BackdoorOldrea BackdoorOldrea modular backdoor Dragonfly energy company

BackdoorOldrea BackdoorOldrea modular backdoor Dragonfly energy company window

BackdoorOldrea BackdoorOldrea modular backdoor Dragonfly energy company Windows Havex

BackdoorOldrea modular backdoor Dragonfly energy company Windows Havex

BackdoorOldrea BackdoorOldrea distribute supply chain compromise include specialized module enumerate map icsspecific system process protocol

BackdoorOldrea BackdoorOldrea distribute supply chain compromise include specialized module enumerate map icsspecific system process protocol window

BackdoorOldrea distribute supply chain compromise include specialized module enumerate map icsspecific system process protocol window

BackdoorOldrea BackdoorOldrea distribute supply chain compromise include specialized module enumerate map icsspecific system process protocol Windows Havex

BackdoorOldrea distribute supply chain compromise include specialized module enumerate map icsspecific system process protocol Windows Havex

BackdoorOldrea distribute supply chain compromise include specialized module enumerate map icsspecific system process protocol Havex

BackdoorOldrea Citation Symantec DragonflyCitation Gigamon Berserk Bear October Citation Symantec Dragonfly Sept

BackdoorOldrea Citation Symantec DragonflyCitation Gigamon Berserk Bear October Citation Symantec Dragonfly Sept window

citation Symantec DragonflyCitation Gigamon Berserk Bear October Citation Symantec Dragonfly Sept window

BackdoorOldrea Citation Symantec DragonflyCitation Gigamon Berserk Bear October Citation Symantec Dragonfly Sept Windows Havex

citation Symantec DragonflyCitation Gigamon Berserk Bear October Citation Symantec Dragonfly Sept Windows Havex

citation Symantec DragonflyCitation Gigamon Berserk Bear October Citation Symantec Dragonfly Sept Havex

bad rabbit Bad Rabbit selfpropagate ransomware affect ukrainian transportation sector

bad rabbit Bad Rabbit selfpropagate ransomware affect ukrainian transportation sector window

bad rabbit selfpropagate ransomware affect ukrainian transportation sector window

bad rabbit Bad Rabbit selfpropagate ransomware affect ukrainian transportation sector Windows WinDiskcoderD

bad rabbit selfpropagate ransomware affect ukrainian transportation sector Windows WinDiskcoderD

bad rabbit selfpropagate ransomware affect ukrainian transportation sector WinDiskcoderD

bad rabbit Bad Rabbit target organization consumer Russia Windows

bad rabbit Bad Rabbit target organization consumer Russia Windows WinDiskcoderD

bad Rabbit target organization consumer Russia Windows WinDiskcoderD

bad rabbit citation Secure list Bad RabbitCitation ESET Bad RabbitCitation Dragos ICS Ransomware

bad rabbit citation Secure list Bad RabbitCitation ESET Bad RabbitCitation Dragos ICS Ransomware Windows

citation Secure list Bad RabbitCitation ESET Bad RabbitCitation Dragos ICS Ransomware Windows

bad rabbit citation Secure list Bad RabbitCitation ESET Bad RabbitCitation Dragos ICS Ransomware Windows WinDiskcoderD

citation Secure list Bad RabbitCitation ESET Bad RabbitCitation Dragos ICS Ransomware Windows WinDiskcoderD

citation Secure list Bad RabbitCitation ESET Bad RabbitCitation Dragos ICS Ransomware WinDiskcoderD

BlackEnergy BlackEnergy malware toolkit criminal apt actor Windows

BlackEnergy BlackEnergy malware toolkit criminal apt actor Windows Black Energy

BlackEnergy malware toolkit criminal apt actor Windows Black Energy

BlackEnergy date originally design create botnet use conduct distribute Denial Service DDoS attack use evolve support plugin

BlackEnergy date originally design create botnet use conduct distribute Denial Service DDoS attack use evolve support plugin window

date originally design create botnet use conduct distribute Denial Service DDoS attack use evolve support plugin window

BlackEnergy date originally design create botnet use conduct distribute Denial Service DDoS attack use evolve support plugin Windows Black Energy

date originally design create botnet use conduct distribute Denial Service DDoS attack use evolve support plugin Windows Black Energy

date originally design create botnet use conduct distribute Denial Service DDoS attack use evolve support plugin Black Energy

BlackEnergy know confrontation Georgia Russia target ukrainian institution

BlackEnergy know confrontation Georgia Russia target ukrainian institution window

know confrontation Georgia Russia target ukrainian institution window

BlackEnergy know confrontation Georgia Russia target ukrainian institution Windows Black Energy

know confrontation Georgia Russia target ukrainian institution Windows Black Energy

know confrontation Georgia Russia target ukrainian institution Black Energy

BlackEnergy Variants include BlackEnergy BlackEnergy Windows Black Energy

Conficker Conficker computer worm detect October target Microsoft Windows MS Windows vulnerability spread

