Dragos · PDF
Dragos-FrostyGoop-ICS-Malware-Intel-Brief-0724_.pdf
Excerpt
I N T E L L I G E N C E B R I E F
Impact of FrostyGoop ICS Malware on
Connected OT Systems
MARK (MAGPIE) GRAHAM | INTEL CAPABILITY TECHNICAL DIRECTOR
CAROLYN AHLERS | PRINCIPAL MALWARE ANALYST
KYLE O’MEARA | PRINCIPAL ADVERSARY HUNTER
DRAGOS, INC
JULY 2024
TA
B
LE
O
F C
O
N
TE
N
TS 01
01
02
Summary
Key Findings
Analyzing the FrostyGoop ICS Malware
What Is the Modbus Protocol?
FrostyGoop ICS Malware Capabilities
Optional Command Line Execution Arguments
Configuration File
Modbus Network Traffic
Logging Capabilities
2024 OT Cyber Attack Impacting Communities in Lviv, Ukraine
Assessing the Broader Impact on OT Cybersecurity
Guidance for Dragos Customers
Recommendations – Implement 5 Critical Controls
Conclusion
07
06
10
07
09
Page | 1 Frost…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Dragos on hub.dragos.com.
More from Dragos2
Dragos · PDF · Added 23 Apr
Dragos-FrostyGoop-ICS-Malware-Intel-Brief-0724_r2.pdf
What Is the Modbus Protocol? FrostyGoop ICS Malware Capabilities Optional Command Line Execution Arguments Configuration File Modbus TCP Network Traffic Logging Capabilities 2024 OT Cyber Attack Impacting Communities in Ukraine Assessing the Broader Impact on…
Dragos · PDF · Added 22 Apr
Dragos_Littleton_Electric_Water_CaseStudy.pdf
The utility’s challenges came to a head when a sophisticated threat group compromised their network to collect data on OT systems, necessitating swift action, expedited implementation of the Dragos Platform, and a rapid response by OT Watch. Dragos worked…
On the same topics
Check Point · Web page · Published 27 Mar
Rhadamanthys: The “Everything Bagel” Infostealer
Rhadamanthys is an advanced infostealer which debuted on the dark web in September of last year to a warm critical reception by cybercriminals. A maximalist approach to features: functionality is added for its own sake, never mind the effort required or…
Check Point · Web page · Published 12 Jan
Going Rogue- a Mastermind behind Android Malware Returns with a New RAT
Research by: Aviran Hazum, Alex Shamshur, Raman Ladutska, Ohad Mana, Israel Wernik Introduction Now more than ever, we rely on our smartphones to keep in touch with our work, our families and the world around us. There are over 3.5 billion smartphone users…
cocomelonc.github.io · Web page · Published 23 Jun
MacOS malware persistence 12: Folder Actions. Simple AppleScript and C example
Hello, cybersecurity enthusiasts and white hackers! Continuing the macOS malware persistence series. In previous parts we already looked at LaunchAgents , shell environment hijacking, dylib hijacking, Login Items, cron , PAM modules, re-opened applications,…
Check Point · Web page · Published 10 Dec
Cracking ValleyRAT: From Builder Secrets to Kernel Rootkits
Check Point Research (CPR) presents a full dissection of the widely used ValleyRAT backdoor, also known as Winos/Winos4.0, covering its modular architecture and plugin system. By analyzing the publicly leaked builder and development structure (Visual Studio…