Industroyer: biggest threat to industrial control systems since Stuxnet

This presentation by Anton Cherepanov and Robert Lipovsky (ESET) was given at VB2017 in Madrid, Spain.
Industroyer is the first ever malware specifically designed to attack power grids. This unique and extremely dangerous malware framework was involved in the December 2016 blackout in Ukraine. What sets Industroyer apart from other malware targeting infrastructure, such as BlackEnergy (a.k.a. SandWorm), is its ability to control switches and circuit breakers directly via four different industrial communication protocols.

Our talk will cover a detailed analysis of Industroyer's malicious payloads that directly interfere with the targeted industrial control systems, as well as supporting modules responsible for command & control communication, persistence, and so on.

In addition to explaining why Industroyer can be considered the biggest threat to industrial control systems since the infamous Stuxnet worm, we will take a look at the 2016 power outage in the context of the other numerous cyber attacks against Ukrainian critical infrastructure in the recent years, some of which were covered in our previous Virus Bulletin talks.

We will also assess the attackers' motivations and what this threat means to utilities around the world. As the protocols and hardware targeted by Industroyer are employed in power supply infrastructure, transportation control systems, and other critical infrastructure systems, like water and gas, worldwide, the malware can be re-purposed to target vital services in other countries. This discovery should serve as a wake-up call for those responsible for the security of these critical systems.