Conficker Conficker computer worm detect October target Microsoft Windows MS Windows vulnerability spread Windows

conficker computer worm detect October target Microsoft Windows MS Windows vulnerability spread Windows

Conficker Conficker computer worm detect October target Microsoft Windows MS Windows vulnerability spread Windows Downadup

conficker computer worm detect October target Microsoft Windows MS Windows vulnerability spread Windows Downadup

conficker computer worm detect October target Microsoft Windows MS Windows vulnerability spread Downadup

Conficker Conficker computer worm detect October target Microsoft Windows MS Windows vulnerability spread Windows Kido

conficker computer worm detect October target Microsoft Windows MS Windows vulnerability spread Windows Kido

conficker computer worm detect October target Microsoft Windows MS Windows vulnerability spread Kido

Conficker Citation san Conficker variant Conficker way computer removable disk drive belong nuclear power plant

Conficker Citation san Conficker variant Conficker way computer removable disk drive belong nuclear power plant window

citation san Conficker variant Conficker way computer removable disk drive belong nuclear power plant window

Conficker Citation san Conficker variant Conficker way computer removable disk drive belong nuclear power plant Windows Downadup

citation san Conficker variant Conficker way computer removable disk drive belong nuclear power plant Windows Downadup

citation san Conficker variant Conficker way computer removable disk drive belong nuclear power plant Downadup

Conficker Citation san Conficker variant Conficker way computer removable disk drive belong nuclear power plant Windows Kido

citation san Conficker variant Conficker way computer removable disk drive belong nuclear power plant Windows Kido

citation san Conficker variant Conficker way computer removable disk drive belong nuclear power plant Kido

Conficker Citation Conficker Nuclear Power Plant Windows Downadup

Duqu Duqu malware platform use modular approach extend functionality deployment target network

Duqu Duqu malware platform use modular approach extend functionality deployment target network window

Duqu malware platform use modular approach extend functionality deployment target network window

EKANS EKANS ransomware variant write Golang appear middecember multiple sector include energy healthcare automotive manufacturing case result significant operational disruption

EKANS EKANS ransomware variant write Golang appear middecember multiple sector include energy healthcare automotive manufacturing case result significant operational disruption window

EKANS ransomware variant write Golang appear middecember multiple sector include energy healthcare automotive manufacturing case result significant operational disruption window

EKANS EKANS ransomware variant write Golang appear middecember multiple sector include energy healthcare automotive manufacturing case result significant operational disruption Windows snakehose

EKANS ransomware variant write Golang appear middecember multiple sector include energy healthcare automotive manufacturing case result significant operational disruption Windows snakehose

EKANS ransomware variant write Golang appear middecember multiple sector include energy healthcare automotive manufacturing case result significant operational disruption snakehose

EKANS EKANS hardcode killlist process include associate common ICS software platform eg GE Proficy Honeywell HMIWeb etc similar define MegaCortex

EKANS EKANS hardcode killlist process include associate common ICS software platform eg GE Proficy Honeywell HMIWeb etc similar define MegaCortex Windows

EKANS hardcode killlist process include associate common ICS software platform eg GE Proficy Honeywell HMIWeb etc similar define MegaCortex Windows

EKANS EKANS hardcode killlist process include associate common ICS software platform eg GE Proficy Honeywell HMIWeb etc similar define MegaCortex Windows snakehose

EKANS hardcode killlist process include associate common ICS software platform eg GE Proficy Honeywell HMIWeb etc similar define MegaCortex Windows snakehose

EKANS hardcode killlist process include associate common ICS software platform eg GE Proficy Honeywell HMIWeb etc similar define MegaCortex SNAKEHOSE

EKANS Citation Dragos EKANSCitation Palo Alto Unit EKANS Windows snakehose

citation Dragos EKANSCitation Palo Alto Unit EKANS Windows snakehose

Flame Flame sophisticated toolkit collect information largely target Middle East country

Flame Flame sophisticated toolkit collect information largely target Middle East country Windows

flame sophisticated toolkit collect information largely target Middle East country Windows

Flame Flame sophisticated toolkit collect information largely target Middle East country Windows Flamer

flame sophisticated toolkit collect information largely target Middle East country Windows Flamer

flame sophisticated toolkit collect information largely target Middle East country flamer

Flame Flame sophisticated toolkit collect information largely target Middle East country Windows sKyWIper

flame sophisticated toolkit collect information largely target Middle East country Windows sKyWIper

flame sophisticated toolkit collect information largely target Middle East country sKyWIper

Industroyer Industroyer sophisticated malware framework design cause impact working process Industrial Control Systems ICS specifically component electrical substation

Industroyer Industroyer sophisticated malware framework design cause impact working process Industrial Control Systems ICS specifically component electrical substation window

