Industroyer
Software · ATTACK:ics:S0604
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:ics:S0604",
"title": "Industroyer",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0604",
"snapshot": "ics-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--e401d4fe-f0c9-44f0-98e6-f93487678808",
"external_id": "S0604",
"domain": "ics",
"created": "2021-01-04T20:42:21.997Z",
"modified": "2026-05-12T15:12:00.739Z",
"version": "1.2",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "CRASHOVERRIDE"
},
{
"source_name": "Win32/Industroyer"
},
{
"source_name": "ESET Industroyer",
"url": "https://www.welivesecurity.com/wp-content/uploads/2017/06/Win32_Industroyer.pdf"
},
{
"source_name": "Dragos Crashoverride 2017",
"url": "https://dragos.com/blog/crashoverride/CrashOverride-01.pdf"
},
{
"source_name": "Dragos Crashoverride 2018",
"url": "https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf"
}
]
}Explicit source assertions (27)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:ics:S0604 → uses → ATTACK:ics:T0846
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1c831708-28c2-47ae-a158-39f1f7b73406
ATTACK:ics:S0604 → uses → ATTACK:ics:T1701.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3bd0868c-7124-4a84-9541-d6f95f746dd9
Anton Cherepanov, ESET June 2017ATTACK:ics:S0604 → uses → ATTACK:ics:T0884
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--433539bf-cb17-4de1-9c0f-e579b041514f
Dragos Inc. June 2017ATTACK:ics:S0604 → uses → ATTACK:ics:T0814
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--50c20664-75dc-451e-b026-67b1d309e4b5
Anton Cherepanov, ESET June 2017ATTACK:ics:C0025 → uses → ATTACK:ics:S0604
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--57e8711a-9aae-4a22-94d4-f4c8a3a8f141
ESET Industroyer · Dragos Crashoverride 2018ATTACK:ics:S0604 → uses → ATTACK:ics:T1691.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--605dcc44-9e1c-42a9-bc0f-5dfa81444022
Anton Cherepanov, ESET June 2017ATTACK:ics:S0604 → uses → ATTACK:ics:T0888
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--62e818b8-38e6-42ff-9424-9a327332eb2a
ESET IndustroyerATTACK:ics:S0604 → uses → ATTACK:ics:T0881
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--66f79019-d52c-46a6-b605-c2335d1d3d20
Anton Cherepanov, ESET June 2017ATTACK:ics:S0604 → uses → ATTACK:ics:T1691.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6ce3bd17-de4c-4ff3-9f7d-ae30efae2b58
Anton Cherepanov, ESET June 2017ATTACK:ics:S0604 → uses → ATTACK:ics:T0831
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7c3b65e8-e8b7-4c3b-b27b-e216986d8976
Anton Cherepanov, ESET June 2017ATTACK:ics:S0604 → uses → ATTACK:ics:T1695.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7c7777a0-f96a-414c-b294-e9f0744bf8b8
Anton Cherepanov, ESET June 2017ATTACK:ics:S0604 → uses → ATTACK:ics:T0801
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--83c29179-4805-403a-acf5-5151c4d2e556
Anton Cherepanov, ESET June 2017ATTACK:ics:S0604 → uses → ATTACK:ics:T0800
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--83c8c216-7ff7-4bd3-9db4-573469628d95
Joe Slowik August 2019ATTACK:ics:S0604 → uses → ATTACK:ics:T0840
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--841ec349-0f4c-43fa-89b8-ef3656497fc9
Anton Cherepanov, ESET June 2017ATTACK:ics:S0604 → uses → ATTACK:ics:T0816
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--87c8ab74-576d-4962-b641-0762d374d1e8
Anton Cherepanov, ESET June 2017ATTACK:ics:S0604 → uses → ATTACK:ics:T0806
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--966b59c0-8641-432c-84f7-b2a712004d74
Anton Cherepanov, ESET June 2017ATTACK:ics:S0604 → uses → ATTACK:ics:T0813
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9902691c-aaf2-48a1-b1ca-cd6f652ae1c6
Anton Cherepanov, ESET June 2017ATTACK:ics:S0604 → uses → ATTACK:ics:T0829
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9d6f9bba-dd79-4cb6-a0f3-1284e58a6236
Anton Cherepanov, ESET June 2017ATTACK:ics:G0034 → uses → ATTACK:ics:S0604
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9f07c92a-78a0-438a-8cb2-01e2bddaeb42
ESET Industroyer · Dragos Crashoverride 2017 · Dragos Crashoverride 2018 · mandiant_apt44_unearthing_sandworm · Secureworks IRON VIKINGATTACK:ics:S0604 → uses → ATTACK:ics:T0815
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a04169ed-c16b-466b-80ef-22a11067f475
Anton Cherepanov, ESET June 2017ATTACK:ics:S0604 → uses → ATTACK:ics:T0809
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a1cbbdb5-30ad-4139-9784-e5a134f8d405
Dragos Inc. June 2017ATTACK:ics:S0604 → uses → ATTACK:ics:T0827
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a6d8b66d-fc10-404f-b0ae-e8c66506b818
Anton Cherepanov, ESET June 2017ATTACK:ics:S0604 → uses → ATTACK:ics:T0846.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b217aaf1-0fe7-43cc-85ad-45b252651e2d
Anton Cherepanov, ESET June 2017ATTACK:ics:S0604 → uses → ATTACK:ics:T1692.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bc51e6c7-6211-4124-874d-4a5aea2efce0
Anton Cherepanov, ESET June 2017ATTACK:ics:S0604 → uses → ATTACK:ics:T0802
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c4122b58-f1b2-4656-a715-55016700bf75
Anton Cherepanov, ESET June 2017ATTACK:ics:S0604 → uses → ATTACK:ics:T0832
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ca3c4d4b-cf53-4489-904f-8a220e421aeb
Anton Cherepanov, ESET June 2017ATTACK:ics:S0604 → uses → ATTACK:ics:T0837
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f347b4fe-d829-427d-851a-fff3393441db
Joe Slowik August 2019