Frosty Goop’s Zoom-In: A Closer Look into the Malware Artifacts, Behaviors and Network Communications
Summary: FrostyGoop/BUSTLEBERM, the ninth reported OT-centric malware and the first to use Modbus TCP to affect power supply, was used in a January 2024 attack on a Ukrainian municipal energy company that caused a two-day heating outage for over 600 apartment buildings in sub-zero temperatures. Unit 42's analysis found new samples, JSON configuration files and a related Go-written tool named go-encrypt.exe, and its telemetry counted 1,088,175 Modbus TCP devices exposed to the internet from Sept. 2 to Oct. 2, 2024, out of 6,211,623 exposed overall.
Key Takeaway: The malware needs only a reachable Modbus TCP device to send commands, and more than a million such devices were exposed to the internet in a single month - the same condition that let attackers drive ENCO controllers into inaccurate measurements and a two-day outage.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026