

Industroyer has a data wiper component that enumerates keys in the Registry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services.[1]

EnterpriseT1027Obfuscated Files or Information

Industroyer uses heavily obfuscated code in its Windows Notepad backdoor.[1]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0034: Sandworm Team

Sandworm Team is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455.[1][2] This group has been active since at least 2009.[3][4][5][6]

In October 2020, the US indicted six GRU Unit 74455 officers associated with Sandworm Team for the following cyber operations: the 2015 and 2016 attacks against Ukrainian electrical companies and government organizations, the 2017 worldwide NotPetya attack, targeting of the 2017 French presidential campaign, the 2018 Olympic Destroyer attack against the Winter Olympic Games, the 2018 operation against the Organisation for the Prohibition of Chemical Weapons, and attacks against the country of Georgia in 2018 and 2019.[1][2] Some of these were conducted with the assistance of GRU Unit 26165, which is also referred to as APT28.[7]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1543.003: Windows ServiceEnterpriseuses · TechniqueT1485: Data DestructionEnterpriseuses · TechniqueT1046: Network Service DiscoveryEnterpriseuses · TechniqueT1078: Valid AccountsEnterpriseuses · TechniqueT1554: Compromise Host Software BinaryEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1018: Remote System DiscoveryEnterpriseuses · CampaignC0025: 2016 Ukraine Electric Power AttackEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1572: Protocol TunnelingEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1489: Service StopEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · GroupG0034: Sandworm TeamEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1090.003: Multi-hop ProxyEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1499.004: Application or System ExploitationEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1012: Query RegistryEnterpriseuses · TechniqueT1027: Obfuscated Files or InformationEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.2
Created
Modified
Raw hash
30f412bcf692622a...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.2Current bundle30f412bcf692…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    ESET Industroyer

    Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.

    Open source URL
  2. [2]
    Dragos Crashoverride 2017

    Dragos Inc.. (2017, June 13). CRASHOVERRIDE Analysis of the Threat to Electric Grid Operations. Retrieved December 18, 2020.

    Open source URL
  3. [3]
    Dragos Crashoverride 2018

    Joe Slowik. (2018, October 12). Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE. Retrieved December 18, 2020.

    Open source URL
  4. [4]
    Secureworks IRON VIKING

    Secureworks. (2020, May 1). IRON VIKING Threat Profile. Retrieved June 10, 2020.

    Open source URL
  5. [5]
    mandiant_apt44_unearthing_sandworm

    Roncone, G. et al. (n.d.). APT44: Unearthing Sandworm. Retrieved July 11, 2024.

    Open source URL
  6. [6]
    CRASHOVERRIDE

    (Citation: Dragos Crashoverride 2017)

  7. [7]
    CRASHOVERRIDE

    (Citation: Dragos Crashoverride 2017)

  8. [8]
    CRASHOVERRIDE

    (Citation: Dragos Crashoverride 2017)

  9. [9]
    Dragos Crashoverride 2017

    Dragos Inc.. (2017, June 13). CRASHOVERRIDE Analysis of the Threat to Electric Grid Operations. Retrieved December 18, 2020.

    Open source URL
  10. [10]
    Dragos Crashoverride 2017

    Dragos Inc.. (2017, June 13). CRASHOVERRIDE Analysis of the Threat to Electric Grid Operations. Retrieved December 18, 2020.

    Open source URL
  11. [11]
    Dragos Crashoverride 2018

    Joe Slowik. (2018, October 12). Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE. Retrieved December 18, 2020.

    Open source URL
  12. [12]
    Dragos Crashoverride 2018

    Joe Slowik. (2018, October 12). Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE. Retrieved December 18, 2020.

    Open source URL
  13. [13]
    ESET Industroyer

    Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.

    Open source URL
  14. [14]
    ESET Industroyer

    Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.

    Open source URL
  15. [15]
    Win32/Industroyer

    (Citation: ESET Industroyer)

  16. [16]
    Win32/Industroyer

    (Citation: ESET Industroyer)

  17. [17]
    Win32/Industroyer

    (Citation: ESET Industroyer)

  18. [18]
    mitre-attackS0604
    Open source URL
  19. [19]
    mitre-attackS0604
    Open source URL
  20. [20]
    mitre-attackS0604
    Open source URL
  21. [21]
    Dragos Crashoverride 2017

    Dragos Inc.. (2017, June 13). CRASHOVERRIDE Analysis of the Threat to Electric Grid Operations. Retrieved December 18, 2020.

    Open source URL
  22. [22]
    Dragos Crashoverride 2017

    Dragos Inc.. (2017, June 13). CRASHOVERRIDE Analysis of the Threat to Electric Grid Operations. Retrieved December 18, 2020.

    Open source URL
  23. [23]
    Dragos Crashoverride 2017

    Dragos Inc.. (2017, June 13). CRASHOVERRIDE Analysis of the Threat to Electric Grid Operations. Retrieved December 18, 2020.

    Open source URL
  24. [24]
    Dragos Crashoverride 2017

    Dragos Inc.. (2017, June 13). CRASHOVERRIDE Analysis of the Threat to Electric Grid Operations. Retrieved December 18, 2020.

    Open source URL
  25. [25]
    ESET Industroyer

    Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.

