Hello, welcome to the Tuesday, June 13th, 2017 edition of the Santernet Storm Center's Stormcast. My name is Johannes Ulrich, and today I'm recording from Washington, D.C.

ESAT and Tragos security released an analysis of malware that was found to disrupt power networks in the Ukraine.

The malware was originally found by ESET, who named it Industroar.

According to ESET, the malware was responsible for power outages in the Ukraine in December last year.

Only a single substation was affected by the attack at the time,

and Tarragos suggests that the attack was more of a proof of concept to test the capabilities

of this Malvern. Unlike prior malware, found to attack industrial control systems, for example, Black Energy 2,

which was responsible for the attacks in the Ukraine in 2015, this new malware is very modular.

It loads specific modules where each module is written to attack a specific industrial system control protocol.

The malware uses HTTP for command and control.

The HTTP requests are sent to a proxy inside the company's network,

and then Tor is used to protect the destination of the requests.

The command and control channel can be used to execute typical commands, like executing commands on the infected systems,

copying files on the infected systems.

However, the malware does not offer a built-in command to exfiltrate data. This could be installed later,

but it also shows how this particular malware focuses on disrupting the system, less on

exfiltrating information. An attacker would initiate an attack against a power company by loading

a configuration file specific to the company's network,

and then the attacker is able to, for example, the energized power lines, essentially turning off power for

part of the network, or initiate what Tregos calls an islanding event. In this scenario, power is cycled quickly multiple

times to trigger the power network's self-protection mechanism and disconnect the system from

the larger power network. According to Traygos, this could lead to multi-day power outages.

...