AiVibeIndustroyer (CrashOverride)
Industroyer, also called CrashOverride, is malware designed to attack electrical substations by speaking grid control protocols directly, and was used in the December 2016 cyberattack that cut power in part of Kyiv, Ukraine.
Industroyer, also known as CrashOverride, is malware designed to attack electrical substations. It was used in the December 2016 cyberattack on Ukraine's power grid, which caused a power outage in part of Kyiv. Publicly analysed in 2017 by ESET and Dragos, it was described as the first known malware framework designed and deployed to attack electric grids, operating equipment by speaking industrial protocols directly rather than relying on attackers manually operating control screens.
Industroyer contained modules for the IEC 60870-5-101, IEC 60870-5-104, IEC 61850 and OPC DA protocols, allowing it to send commands that open circuit breakers and switches, along with a data wiper and a tool to cause denial of service on certain protection relays. Because these protocols are standardised and widely used by utilities, the design could be adapted to other targets. A variant known as Industroyer2 was discovered in an attack on a Ukrainian energy company in 2022.
The case highlights that many legacy utility protocols lack authentication, so any system that can reach a device on the network can usually command it. Defences include strict segmentation of substation networks, monitoring for unusual protocol commands, protecting engineering and SCADA servers, and incident response plans that include manual operation. Security researchers and government agencies have published indicators and detection guidance for the malware.
Key points
- Used in the December 2016 attack on Ukraine's power grid
- Spoke IEC 60870-5-101, IEC 60870-5-104, IEC 61850 and OPC DA directly
- Could open breakers and included a wiper and a relay denial-of-service tool
- A variant, Industroyer2, was found in a 2022 attack on a Ukrainian energy company
Where AiVibe comes in
In AiVibe's AiAmbA AI Factory, the AiAmbA IoT edge layer keeps writes to machines deny-by-default and AI agents only propose changes that a trained operator confirms. AiVibe's security services include vulnerability assessment and penetration testing, and AiVibe is ISO/IEC 27001:2022 certified.
Related terms
- Industrial Protocol SecurityOT & Industrial Cybersecurity
- OT Network MonitoringOT & Industrial Cybersecurity
- OT Incident ResponseOT & Industrial Cybersecurity
- Supervisory Control and Data Acquisition (SCADA)PLC & Industrial Control
- StuxnetOT & Industrial Cybersecurity
- MITRE ATT&CK for ICSOT & Industrial Cybersecurity