Industroyer
Software · ATTACK:enterprise:S0604
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0604",
"title": "Industroyer",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0604",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--e401d4fe-f0c9-44f0-98e6-f93487678808",
"external_id": "S0604",
"domain": "enterprise",
"created": "2021-01-04T20:42:21.997Z",
"modified": "2026-05-12T15:12:00.739Z",
"version": "1.2",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "CRASHOVERRIDE"
},
{
"source_name": "Win32/Industroyer"
},
{
"source_name": "ESET Industroyer",
"url": "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"
},
{
"source_name": "Dragos Crashoverride 2017",
"url": "https://dragos.com/blog/crashoverride/CrashOverride-01.pdf"
},
{
"source_name": "Dragos Crashoverride 2018",
"url": "https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf"
}
]
}Explicit source assertions (21)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0604 → uses → ATTACK:enterprise:T1543.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--02af155a-ed26-4807-99c5-f88477a6e143
Dragos Crashoverride 2017ATTACK:enterprise:S0604 → uses → ATTACK:enterprise:T1485
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--16873550-3105-4ce5-92fc-7b8127e47b5d
Dragos Crashoverride 2017ATTACK:enterprise:S0604 → uses → ATTACK:enterprise:T1046
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1d1cc2e5-ef43-4b36-9077-3b173e03d254
ESET IndustroyerATTACK:enterprise:S0604 → uses → ATTACK:enterprise:T1078
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3ce056f2-7ade-4557-86a8-f0ec216730ec
ESET IndustroyerATTACK:enterprise:S0604 → uses → ATTACK:enterprise:T1554
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3f9b76e7-7902-44b1-b589-51f5657fff75
ESET IndustroyerATTACK:enterprise:S0604 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4f90d1a5-4903-46d9-95b2-73bb118f8cb9
ESET IndustroyerATTACK:enterprise:S0604 → uses → ATTACK:enterprise:T1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--50cf1a8b-5ed4-4155-a09d-ed65cf9c4a08
ESET IndustroyerATTACK:enterprise:C0025 → uses → ATTACK:enterprise:S0604
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--57e8711a-9aae-4a22-94d4-f4c8a3a8f141
ESET Industroyer · Dragos Crashoverride 2018ATTACK:enterprise:S0604 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6832f4b5-3f36-4def-9b97-d0228da33964
ESET IndustroyerATTACK:enterprise:S0604 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--69a744c7-a971-4e21-b305-335801c539d1
Dragos Crashoverride 2017ATTACK:enterprise:S0604 → uses → ATTACK:enterprise:T1016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--80e4369d-4799-4aad-918c-ae34fb7ffa17
ESET IndustroyerATTACK:enterprise:S0604 → uses → ATTACK:enterprise:T1489
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--88484d85-3c8e-4ccc-b82b-650c6c9bc825
Dragos Crashoverride 2017ATTACK:enterprise:S0604 → uses → ATTACK:enterprise:T1041
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--987786d7-5f2f-4fdd-b5cb-fddadc9982c8
ESET IndustroyerATTACK:enterprise:G0034 → uses → ATTACK:enterprise:S0604
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9f07c92a-78a0-438a-8cb2-01e2bddaeb42
ESET Industroyer · Dragos Crashoverride 2017 · Dragos Crashoverride 2018 · mandiant_apt44_unearthing_sandworm · Secureworks IRON VIKINGATTACK:enterprise:S0604 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a8e426d7-d4d8-44f4-b2f4-6d552e75908b
ESET IndustroyerATTACK:enterprise:S0604 → uses → ATTACK:enterprise:T1090.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c9fbbab5-c6f1-4aed-bf1f-ea7c83e4d1f2
Dragos Crashoverride 2017ATTACK:enterprise:S0604 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d0592d8b-cb1e-431f-a27e-1412892ca030
Dragos Crashoverride 2017ATTACK:enterprise:S0604 → uses → ATTACK:enterprise:T1499.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--db95e799-2b1b-48bc-b27e-7c7af554250b
ESET IndustroyerATTACK:enterprise:S0604 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f3d0ffd9-5bda-46fd-ba44-ef1b1def9506
ESET IndustroyerATTACK:enterprise:S0604 → uses → ATTACK:enterprise:T1012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f6c9d3c4-2e47-4881-a376-e60791092fc5
ESET IndustroyerATTACK:enterprise:S0604 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fea9df26-2ff4-4fa4-8306-f10af6cdd7cd
ESET Industroyer