Industroyer sophisticated malware framework design cause impact working process Industrial Control Systems ICS specifically component electrical substation window

Industroyer Industroyer sophisticated malware framework design cause impact working process Industrial Control Systems ICS specifically component electrical substation Windows CRASHOVERRIDE

Industroyer sophisticated malware framework design cause impact working process Industrial Control Systems ICS specifically component electrical substation Windows CRASHOVERRIDE

Industroyer sophisticated malware framework design cause impact working process Industrial Control Systems ICS specifically component electrical substation CRASHOVERRIDE

Industroyer Industroyer sophisticated malware framework design cause impact working process Industrial Control Systems ICS specifically component electrical substation Windows WinIndustroyer

Industroyer sophisticated malware framework design cause impact working process Industrial Control Systems ICS specifically component electrical substation Windows WinIndustroyer

Industroyer sophisticated malware framework design cause impact working process Industrial Control Systems ICS specifically component electrical substation WinIndustroyer

Industroyer Citation ESET Industroyer Industroyer attack ukrainian power grid December

Industroyer Citation ESET Industroyer Industroyer attack ukrainian power grid December window

citation ESET Industroyer Industroyer attack ukrainian power grid December window

Industroyer Citation ESET Industroyer Industroyer attack ukrainian power grid December Windows CRASHOVERRIDE

citation ESET Industroyer Industroyer attack ukrainian power grid December Windows CRASHOVERRIDE

citation ESET Industroyer Industroyer attack ukrainian power grid December CRASHOVERRIDE

Industroyer Citation ESET Industroyer Industroyer attack ukrainian power grid December Windows WinIndustroyer

citation ESET Industroyer Industroyer attack ukrainian power grid December Windows WinIndustroyer

citation ESET Industroyer Industroyer attack ukrainian power grid December WinIndustroyer

Industroyer Citation Dragos Crashoverride publicly know malware specifically design target impact operation electric grid

Industroyer Citation Dragos Crashoverride publicly know malware specifically design target impact operation electric grid Windows

citation Dragos Crashoverride publicly know malware specifically design target impact operation electric grid Windows

Industroyer Citation Dragos Crashoverride publicly know malware specifically design target impact operation electric grid Windows CRASHOVERRIDE

citation Dragos Crashoverride publicly know malware specifically design target impact operation electric grid Windows CRASHOVERRIDE

citation Dragos Crashoverride publicly know malware specifically design target impact operation electric grid CRASHOVERRIDE

Industroyer Citation Dragos Crashoverride publicly know malware specifically design target impact operation electric grid Windows WinIndustroyer

citation Dragos Crashoverride publicly know malware specifically design target impact operation electric grid Windows WinIndustroyer

citation Dragos Crashoverride publicly know malware specifically design target impact operation electric grid WinIndustroyer

Industroyer Citation Dragos Crashoverride Windows WinIndustroyer

KillDisk KillDisk diskwiping tool design overwrite file random datum render os unbootable

KillDisk KillDisk diskwiping tool design overwrite file random datum render OS unbootable Linux

KillDisk diskwiping tool design overwrite file random datum render OS unbootable Linux

KillDisk KillDisk diskwiping tool design overwrite file random datum render OS unbootable Linux WinKillDiskNBB

KillDisk diskwiping tool design overwrite file random datum render OS unbootable Linux WinKillDiskNBB

KillDisk diskwiping tool design overwrite file random datum render OS unbootable WinKillDiskNBB

KillDisk KillDisk diskwiping tool design overwrite file random datum render OS unbootable Linux WinKillDiskNBC

KillDisk diskwiping tool design overwrite file random datum render OS unbootable Linux WinKillDiskNBC

KillDisk diskwiping tool design overwrite file random datum render OS unbootable WinKillDiskNBC

KillDisk KillDisk diskwiping tool design overwrite file random datum render OS unbootable Linux WinKillDiskNBD

KillDisk diskwiping tool design overwrite file random datum render OS unbootable Linux WinKillDiskNBD

KillDisk diskwiping tool design overwrite file random datum render OS unbootable WinKillDiskNBD

KillDisk KillDisk diskwiping tool design overwrite file random datum render OS unbootable Linux WinKillDiskNBH

KillDisk diskwiping tool design overwrite file random datum render OS unbootable Linux WinKillDiskNBH

KillDisk diskwiping tool design overwrite file random datum render OS unbootable WinKillDiskNBH

KillDisk KillDisk diskwiping tool design overwrite file random datum render OS unbootable Linux WinKillDiskNBI

KillDisk diskwiping tool design overwrite file random datum render OS unbootable Linux WinKillDiskNBI

KillDisk diskwiping tool design overwrite file random datum render OS unbootable WinKillDiskNBI

KillDisk KillDisk diskwiping tool design overwrite file random datum render OS unbootable window

KillDisk diskwiping tool design overwrite file random datum render OS unbootable window

