Industroyer
Industroyer / CrashOverride
Industroyer (CrashOverride)
Industroyer (also CrashOverride) is Industrial Control Systems (ICS) malware that caused a power outage in Kyiv in December 2016, cutting about a fifth of the city off the grid for around an hour. It was modular in design and addressed industrial switching equipment directly via its own protocols. A variant, Industroyer2, was deployed again against Ukraine in 2022.
History & facts. Unlike the preceding, largely manual attack on the Ukrainian grid in 2015, Industroyer in 2016 automated the manipulation of substations — among other routes via the protocol IEC 60870-5-104, widespread in energy technology. In 2022 the group Sandworm (APT) (Sandworm) again tried, with Industroyer2, to shut down Ukrainian high-voltage substations, combined with destructive wiper malware (including CaddyWiper); the attack was thwarted by ESET and CERT-UA. Both versions are attributed to Sandworm.
Outlook & recommendation. Industroyer shows that attackers master the specific Operational Technology (OT) protocols of energy supply and deploy them in a targeted manner. Protection here means: deep visibility at the protocol level (such as detecting anomalous IEC-104 commands), strict separation of IT and OT networks, hardening of remote access and tested restart plans — precisely because wipers are deployed in parallel to complicate recovery. For Critical Infrastructure (KRITIS) operators in the energy sector, this threat picture is directly relevant.