Skip to content

Industroyer

Software · ATTACK:ics:S0604

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:ics:S0604",
  "title": "Industroyer",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0604",
  "snapshot": "ics-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--e401d4fe-f0c9-44f0-98e6-f93487678808",
  "external_id": "S0604",
  "domain": "ics",
  "created": "2021-01-04T20:42:21.997Z",
  "modified": "2026-05-12T15:12:00.739Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "CRASHOVERRIDE"
    },
    {
      "source_name": "Win32/Industroyer"
    },
    {
      "source_name": "ESET Industroyer",
      "url": "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"
    },
    {
      "source_name": "Dragos Crashoverride 2017",
      "url": "https://dragos.com/blog/crashoverride/CrashOverride-01.pdf"
    },
    {
      "source_name": "Dragos Crashoverride 2018",
      "url": "https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf"
    }
  ]
}

Explicit source assertions (27)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:ics:S0604 → uses → ATTACK:ics:T0846

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1c831708-28c2-47ae-a158-39f1f7b73406

ATTACK:ics:S0604 → uses → ATTACK:ics:T1701.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3bd0868c-7124-4a84-9541-d6f95f746dd9

Anton Cherepanov, ESET June 2017

ATTACK:ics:S0604 → uses → ATTACK:ics:T0884

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--433539bf-cb17-4de1-9c0f-e579b041514f

Dragos Inc. June 2017

ATTACK:ics:S0604 → uses → ATTACK:ics:T0814

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--50c20664-75dc-451e-b026-67b1d309e4b5

Anton Cherepanov, ESET June 2017

ATTACK:ics:C0025 → uses → ATTACK:ics:S0604

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--57e8711a-9aae-4a22-94d4-f4c8a3a8f141

ESET Industroyer · Dragos Crashoverride 2018

ATTACK:ics:S0604 → uses → ATTACK:ics:T1691.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--605dcc44-9e1c-42a9-bc0f-5dfa81444022

Anton Cherepanov, ESET June 2017

ATTACK:ics:S0604 → uses → ATTACK:ics:T0888

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--62e818b8-38e6-42ff-9424-9a327332eb2a

ESET Industroyer

ATTACK:ics:S0604 → uses → ATTACK:ics:T0881

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--66f79019-d52c-46a6-b605-c2335d1d3d20

Anton Cherepanov, ESET June 2017

ATTACK:ics:S0604 → uses → ATTACK:ics:T1691.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6ce3bd17-de4c-4ff3-9f7d-ae30efae2b58

Anton Cherepanov, ESET June 2017

ATTACK:ics:S0604 → uses → ATTACK:ics:T0831

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7c3b65e8-e8b7-4c3b-b27b-e216986d8976

Anton Cherepanov, ESET June 2017

ATTACK:ics:S0604 → uses → ATTACK:ics:T1695.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7c7777a0-f96a-414c-b294-e9f0744bf8b8

Anton Cherepanov, ESET June 2017

ATTACK:ics:S0604 → uses → ATTACK:ics:T0801

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--83c29179-4805-403a-acf5-5151c4d2e556

Anton Cherepanov, ESET June 2017

ATTACK:ics:S0604 → uses → ATTACK:ics:T0800

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--83c8c216-7ff7-4bd3-9db4-573469628d95

Joe Slowik August 2019

ATTACK:ics:S0604 → uses → ATTACK:ics:T0840

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--841ec349-0f4c-43fa-89b8-ef3656497fc9

Anton Cherepanov, ESET June 2017

ATTACK:ics:S0604 → uses → ATTACK:ics:T0816

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--87c8ab74-576d-4962-b641-0762d374d1e8

Anton Cherepanov, ESET June 2017

ATTACK:ics:S0604 → uses → ATTACK:ics:T0806

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--966b59c0-8641-432c-84f7-b2a712004d74

Anton Cherepanov, ESET June 2017

ATTACK:ics:S0604 → uses → ATTACK:ics:T0813

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9902691c-aaf2-48a1-b1ca-cd6f652ae1c6

Anton Cherepanov, ESET June 2017

ATTACK:ics:S0604 → uses → ATTACK:ics:T0829

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9d6f9bba-dd79-4cb6-a0f3-1284e58a6236

Anton Cherepanov, ESET June 2017

ATTACK:ics:G0034 → uses → ATTACK:ics:S0604

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9f07c92a-78a0-438a-8cb2-01e2bddaeb42

ESET Industroyer · Dragos Crashoverride 2017 · Dragos Crashoverride 2018 · mandiant_apt44_unearthing_sandworm · Secureworks IRON VIKING

ATTACK:ics:S0604 → uses → ATTACK:ics:T0815

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a04169ed-c16b-466b-80ef-22a11067f475

Anton Cherepanov, ESET June 2017

ATTACK:ics:S0604 → uses → ATTACK:ics:T0809

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a1cbbdb5-30ad-4139-9784-e5a134f8d405

Dragos Inc. June 2017

ATTACK:ics:S0604 → uses → ATTACK:ics:T0827

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a6d8b66d-fc10-404f-b0ae-e8c66506b818

Anton Cherepanov, ESET June 2017

ATTACK:ics:S0604 → uses → ATTACK:ics:T0846.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b217aaf1-0fe7-43cc-85ad-45b252651e2d

Anton Cherepanov, ESET June 2017

ATTACK:ics:S0604 → uses → ATTACK:ics:T1692.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bc51e6c7-6211-4124-874d-4a5aea2efce0

Anton Cherepanov, ESET June 2017

ATTACK:ics:S0604 → uses → ATTACK:ics:T0802

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c4122b58-f1b2-4656-a715-55016700bf75

Anton Cherepanov, ESET June 2017

ATTACK:ics:S0604 → uses → ATTACK:ics:T0832

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ca3c4d4b-cf53-4489-904f-8a220e421aeb

Anton Cherepanov, ESET June 2017

ATTACK:ics:S0604 → uses → ATTACK:ics:T0837

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f347b4fe-d829-427d-851a-fff3393441db

Joe Slowik August 2019

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.