KillDisk KillDisk diskwiping tool design overwrite file random datum render OS unbootable Windows WinKillDiskNBB

KillDisk diskwiping tool design overwrite file random datum render OS unbootable Windows WinKillDiskNBB

KillDisk KillDisk diskwiping tool design overwrite file random datum render OS unbootable Windows WinKillDiskNBC

KillDisk diskwiping tool design overwrite file random datum render OS unbootable Windows WinKillDiskNBC

KillDisk KillDisk diskwiping tool design overwrite file random datum render OS unbootable Windows WinKillDiskNBD

KillDisk diskwiping tool design overwrite file random datum render OS unbootable Windows WinKillDiskNBD

KillDisk KillDisk diskwiping tool design overwrite file random datum render OS unbootable Windows WinKillDiskNBH

KillDisk diskwiping tool design overwrite file random datum render OS unbootable Windows WinKillDiskNBH

KillDisk KillDisk diskwiping tool design overwrite file random datum render OS unbootable Windows WinKillDiskNBI

KillDisk diskwiping tool design overwrite file random datum render OS unbootable Windows WinKillDiskNBI

KillDisk observe component BlackEnergy malware cyber attack Ukraine

KillDisk observe component BlackEnergy malware cyber attack Ukraine Linux

observe component BlackEnergy malware cyber attack Ukraine Linux

KillDisk observe component BlackEnergy malware cyber attack Ukraine Linux WinKillDiskNBB

observe component BlackEnergy malware cyber attack Ukraine Linux WinKillDiskNBB

observe component BlackEnergy malware cyber attack Ukraine WinKillDiskNBB

KillDisk observe component BlackEnergy malware cyber attack Ukraine Linux WinKillDiskNBC

observe component BlackEnergy malware cyber attack Ukraine Linux WinKillDiskNBC

observe component BlackEnergy malware cyber attack Ukraine winkilldisknbc

KillDisk observe component BlackEnergy malware cyber attack Ukraine Linux WinKillDiskNBD

observe component BlackEnergy malware cyber attack Ukraine Linux WinKillDiskNBD

observe component BlackEnergy malware cyber attack Ukraine WinKillDiskNBD

KillDisk observe component BlackEnergy malware cyber attack Ukraine Linux WinKillDiskNBH

observe component BlackEnergy malware cyber attack Ukraine Linux WinKillDiskNBH

observe component BlackEnergy malware cyber attack Ukraine WinKillDiskNBH

KillDisk observe component BlackEnergy malware cyber attack Ukraine Linux WinKillDiskNBI

observe component BlackEnergy malware cyber attack Ukraine Linux WinKillDiskNBI

observe component BlackEnergy malware cyber attack Ukraine WinKillDiskNBI

KillDisk observe component BlackEnergy malware cyber attack Ukraine window

observe component BlackEnergy malware cyber attack Ukraine window

KillDisk observe component BlackEnergy malware cyber attack Ukraine Windows WinKillDiskNBB

observe component BlackEnergy malware cyber attack Ukraine Windows WinKillDiskNBB

KillDisk observe component BlackEnergy malware cyber attack Ukraine Windows WinKillDiskNBC

observe component BlackEnergy malware cyber attack Ukraine Windows WinKillDiskNBC

KillDisk observe component BlackEnergy malware cyber attack Ukraine Windows WinKillDiskNBD

observe component BlackEnergy malware cyber attack Ukraine Windows WinKillDiskNBD

KillDisk observe component BlackEnergy malware cyber attack Ukraine Windows WinKillDiskNBH

observe component BlackEnergy malware cyber attack Ukraine Windows WinKillDiskNBH

KillDisk observe component BlackEnergy malware cyber attack Ukraine Windows WinKillDiskNBI

observe component BlackEnergy malware cyber attack Ukraine Windows WinKillDiskNBI

KillDisk KillDisk evolve standalone malware variety threat actor additional target Europe Latin America ransomware component incorporate KillDisk variant

KillDisk KillDisk evolve standalone malware variety threat actor additional target Europe Latin America ransomware component incorporate KillDisk variant Linux

KillDisk evolve standalone malware variety threat actor additional target Europe Latin America ransomware component incorporate KillDisk variant Linux

KillDisk KillDisk evolve standalone malware variety threat actor additional target Europe Latin America ransomware component incorporate KillDisk variant Linux WinKillDiskNBB

KillDisk evolve standalone malware variety threat actor additional target Europe Latin America ransomware component incorporate KillDisk variant Linux WinKillDiskNBB

KillDisk evolve standalone malware variety threat actor additional target Europe Latin America ransomware component incorporate KillDisk variant WinKillDiskNBB

KillDisk KillDisk evolve standalone malware variety threat actor additional target Europe Latin America ransomware component incorporate KillDisk variant Linux WinKillDiskNBC

