Log in Request a demo

Malware profile

Industroyer

Also known as CRASHOVERRIDE, Win32/Industroyer

Industroyer, also called CrashOverride, is a malware framework built to disrupt industrial control systems, specifically parts used in electrical substations.

In short

Industroyer, also called CrashOverride, is a malware framework built to disrupt industrial control systems, specifically parts used in electrical substations. MITRE ATT&CK says it was used in the attacks on the Ukrainian power grid in December 2016. It is described as the first publicly known malware specifically designed to affect operations in the electric grid.

Last updated 9 October 2026

Profile MapMalware
  1. Names2names in public reportsCRASHOVERRIDE · Win32/Industroyer
  2. Techniques14ATT&CK techniques listedCommand And Control · Persistence · Stealth
  3. Linked Groups1groups that use itSandworm

In one minute

What it is
A Windows malware framework for attacking electrical substations, also known as CrashOverride.
What it does
Uses modules that speak industrial control protocols to operate switches and circuit breakers. It also has a wiper module and a tool that can disable Siemens SIPROTEC protection devices.
Who uses it
Attributed by the US Department of Justice, in an indictment announced 19 October 2020, to officers of GRU Unit 74455 (Sandworm). MITRE also lists Sandworm Team as a user.
How it gets in
Not described in the sources reviewed. CISA calls it a second stage tool, so attackers must already be inside the network. The indictment says the target network was compromised since around April 2016.
What to do first
Run CISA's YARA signature from ICS-ALERT-17-206-01 against backup or test systems, and keep control networks away from the Internet.

What it does

CISA describes Industroyer as a modular platform. It has payloads for several industrial communication protocols, and these payloads can control switches and circuit breakers directly. Other modules wipe data and can deny service to Siemens SIPROTEC devices.

CISA also says it abuses the lack of authentication in common control system protocols to send unauthorized commands to field devices. Its public capabilities focus on protocols used more often outside the United States.

Names

Public sources use several names for this malware.

Names
NameWhere it appears
CRASHOVERRIDEMITRE ATT&CK Associated Software; CISA alerts ICS-ALERT-17-206-01 and TA17-163A; UK government statement[1, 2, 3, 5]
Win32/IndustroyerMITRE ATT&CK Associated Software[1]

What it can do

What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.

Command And Control

  • Application Layer Protocol: Web Protocols T1071.001

    Its main backdoor talks to a remote command server over HTTPS.[1]

  • Ingress Tool Transfer T1105

    It downloads a shellcode payload from a command server and loads it into memory.[1]

  • Proxy: Multi-hop Proxy T1090.003

    It has used Tor nodes to reach its command servers.[1]

  • Protocol Tunneling T1572

    It tries an HTTP CONNECT through an internal proxy to set up a tunnel.[1]

Persistence

  • Compromise Host Software Binary T1554

    It used a trojanized copy of Windows Notepad as an extra backdoor that survives restarts.[1]

  • Create or Modify System Process: Windows Service T1543.003

    It can load at boot through a system service and swaps a service's ImagePath for a new backdoor file.[1]

Stealth

  • Obfuscated Files or Information T1027

    Its Notepad backdoor uses heavily obfuscated code.[1]

Discovery

  • Network Service Discovery T1046

    It maps a network with a custom port scanner.[1]

  • Remote System Discovery T1018

    It can list other computers in the compromised network.[1]

  • System Network Configuration Discovery T1016

    Its 61850 payload lists network adapters and their IP addresses.[1]

Exfiltration

  • Exfiltration Over C2 Channel T1041

    It sends hardware profile data and earlier received commands to its command server in a POST request.[1]

Impact

  • Data Destruction T1485

    Its wiper module clears registry keys and overwrites ICS configuration and Windows files.[1]

  • Service Stop T1489

    Its wiper module writes zeros into service registry keys so the system cannot run.[1]

  • Endpoint Denial of Service: Application or System Exploitation T1499.004

    A custom tool uses CVE-2015-5374 against Siemens SIPROTEC devices at hardcoded IP addresses.[1]

How it spreads

The sources reviewed do not describe how Industroyer first got into a network. CISA says it is a second stage malware that can operate without its first command server, and that stage one infection vectors were not yet known when it wrote its alert. The US indictment says the network of the Ukrainian transmission company had been compromised since around April 2016, months before the December 2016 attack.

