ESET Industroyer

Industroyer has a data wiper component that enumerates keys in the Registry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services.

Industroyer’s 61850 payload component enumerates connected network adapters and their corresponding IP addresses.

Industroyer can enumerate remote computers in the compromised network.

Industroyer uses heavily obfuscated code in its Windows Notepad backdoor.

During the 2016 Ukraine Electric Power Attack, Sandworm Team used heavily obfuscated code with Industroyer in its Windows Notepad backdoor.

Industroyer sends information about hardware profiles and previously-received commands back to the C2 server in a POST-request.

Industroyer uses a custom port scanner to map out a network.

Industroyer’s main backdoor connected to a remote C2 server using HTTPS.

Industroyer can use supplied user credentials to execute processes and stop services.

Industroyer’s data wiper component enumerates specific files on all the Windows drives.

Industroyer downloads a shellcode payload from a remote C2 server and loads it into memory.

Industroyer decrypts code to connect to a remote C2 server.

Industroyer uses a custom DoS tool that leverages CVE-2015-5374 and targets hardcoded IP addresses of Siemens SIPROTEC devices.

Industroyer has used a Trojanized version of the Windows Notepad application for an additional backdoor persistence mechanism.

During the 2016 Ukraine Electric Power Attack, Sandworm Team used a trojanized version of Windows Notepad to add a layer of persistence for Industroyer.