KillDisk evolve standalone malware variety threat actor additional target Europe Latin America ransomware component incorporate KillDisk variant Linux WinKillDiskNBC

KillDisk evolve standalone malware variety threat actor additional target Europe Latin America ransomware component incorporate KillDisk variant WinKillDiskNBC

KillDisk KillDisk evolve standalone malware variety threat actor additional target Europe Latin America ransomware component incorporate KillDisk variant Linux WinKillDiskNBD

KillDisk evolve standalone malware variety threat actor additional target Europe Latin America ransomware component incorporate KillDisk variant Linux WinKillDiskNBD

KillDisk evolve standalone malware variety threat actor additional target Europe Latin America ransomware component incorporate KillDisk variant WinKillDiskNBD

KillDisk KillDisk evolve standalone malware variety threat actor additional target Europe Latin America ransomware component incorporate KillDisk variant Linux WinKillDiskNBH

KillDisk evolve standalone malware variety threat actor additional target Europe Latin America ransomware component incorporate KillDisk variant Linux WinKillDiskNBH

KillDisk evolve standalone malware variety threat actor additional target Europe Latin America ransomware component incorporate KillDisk variant WinKillDiskNBH

KillDisk KillDisk evolve standalone malware variety threat actor additional target Europe Latin America ransomware component incorporate KillDisk variant Linux WinKillDiskNBI

KillDisk evolve standalone malware variety threat actor additional target Europe Latin America ransomware component incorporate KillDisk variant Linux WinKillDiskNBI

KillDisk evolve standalone malware variety threat actor additional target Europe Latin America ransomware component incorporate KillDisk variant WinKillDiskNBI

KillDisk KillDisk evolve standalone malware variety threat actor additional target Europe Latin America ransomware component incorporate KillDisk variant window

KillDisk evolve standalone malware variety threat actor additional target Europe Latin America ransomware component incorporate KillDisk variant window

KillDisk KillDisk evolve standalone malware variety threat actor additional target Europe Latin America ransomware component incorporate KillDisk variant Windows WinKillDiskNBB

KillDisk evolve standalone malware variety threat actor additional target Europe Latin America ransomware component incorporate KillDisk variant Windows WinKillDiskNBB

KillDisk KillDisk evolve standalone malware variety threat actor additional target Europe Latin America ransomware component incorporate KillDisk variant Windows WinKillDiskNBC

KillDisk evolve standalone malware variety threat actor additional target Europe Latin America ransomware component incorporate KillDisk variant Windows WinKillDiskNBC

KillDisk KillDisk evolve standalone malware variety threat actor additional target Europe Latin America ransomware component incorporate KillDisk variant Windows WinKillDiskNBD

KillDisk evolve standalone malware variety threat actor additional target Europe Latin America ransomware component incorporate KillDisk variant Windows WinKillDiskNBD

KillDisk KillDisk evolve standalone malware variety threat actor additional target Europe Latin America ransomware component incorporate KillDisk variant Windows WinKillDiskNBH

KillDisk evolve standalone malware variety threat actor additional target Europe Latin America ransomware component incorporate KillDisk variant Windows WinKillDiskNBH

KillDisk KillDisk evolve standalone malware variety threat actor additional target Europe Latin America ransomware component incorporate KillDisk variant Windows WinKillDiskNBI

KillDisk evolve standalone malware variety threat actor additional target Europe Latin America ransomware component incorporate KillDisk variant Windows WinKillDiskNBI

KillDisk Citation KillDisk RansomwareCitation ESEST Black Energy Jan Citation Trend Micro KillDisk Citation Trend Micro KillDisk

KillDisk Citation KillDisk RansomwareCitation ESEST Black Energy Jan Citation Trend Micro KillDisk Citation Trend Micro KillDisk Linux

citation KillDisk RansomwareCitation ESEST Black Energy Jan Citation Trend Micro KillDisk Citation Trend Micro KillDisk Linux

KillDisk Citation KillDisk RansomwareCitation ESEST Black Energy Jan Citation Trend Micro KillDisk Citation Trend Micro KillDisk Linux WinKillDiskNBB

citation KillDisk RansomwareCitation ESEST Black Energy Jan Citation Trend Micro KillDisk Citation Trend Micro KillDisk Linux WinKillDiskNBB

citation KillDisk RansomwareCitation ESEST Black Energy Jan Citation Trend Micro KillDisk Citation Trend Micro KillDisk WinKillDiskNBB

KillDisk Citation KillDisk RansomwareCitation ESEST Black Energy Jan Citation Trend Micro KillDisk Citation Trend Micro KillDisk Linux WinKillDiskNBC

citation KillDisk RansomwareCitation ESEST Black Energy Jan Citation Trend Micro KillDisk Citation Trend Micro KillDisk Linux WinKillDiskNBC

citation KillDisk RansomwareCitation ESEST Black Energy Jan Citation Trend Micro KillDisk Citation Trend Micro KillDisk WinKillDiskNBC

