For two days in mid-January, some citizens of the city of Lviv in Ukraine were forced to live without central heating and endure freezing temperatures due to a cyberattack on a municipal energy company.
On Tuesday, cybersecurity firm Dragos published a report detailing a new malware called FrostyGoop . According to the company, the malware targets industrial control systems. In the January attack, it targeted heating system controllers.
Dragos researchers said in their report that they discovered the malware in April. At that time, Dragos did not have any further information about the malware. Later, Ukrainian authorities informed Dragos that they had found evidence indicating that FrostyGoop was actively used in a cyberattack in Lviv, from the evening of January 22 to January 23.
See also: HATVIBE and CHERRYSPY Malware Targets Ukraine
"And that resulted in the loss of heating in more than 600 apartment buildings for almost 48 hours," said Magpie Graham, a researcher at Dragos.
Researchers Graham, Kyle O'Meara and Carolyn Ahlers said in their report that "recovery from the incident took nearly two days, during which the population was forced to endure sub-zero temperatures."
The FrostyGoop malware is designed to interact with industrial control devices (ICS) via Modbus, an old protocol widely used around the world to control devices in industrial environments. This means that FrostyGoop could be used to target other companies and facilities anywhere.
"There are at least 46,000 Internet-exposed ICS devices that enable Modbus today," Graham told reporters.
See also: Russian accused of cyberattacks in Ukraine
Dragos researchers reported that hackers operating the FrostyGoop malware likely gained access to the targeted municipal energy by exploiting a vulnerability in a Mikrotik router that was exposed to the internet.
Researchers concluded that the hackers likely gained access to the targeted network in April 2023, almost a year before they deployed the malware and disabled heating systems in Ukraine. In the following months, the hackers maintained access to the network.
Graham believes this attack was likely an attempt to undermine the morale of the Ukrainians living there.
Despite the immediate response and recovery efforts, this incident is a reminder of the increasing risks industrial infrastructures face from cyberattacks . The need for continuous assessments and upgrades of security systems is now more urgent than ever. In addition, specific measures must be taken to educate and raise awareness of personnel about the risks of cyberattacks and the use of safe online practices.
See also: Russian hackers target Ukraine with XWorm RAT Malware
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
The attack in Ukraine demonstrates the importance of prevention and being able to deal with such attacks. Continuous monitoring and dissemination of best practices are needed to ensure that infrastructure is secure and prepared for new types of cyberattacks. It is also important to have mechanisms for sharing information and links between different agencies and companies in order to prevent and deal effectively with cyberattacks.
Source: techcrunch.com
