FrostyGoop’s Zoom-In: A Closer Look into the Malware Artifacts, Behaviors and Network Communications
Unit 42 dissects FrostyGoop OT malware, which sent Modbus TCP commands to disrupt heating for 600+ apartment buildings in Ukraine.
Palo Alto Unit 42 analyzed new FrostyGoop/BUSTLEBERM samples, the ninth known ICS-centric malware, first used against a Ukrainian municipal energy company by sending Modbus TCP commands to ENCO control devices. The attack caused a two-day heating outage affecting over 600 apartment buildings during sub-zero temperatures. The Go-compiled malware accepts Modbus register operations and timing parameters via command-line arguments or a JSON configuration file, uses an obscure open-source Modbus library, and checks the Windows BeingDebugged flag to evade debuggers. Unit 42 telemetry recorded over 1 million Modbus TCP devices exposed to the internet between September and October 2024.
- Ninth known ICS-centric malware, first to use Modbus TCP for disruption
- Caused a two-day heating outage affecting 600+ apartment buildings in Ukraine
- Go-based malware takes Modbus operations via JSON config or command-line args
- New indicators include configuration files, libraries and infection artifacts
- Debugger evasion via Windows BeingDebugged flag check
- Products
- ENCO
- Malware
- FrostyGoop
- Organizations
- Cyber Security Situation Center
- Countries
- Ukraine
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha256 | 2fd9cb69ef30c0d00a61851b2d96350a9be68c7f1f25a31f896082cfbf39559a | Windows executable file for FrostyGoop malware SHA256 hash: 2fd9cb69ef30c0d00a61851b2d96350a9be68c7f1f25a31f896082cfbf39559a File size: 3.4 MB (3,359,232 bytes) File type: PE32+ execut |
| sha256 | 5d2e4fd08f81e3b2eb2f3eaae16eb32ae02e760afc36fa17f4649322f6da53fb | he two FrostyGoop samples have the following SHA256 hashes: 5d2e4fd08f81e3b2eb2f3eaae16eb32ae02e760afc36fa17f4649322f6da53fb a63ba88ad869085f1625729708ba65e87f5b37d7be9153b3db1a1b0e3fe |
| sha256 | a63ba88ad869085f1625729708ba65e87f5b37d7be9153b3db1a1b0e3fed309c | fd08f81e3b2eb2f3eaae16eb32ae02e760afc36fa17f4649322f6da53fb a63ba88ad869085f1625729708ba65e87f5b37d7be9153b3db1a1b0e3fed309c The task_test.json configuration file only has a function c |
From the original article
13 min read at unit42.paloaltonetworks.com
In July 2024, the operational technology (OT)-centric malware FrostyGoop/BUSTLEBERM became publicly known, after attackers used it to disrupt critical infrastructure. The outage occurred after the Cyber Security Situation Center (CSSC), affiliated with the Security Service of Ukraine, disclosed details [PDF] of an attack on a municipal energy company in Ukraine in early 2024.
By Asher Davila, Chris Navarrete · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.