How to Protect Against Frosty Goop: ICS Malware Targeting Operational Technology
Summary: Dragos discovered FrostyGoop, the ninth known ICS malware, in April 2024; it is written in Golang, compiled for Windows, and talks directly to industrial control systems over Modbus TCP port 502, and most antivirus vendors do not detect it as malicious. Ukraine's Cyber Security Situation Center shared details of a disruptive attack on a district energy company in Lviv in which adversaries sent Modbus commands to ENCO controllers, causing inaccurate measurements and system malfunctions that took almost two days to remediate and left customers without heating for two days; Dragos assesses FrostyGoop was likely used, based in part on a configuration file containing an ENCO device's IP address.
Key Takeaway: The attack worked through an externally facing router and a network where the router, management servers and heating controllers were not adequately segmented - and the malware that carried it out is undetected by most antivirus, so the controls many organizations still lean on would not have flagged it.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026