KillDisk Citation KillDisk RansomwareCitation ESEST Black Energy Jan Citation Trend Micro KillDisk Citation Trend Micro KillDisk Linux WinKillDiskNBD

citation KillDisk RansomwareCitation ESEST Black Energy Jan Citation Trend Micro KillDisk Citation Trend Micro KillDisk Linux WinKillDiskNBD

citation KillDisk RansomwareCitation ESEST Black Energy Jan Citation Trend Micro KillDisk Citation Trend Micro KillDisk WinKillDiskNBD

KillDisk Citation KillDisk RansomwareCitation ESEST Black Energy Jan Citation Trend Micro KillDisk Citation Trend Micro KillDisk Linux WinKillDiskNBH

citation KillDisk RansomwareCitation ESEST Black Energy Jan Citation Trend Micro KillDisk Citation Trend Micro KillDisk Linux WinKillDiskNBH

citation KillDisk RansomwareCitation ESEST Black Energy Jan Citation Trend Micro KillDisk Citation Trend Micro KillDisk WinKillDiskNBH

KillDisk Citation KillDisk RansomwareCitation ESEST Black Energy Jan Citation Trend Micro KillDisk Citation Trend Micro KillDisk Linux WinKillDiskNBI

citation KillDisk RansomwareCitation ESEST Black Energy Jan Citation Trend Micro KillDisk Citation Trend Micro KillDisk Linux WinKillDiskNBI

citation KillDisk RansomwareCitation ESEST Black Energy Jan Citation Trend Micro KillDisk Citation Trend Micro KillDisk WinKillDiskNBI

KillDisk Citation KillDisk RansomwareCitation ESEST Black Energy Jan Citation Trend Micro KillDisk Citation Trend Micro KillDisk window

citation KillDisk RansomwareCitation ESEST Black Energy Jan Citation Trend Micro KillDisk Citation Trend Micro KillDisk window

KillDisk Citation KillDisk RansomwareCitation ESEST Black Energy Jan Citation Trend Micro KillDisk Citation Trend Micro KillDisk Windows WinKillDiskNBB

citation KillDisk RansomwareCitation ESEST Black Energy Jan Citation Trend Micro KillDisk Citation Trend Micro KillDisk Windows WinKillDiskNBB

KillDisk Citation KillDisk RansomwareCitation ESEST Black Energy Jan Citation Trend Micro KillDisk Citation Trend Micro KillDisk Windows WinKillDiskNBC

citation KillDisk RansomwareCitation ESEST Black Energy Jan Citation Trend Micro KillDisk Citation Trend Micro KillDisk Windows WinKillDiskNBC

KillDisk Citation KillDisk RansomwareCitation ESEST Black Energy Jan Citation Trend Micro KillDisk Citation Trend Micro KillDisk Windows WinKillDiskNBD

citation KillDisk RansomwareCitation ESEST Black Energy Jan Citation Trend Micro KillDisk Citation Trend Micro KillDisk Windows WinKillDiskNBD

KillDisk Citation KillDisk RansomwareCitation ESEST Black Energy Jan Citation Trend Micro KillDisk Citation Trend Micro KillDisk Windows WinKillDiskNBH

citation KillDisk RansomwareCitation ESEST Black Energy Jan Citation Trend Micro KillDisk Citation Trend Micro KillDisk Windows WinKillDiskNBH

KillDisk Citation KillDisk RansomwareCitation ESEST Black Energy Jan Citation Trend Micro KillDisk Citation Trend Micro KillDisk Windows WinKillDiskNBI

citation KillDisk RansomwareCitation ESEST Black Energy Jan Citation Trend Micro KillDisk Citation Trend Micro KillDisk Windows WinKillDiskNBI

LockerGoga LockerGoga ransomware report January tie attack european company include industrial manufacturing firm

LockerGoga LockerGoga ransomware report January tie attack european company include industrial manufacture firm window

lockergoga ransomware report January tie attack european company include industrial manufacture firm window

LockerGoga Citation Unit LockerGoga Citation CarbonBlack LockerGoga

LockerGoga Citation Unit LockerGoga Citation CarbonBlack LockerGoga Windows

Citation Unit LockerGoga Citation CarbonBlack LockerGoga Windows

NotPetya NotPetya malware Sandworm Team worldwide attack start June

NotPetya NotPetya malware Sandworm Team worldwide attack start June window

NotPetya malware Sandworm Team worldwide attack start June window

NotPetya NotPetya malware Sandworm Team worldwide attack start June Windows DiskcoderC

NotPetya malware Sandworm Team worldwide attack start June Windows DiskcoderC

NotPetya malware Sandworm Team worldwide attack start June DiskcoderC

NotPetya NotPetya malware Sandworm Team worldwide attack start June Windows ExPetr

