Ukrainian Energy Supplier Targeted by New Industroyer Malware

A Ukrainian energy supplier was focused by a new variant of Industroyer malware named Industroyer2. The discovery was made by researchers from cybersecurity vendor ESET in collaboration with the Ukrainian Laptop Unexpected emergency Response Team (CERT-UA).

The Industroyer malware was believed to have been used by the Sandworm APT group to slash energy in Kiev, Ukraine, back again in 2016.

In the newest incident, ESET claimed that Sandworm, which is connected to the Russian point out security products and services, attempted to deploy the new variation of Industroyer from large-voltage electrical substations in Ukraine, with the objective of triggering ability outages. The scheduled execution of the malware was April 8 2022.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

The scientists added that Sandworm employed numerous other damaging malware in coordination with Industroyer2, which include CaddyWiper, ORCSHRED, SOLOSHRED and AWFULSHRED. The use of CaddyWiper, which was first learned by ESET in March when it was deployed in the network of a Ukrainian financial institution, was made to erase traces of Industroyer2. It is believed the attack experienced been prepared for at minimum two months.

ESET and CERT-UA, who together managed to remediate the attack on the unnamed critical infrastructure network, explained they are continuing to investigate the incident. Currently, there is no information on how the attackers were in a position to compromise the first victim or how they moved from the IT network to the industrial handle program network (ICS).

Even though Industroyer2 shares many properties with the original Industroyer malware, it also has some noteworthy variances. These consist of keeping a comprehensive configuration hardcoded in its entire body, driving the malware steps, whilst Industroyer suppliers configuration in a different .INI file. The scientists stated this new configuration format allows Industroyer2 to converse with many products at at the time.

In this new incident, it is believed the attackers tried to get Industroyer2 to management unique ICS units in purchase to cut energy.

While there have been a incredibly very low amount of cyber-incidents impacting Ukraine’s critical infrastructure considering the fact that the Russian invasion commenced, there seems to be a ramping up of the focusing on of these programs in recent months. “Ukraine is after all over again at the middle of cyberattacks targeting their critical infrastructure. This new Industroyer marketing campaign follows a number of waves of wipers that have been concentrating on different sectors in Ukraine,” wrote the ESET group.

In a assertion, the Condition Company of Exclusive Interaction and Data Security of Ukraine (SSSCIP), the nation’s complex security and intelligence company, explained that experienced the attack succeeded, it would have prompted a “black-out in a vast territory, leaving a massive range of civilians without the need of strength.”

Commenting on the incident Viktor Zhora, deputy head of the SSSCIP, reported: “Unfortunately, a portion of the IT infrastructure had by now been impacted by the time we intervened. So, together with prevention of the malware spreading, our experts were being operating on its restoration so that the consumers would not knowledge any power outages. That is particularly what happened. No indications of electric power outages ended up detected. It’s the result of a timely response of the firm employees and CERT-UA professionals.”

All-around two months ago, Ukraine’s nationwide telecommunications company was struck by a significant cyber-attack, leading to a reduction of connectivity to significant pieces of the state.