Timeline

  1. around April 2016

    Network already compromised

    The US indictment says the Ukrainian transmission company's network had been compromised by the conspirators since in and around April 2016.[4]

  2. December 2016

    Ukraine power grid attack

    MITRE says Industroyer was used in the attacks on the Ukrainian power grid in December 2016, in a campaign it ties to Sandworm Team.[1, 7]

  3. December 17, 2016

    Intrusion at transmission company

    The indictment says the conspirators attacked the company with the malware later named Industroyer, and that power to Kiev was disrupted for about one hour.[4]

  4. July 25, 2017

    CISA alert ICS-ALERT-17-206-01

    CISA published an alert on CRASHOVERRIDE, also known as Industroyer, with a YARA signature for detection.[2]

  5. October 19, 2020

    US charges and UK statement

    The US Department of Justice announced charges against GRU officers, and the UK government listed Industroyer, December 2016, among attacks it ties to GRU unit GTsST.[5, 4]

  6. July 20, 2021

    CISA attribution

    CISA updated alert TA17-163A to say the US Government attributes the activity to Russian nation-state cyber actors.[3]

  7. April 20, 2022

    CISA advisory AA22-110A

    A joint advisory says GTsST actors deployed CrashOverride, also known as Industroyer, in a 2016 intrusion against a Ukrainian electrical transmission company.[6]

Detection and defense

  1. Use CISA's YARA signature

    CISA built a YARA signature to find the malicious files. Try it first in a test or development ICS environment, or on backup systems, because it will not work on most field devices.[2]

  2. Read the official detection resources

    ICS-ALERT-17-206-01 carries the YARA signature. TA17-163A lists indicators of compromise and detection rules. CISA notes that normal detection may miss it before it runs, so it asks for behavioral analysis to spot earlier activity.[2, 3]

  3. Check commands to field devices

    CISA says the malware exploits missing authentication in common ICS protocols. It advises authentication of commands, using ICS firewalls for legacy devices.[3]

  4. Isolate and segment control networks

    CISA advises isolating ICS networks from untrusted networks, especially the Internet, and splitting networks into logical enclaves to limit spread.[3]

  5. Allow only approved programs

    CISA says application whitelisting can detect and prevent execution of malware uploaded by attackers, and suits HMI computers.[3]

  6. Protect accounts

    CISA advises multi-factor authentication where possible and reduced privileges, with separate credentials for corporate and control networks.[3]

    Counters: T1078

  7. Keep backups of control systems

    CISA advises keeping backups of key data, gold images and PLC and RTU configurations, because the wiper leaves systems needing a rebuild or restore.[3]

    Counters: T1485 T1489

Questions

What is Industroyer?

MITRE ATT&CK calls it a malware framework designed to affect the working processes of industrial control systems, specifically components used in electrical substations. It is also known as CrashOverride.

Who is linked to Industroyer?

The US Department of Justice, in an indictment announced 19 October 2020, ties the attack to GRU Unit 74455, tracked as Sandworm. MITRE lists Sandworm Team as a user, and CISA advisory AA22-110A says GTsST actors deployed it.

What happened in December 2016?

The indictment says the malware was used against a Ukrainian electric transmission company on or about 17 December 2016 and disrupted electricity to Kiev for about one hour. The UK says a fifth of Kyiv lost power for an hour.

Is Industroyer the same as CrashOverride?

Yes. CISA writes "CRASHOVERRIDE, aka, Industroyer", and MITRE lists CRASHOVERRIDE as an associated name.

How can I check for it?

CISA published a YARA signature in ICS-ALERT-17-206-01, and indicators and detection rules in TA17-163A. CISA says the signature will not work on most field devices.

In our research

  1. Sandworm (APT44): Russia’s Most Destructive Cyber Weapon November 2025
  2. SandWorm APT Group Cyber Intelligence Report September 2023
  3. Sandworm Threat group
  4. Energy and utilities Industry

Sources

  1. Industroyer, Software S0604 MITRE ATT&CKSupports: Description, names, platform, techniques, December 2016 use and Sandworm Team link.
  2. CRASHOVERRIDE Malware, ICS-ALERT-17-206-01 CISASupports: Modular design, modules, YARA signature and how to use it, revised July 25, 2017.
  3. CrashOverride Malware, TA17-163A CISASupports: Capabilities, detection, mitigations, July 20, 2021 attribution update.
  4. Indictment, United States v. Andrienko et al. (Military Unit 74455) US Department of JusticeSupports: Unit 74455 is Sandworm; December 17, 2016 attack with Industroyer; compromise since April 2016.
  5. UK exposes series of Russian cyber attacks against Olympic and Paralympic Games UK Foreign, Commonwealth and Development Office and NCSCSupports: UK lists Industroyer, December 2016 among attacks by GRU unit GTsST; DOJ charges on 19 October 2020.
  6. Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure, AA22-110A CISA and partner agenciesSupports: GTsST actors deployed CrashOverride (Industroyer) in 2016; initial version April 20, 2022.
  7. 2016 Ukraine Electric Power Attack, Campaign C0025 MITRE ATT&CKSupports: Sandworm Team campaign using Industroyer, December 2016.
  8. Sandworm Team, Group G0034 MITRE ATT&CKSupports: MITRE group page listing Industroyer as software.

Browse the threat library

Keep exploring

Knowledge Hub

Article

SandWorm APT Group Cyber Intelligence Report

Intelligence report on the Sandworm APT group — threat actor profile, historical campaigns, toolset analysis, geopolitical targeting patterns, and defensive

Read more

Industry

Energy and utilities

Exposed network devices, destructive attacks, ransomware and state-backed groups that target energy and utility operators, and the rules that apply.

Read more

Glossary term

MITRE ATT&CK

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

Read more