A novel malware targeting the popular Modbus industrial communication protocol caused more than 600 apartment buildings in Lviv, Ukraine, to lose heat for two days earlier this year in January. Security researchers have named the malware FrostyGoop and described it as the first malware strain to directly use Modbus TCP communication to disrupt operational technology networks.
Cybersecurity firm Dragos discovered it in April 2024 and published a technical assessment of the malware. The malware isn’t exactly technically sophisticated, but its focus on once-obscure systems, including ones that run critical infrastructure, makes its attacks significant nonetheless.
The malware is written in Go and uses open-source software libraries, but its creator hasn’t been found yet. That said, it can read and write to an ICS (industrial control system) device holding registers containing inputs, outputs and configuration data. it also accepts command line arguments, uses separate configuration files to specify target IP addresses and Modbus commands, and even logs output to a console and/or a JSON file.
Investigation into the attack revealed that the malware infiltrated the victim network as early as ten months on April 17, 2024, via a vulnerability in an external-facing Mikrotik router. Network assets, including a Mikrotik router (the original point of entry for the attackers), four management servers, and the district heating system controllers, were not adequately segmented within the victim network and compromised by the attackers to facilitate their attack.
On April 20 and 26, a web shell with tunnel capabilities was deployed. Eight months later, on November 30 and December 14, the threat actors accessed the contents of the Security Account Manager (SAM) registry, obtaining user credentials from the system. Finally, on January 22, they launched the attack from Moscow-based IP addresses.
FrostyGoop’s ability to communicate with ICS devices over the Modbus protocol means trouble for critical infrastructure across multiple sectors, given the popularity of the Modbus protocol. The attack also points out the need for improved security controls and analytics.
In the News: Two critical flaws in BookingPress plugin allow full site takeover
