Industroyer2 IEC-104 substation hijack

§ Context

Assumed environment: foothold inside an electric utility's OT segment. Substation RTUs reachable over the corporate-grid VPN. No segmentation between the OT control centre and substations.

§ Steps

1. 01
   Foothold in OT control centreInitial Access

   T1078— Valid Accounts
2. 02
   Payload fires at chosen UTC hourExecution

   T1053— Scheduled Task/Job
3. 03
   Discover IEC-104 endpointsDiscovery

   N-NMAP-INTERNAL— Internal Nmap Sweep
4. 04
   Wiper module destroys Windows controllersImpact

   T1485— Data Destruction
5. 05
   Mass 'open breaker' commandsImpact

   OT-ENERGY-IEC104— IEC-104 Substation Control
6. 06
   Deploy timed Industroyer2 payloadImpact

   ICS-INDUSTROYER2— Industroyer2 Timed IEC-104 Sweep

§ References

• T1078Valid Accounts
• T1053Scheduled Task/Job
• T1485Data Destruction

§ Frequently asked

What is the "Industroyer2 IEC-104 substation hijack" attack path?

Timed payload speaks IEC-60870-5-104 to substation RTUs at attacker-chosen hour; sends 'open breaker' commands across a substation, blackouts a grid section. It chains 6 steps drawn from real-world offensive-security techniques.

What starting position does this attack require?

The first step is Foothold in OT control centre (T1078) — a initial access primitive. Assumed environment: foothold inside an electric utility's OT segment.

What is the final impact of this kill-chain?

The final step lands on Deploy timed Industroyer2 payload (ICS-INDUSTROYER2), which falls under Impact. From here, an operator typically pivots into post-exploitation or maintains persistence.

How can defenders detect or prevent this attack?

Detection and prevention vary per step. Refer to each linked MITRE ATT&CK entry under "References" — every technique on that page lists defensive controls, detection telemetry, and known threat-actor usage.

§ Related dossiers

• Shared techniques2

  Trusted updater hijack → wormable destructive payload (NotPetya / M.E.Doc)

  Compromise a niche third-party vendor (regional tax software, niche industry tooling). Push a malicious update; every customer auto-installs it. Payload spreads via SMB + Mimikatz, wipes drives.

• Shared techniques2

  ERC-4337 paymaster sponsor drain

  A paymaster sponsors all UserOperations without per-user gas accounting. Spam tiny UserOps from many bundled addresses — paymaster pays the gas until its deposit hits zero.

• Shared techniques2

  z/OS TN3270 → RACF userID brute → mainframe shell

  Internet-/intranet-exposed TN3270 mainframe terminal. Userids follow predictable HR scheme. Brute-force passwords; many environments allow short / dictionary passwords for legacy reasons.

• Shared techniques2

  Reconfigure MFP LDAP → harvest service-account credentials

  Walk up to / network-into the MFP admin web panel (default creds), change the LDAP address-book server to attacker IP — printer immediately re-binds and sends its service-account creds in cleartext.

• Shared techniques2

  HMI default credentials → operations disruption

  Wonderware / iFix HMI exposed to the corporate network with vendor-default credentials. Operators see attacker-controlled values + commands sent to PLCs through legit channels.

• Shared techniques2

  PMKID attack → offline crack with no client interaction

  WPA2 PMKID can be extracted from a single association attempt with the AP — no client needed. hcxdumptool + hashcat -m 22000 yields the PSK if it's weak.