    Open source URL
  26. [26]
    ESET Industroyer

    Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.

    Open source URL
  27. [27]
    ESET Industroyer

    Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.

    Open source URL
  28. [28]
    ESET Industroyer

    Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.

    Open source URL
  29. [29]
    ESET Industroyer

    Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.

    Open source URL
  30. [30]
    ESET Industroyer

    Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.

    Open source URL
  31. [31]
    ESET Industroyer

    Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.

    Open source URL
  32. [32]
    ESET Industroyer

    Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.

    Open source URL
  33. [33]
    ESET Industroyer

    Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.

    Open source URL
  34. [34]
    ESET Industroyer

    Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.

    Open source URL
  35. [35]
    Dragos Crashoverride 2018

    Joe Slowik. (2018, October 12). Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE. Retrieved December 18, 2020.

    Open source URL
  36. [36]
    Dragos Crashoverride 2018

    Joe Slowik. (2018, October 12). Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE. Retrieved December 18, 2020.

    Open source URL
  37. [37]
    ESET Industroyer

    Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.

    Open source URL
  38. [38]
    ESET Industroyer

    Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.

    Open source URL
  39. [39]
    ESET Industroyer

    Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.

    Open source URL
  40. [40]
    ESET Industroyer

    Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.

    Open source URL
  41. [41]
    Dragos Crashoverride 2017

    Dragos Inc.. (2017, June 13). CRASHOVERRIDE Analysis of the Threat to Electric Grid Operations. Retrieved December 18, 2020.

    Open source URL
  42. [42]
    Dragos Crashoverride 2017

    Dragos Inc.. (2017, June 13). CRASHOVERRIDE Analysis of the Threat to Electric Grid Operations. Retrieved December 18, 2020.

    Open source URL
  43. [43]
    ESET Industroyer

    Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.

    Open source URL
  44. [44]
    ESET Industroyer

    Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.

    Open source URL
  45. [45]
    Dragos Crashoverride 2017

    Dragos Inc.. (2017, June 13). CRASHOVERRIDE Analysis of the Threat to Electric Grid Operations. Retrieved December 18, 2020.

    Open source URL
  46. [46]
    Dragos Crashoverride 2017

    Dragos Inc.. (2017, June 13). CRASHOVERRIDE Analysis of the Threat to Electric Grid Operations. Retrieved December 18, 2020.

    Open source URL
  47. [47]
    ESET Industroyer

    Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.

    Open source URL
  48. [48]
    ESET Industroyer

    Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.

    Open source URL
  49. [49]
    Dragos Crashoverride 2017

    Dragos Inc.. (2017, June 13). CRASHOVERRIDE Analysis of the Threat to Electric Grid Operations. Retrieved December 18, 2020.

    Open source URL
  50. [50]
    Dragos Crashoverride 2017

    Dragos Inc.. (2017, June 13). CRASHOVERRIDE Analysis of the Threat to Electric Grid Operations. Retrieved December 18, 2020.

    Open source URL
  51. [51]
    Dragos Crashoverride 2018

    Joe Slowik. (2018, October 12). Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE. Retrieved December 18, 2020.

    Open source URL
  52. [52]
    Dragos Crashoverride 2018

    Joe Slowik. (2018, October 12). Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE. Retrieved December 18, 2020.

    Open source URL
  53. [53]
    ESET Industroyer

    Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.

    Open source URL
  54. [54]
    ESET Industroyer

    Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.

    Open source URL
  55. [55]
    Secureworks IRON VIKING

    Secureworks. (2020, May 1). IRON VIKING Threat Profile. Retrieved June 10, 2020.

    Open source URL
  56. [56]
    mandiant_apt44_unearthing_sandworm

    Roncone, G. et al. (n.d.). APT44: Unearthing Sandworm. Retrieved July 11, 2024.

    Open source URL
  57. [57]
    ESET Industroyer

    Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.

    Open source URL
  58. [58]
    ESET Industroyer

    Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.

    Open source URL
  59. [59]
    Dragos Crashoverride 2017

    Dragos Inc.. (2017, June 13). CRASHOVERRIDE Analysis of the Threat to Electric Grid Operations. Retrieved December 18, 2020.

    Open source URL
  60. [60]
    Dragos Crashoverride 2017

    Dragos Inc.. (2017, June 13). CRASHOVERRIDE Analysis of the Threat to Electric Grid Operations. Retrieved December 18, 2020.

    Open source URL
  61. [61]
    Dragos Crashoverride 2017

    Dragos Inc.. (2017, June 13). CRASHOVERRIDE Analysis of the Threat to Electric Grid Operations. Retrieved December 18, 2020.

    Open source URL
  62. [62]
    Dragos Crashoverride 2017

    Dragos Inc.. (2017, June 13). CRASHOVERRIDE Analysis of the Threat to Electric Grid Operations. Retrieved December 18, 2020.

    Open source URL
  63. [63]
    ESET Industroyer

    Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.

    Open source URL
  64. [64]
    ESET Industroyer

    Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.

    Open source URL
  65. [65]
    ESET Industroyer

    Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.

    Open source URL
  66. [66]
    ESET Industroyer

    Anton Cherepanov. (2017, June 12). Win32/Industroyer: A new threat for industrial controls systems. Retrieved December 18, 2020.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use