CrashOverride.pdf

CRASHOVERRIDE is a malware framework designed to attack electric grids, identified by Dragos, Inc. after being notified by ESET on June 8th, 2017. It is the first malware framework specifically designed to attack electric grids and the fourth piece of ICS-tailored malware used against targets. CRASHOVERRIDE is not unique to any particular vendor or configuration, instead leveraging knowledge of grid operations and network communications to cause impact. It is extensible and can be repurposed in Europe, the Middle East, and Asia. The malware was used in a cyber-attack on December 17, 2016, to de-energize a transmission substation in Ukraine, resulting in outages. Dragos assesses with high confidence that the same malware was used in this attack and tracks the adversary group behind CRASHOVERRIDE as ELECTRUM, with direct ties to the Sandworm team.