NotPetya malware Sandworm Team worldwide attack start June Windows ExPetr

NotPetya malware Sandworm Team worldwide attack start June ExPetr

NotPetya NotPetya malware Sandworm Team worldwide attack start June Windows goldeneye

NotPetya malware Sandworm Team worldwide attack start June Windows goldeneye

NotPetya malware Sandworm Team worldwide attack start June goldeneye

NotPetya NotPetya malware Sandworm Team worldwide attack start June Windows Nyetya

NotPetya malware Sandworm Team worldwide attack start June Windows Nyetya

NotPetya malware Sandworm Team worldwide attack start June Nyetya

NotPetya NotPetya malware Sandworm Team worldwide attack start June Windows Petrwrap

NotPetya malware Sandworm Team worldwide attack start June Windows Petrwrap

NotPetya malware Sandworm Team worldwide attack start June Petrwrap

NotPetya NotPetya appear form ransomware main purpose destroy datum disk structure compromise system attacker intend encrypted datum recoverable

NotPetya NotPetya appear form ransomware main purpose destroy datum disk structure compromise system attacker intend encrypted datum recoverable Windows

NotPetya appear form ransomware main purpose destroy datum disk structure compromise system attacker intend encrypted datum recoverable Windows

NotPetya NotPetya appear form ransomware main purpose destroy datum disk structure compromise system attacker intend encrypted datum recoverable Windows DiskcoderC

NotPetya appear form ransomware main purpose destroy datum disk structure compromise system attacker intend encrypted datum recoverable Windows DiskcoderC

NotPetya appear form ransomware main purpose destroy datum disk structure compromise system attacker intend encrypted datum recoverable diskcoderc

NotPetya NotPetya appear form ransomware main purpose destroy datum disk structure compromise system attacker intend encrypted datum recoverable Windows ExPetr

NotPetya appear form ransomware main purpose destroy datum disk structure compromise system attacker intend encrypted datum recoverable Windows ExPetr

NotPetya appear form ransomware main purpose destroy datum disk structure compromise system attacker intend encrypted datum recoverable ExPetr

NotPetya NotPetya appear form ransomware main purpose destroy datum disk structure compromise system attacker intend encrypted datum recoverable Windows goldeneye

NotPetya appear form ransomware main purpose destroy datum disk structure compromise system attacker intend encrypted datum recoverable Windows goldeneye

NotPetya appear form ransomware main purpose destroy datum disk structure compromise system attacker intend encrypted datum recoverable goldeneye

NotPetya NotPetya appear form ransomware main purpose destroy datum disk structure compromise system attacker intend encrypted datum recoverable Windows Nyetya

NotPetya appear form ransomware main purpose destroy datum disk structure compromise system attacker intend encrypted datum recoverable Windows Nyetya

NotPetya appear form ransomware main purpose destroy datum disk structure compromise system attacker intend encrypted datum recoverable Nyetya

NotPetya NotPetya appear form ransomware main purpose destroy datum disk structure compromise system attacker intend encrypted datum recoverable Windows Petrwrap

NotPetya appear form ransomware main purpose destroy datum disk structure compromise system attacker intend encrypted datum recoverable Windows Petrwrap

NotPetya appear form ransomware main purpose destroy datum disk structure compromise system attacker intend encrypted datum recoverable Petrwrap

NotPetya NotPetya appropriately think form wiper malware Windows

NotPetya NotPetya appropriately think form wiper malware Windows DiskcoderC

NotPetya appropriately think form wiper malware Windows DiskcoderC

NotPetya NotPetya appropriately think form wiper malware Windows ExPetr

NotPetya NotPetya appropriately think form wiper malware Windows goldeneye

NotPetya appropriately think form wiper malware Windows goldeneye

NotPetya NotPetya appropriately think form wiper malware Windows Nyetya

NotPetya NotPetya appropriately think form wiper malware Windows Petrwrap

NotPetya appropriately think form wiper malware Windows Petrwrap

NotPetya NotPetya contain wormlike feature spread computer network SMBv exploit EternalBlue EternalRomance

NotPetya NotPetya contain wormlike feature spread computer network SMBv exploit EternalBlue EternalRomance Windows

NotPetya contain wormlike feature spread computer network SMBv exploit EternalBlue EternalRomance Windows

NotPetya NotPetya contain wormlike feature spread computer network SMBv exploit EternalBlue EternalRomance Windows DiskcoderC

NotPetya contain wormlike feature spread computer network SMBv exploit EternalBlue EternalRomance Windows DiskcoderC

NotPetya contain wormlike feature spread computer network SMBv exploit EternalBlue EternalRomance DiskcoderC

NotPetya NotPetya contain wormlike feature spread computer network SMBv exploit EternalBlue EternalRomance Windows ExPetr

NotPetya contain wormlike feature spread computer network SMBv exploit EternalBlue EternalRomance Windows ExPetr

NotPetya contain wormlike feature spread computer network SMBv exploit EternalBlue EternalRomance ExPetr

