FrostyGoop’s Zoom-In: A Closer Look into the Malware Artifacts, Behaviors and Network Communications

Category	Details
Threat Actors	Russian Threat Actors (suspected based on the attack’s origin).
Campaign Overview	Attack on a Ukrainian municipal energy company using FrostyGoop/BUSTLEBERM malware. Caused a two-day heating outage affecting over 600 apartment buildings.
Target Regions (Victims)	Ukraine, with a focus on critical infrastructure (municipal energy systems).
Methodology	– Malware delivered via a vulnerability in a MikroTik router (or exposed OT devices). – Used Modbus TCP to manipulate ICS/OT devices.
Product Targeted	ENCO control devices, other Modbus TCP devices within critical infrastructure.
Malware Reference	FrostyGoop/BUSTLEBERM (OT-centric malware), associated with Russian threat actors.
Tools Used	– FrostyGoop malware (compiled in Go programming language). – go-encrypt.exe (used for encrypting/decrypting JSON).
Vulnerabilities Exploited	– MikroTik router vulnerability (unconfirmed method). – Exposed Modbus TCP devices accessible over the internet.
TTPs	– Use of Modbus TCP protocol to control ICS/OT devices. – JSON configuration files for targeting specific devices. – Telnet used for management of ENCO devices.
Attribution	Russian threat actors, inferred from malware association and tactics.
Recommendations	– Secure exposed OT devices from the internet. – Implement proper encryption and authentication for ICS communications. – Monitor for anomalous Modbus traffic.
Source	Unit42 by Palo Alto Networks

Read full article : https://unit42.paloaltonetworks.com/frostygoop-malware-analysis/

The above summary has been generated by an AI language model