ICS-INDUSTROYER2Impact

Industroyer2 Timed IEC-104 Sweep

Time-bombed payload speaks IEC-104 to substation RTUs at a precise hour, opens breakers across an entire grid section.

§ Where this technique fits

ICS-INDUSTROYER2 is catalogued under the Impact tactic of the offensive-security kill-chain. It appears in 1 approved dossier in the registry, typically at step 3 on average.

§ Dossiers chaining this technique

Industroyer2 IEC-104 substation hijack
Timed payload speaks IEC-60870-5-104 to substation RTUs at attacker-chosen hour; sends 'open breaker' commands across a substation, blackouts a grid section.
step 3 / 6

§ What commonly comes next

01
Scheduled Task/Job
T1053 · Execution
seen 1×

§ Where this technique fits

§ Dossiers chaining this technique

Industroyer2 IEC-104 substation hijack

§ What commonly comes next