NotPetya NotPetya contain wormlike feature spread computer network SMBv exploit EternalBlue EternalRomance Windows goldeneye

NotPetya contain wormlike feature spread computer network SMBv exploit EternalBlue EternalRomance Windows goldeneye

NotPetya contain wormlike feature spread computer network SMBv exploit EternalBlue EternalRomance goldeneye

NotPetya NotPetya contain wormlike feature spread computer network SMBv exploit EternalBlue EternalRomance Windows Nyetya

NotPetya contain wormlike feature spread computer network SMBv exploit EternalBlue EternalRomance Windows Nyetya

NotPetya contain wormlike feature spread computer network SMBv exploit EternalBlue EternalRomance Nyetya

NotPetya NotPetya contain wormlike feature spread computer network SMBv exploit EternalBlue EternalRomance Windows Petrwrap

NotPetya contain wormlike feature spread computer network SMBv exploit EternalBlue EternalRomance Windows Petrwrap

NotPetya contain wormlike feature spread computer network SMBv exploit EternalBlue EternalRomance Petrwrap

NotPetya citation Talos Nyetya June Citation USCERT NotPetya Citation ESET Telebots June Citation District Court Indictment GRU Unit October

NotPetya citation Talos Nyetya June Citation USCERT NotPetya Citation ESET Telebots June Citation District Court Indictment GRU Unit October window

citation Talos Nyetya June Citation USCERT NotPetya Citation ESET Telebots June Citation District Court Indictment GRU Unit October window

NotPetya citation Talos Nyetya June Citation USCERT NotPetya Citation ESET Telebots June Citation District Court Indictment GRU Unit October Windows DiskcoderC

citation Talos Nyetya June Citation USCERT NotPetya Citation ESET Telebots June Citation District Court Indictment GRU Unit October Windows DiskcoderC

citation Talos Nyetya June Citation USCERT NotPetya Citation ESET Telebots June Citation District Court Indictment GRU Unit October DiskcoderC

NotPetya citation Talos Nyetya June Citation USCERT NotPetya Citation ESET Telebots June Citation District Court Indictment GRU Unit October Windows ExPetr

citation Talos Nyetya June Citation USCERT NotPetya Citation ESET Telebots June Citation District Court Indictment GRU Unit October Windows ExPetr

citation Talos Nyetya June Citation USCERT NotPetya Citation ESET Telebots June Citation District Court Indictment GRU Unit October ExPetr

NotPetya citation Talos Nyetya June Citation USCERT NotPetya Citation ESET Telebots June Citation District Court Indictment GRU Unit October Windows goldeneye

citation Talos Nyetya June Citation USCERT NotPetya Citation ESET Telebots June Citation District Court Indictment GRU Unit October Windows goldeneye

citation Talos Nyetya June Citation USCERT NotPetya Citation ESET Telebots June Citation District Court Indictment GRU Unit October goldeneye

NotPetya citation Talos Nyetya June Citation USCERT NotPetya Citation ESET Telebots June Citation District Court Indictment GRU Unit October Windows Nyetya

citation Talos Nyetya June Citation USCERT NotPetya Citation ESET Telebots June Citation District Court Indictment GRU Unit October Windows Nyetya

citation Talos Nyetya June Citation USCERT NotPetya Citation ESET Telebots June Citation District Court Indictment GRU Unit October Nyetya

NotPetya citation Talos Nyetya June Citation USCERT NotPetya Citation ESET Telebots June Citation District Court Indictment GRU Unit October Windows Petrwrap

citation Talos Nyetya June Citation USCERT NotPetya Citation ESET Telebots June Citation District Court Indictment GRU Unit October Windows Petrwrap

citation Talos Nyetya June Citation USCERT NotPetya Citation ESET Telebots June Citation District Court Indictment GRU Unit October Petrwrap

PLCBlaster PLCBlaster piece proofofconcept malware run Siemens S PLCs

PLCBlaster worm infect target attempt infect device network worm run module

PLCBlaster Citation Spenneberg Ralf Maik Brggemann Hendrik Schwartke March Citation Spenneberg Ralf

REvil REvil ransomware family link GOLD SOUTHFIELD group operate ransomwareasaservice raas April

REvil REvil ransomware family link GOLD SOUTHFIELD group operate ransomwareasaservice raas April window

revil ransomware family link GOLD SOUTHFIELD group operate ransomwareasaservice raas April window

REvil REvil ransomware family link GOLD SOUTHFIELD group operate ransomwareasaservice raas April Windows Sodin

revil ransomware family link GOLD SOUTHFIELD group operate ransomwareasaservice raas April Windows Sodin

revil ransomware family link GOLD SOUTHFIELD group operate ransomwareasaservice raas April Sodin

REvil REvil ransomware family link GOLD SOUTHFIELD group operate ransomwareasaservice raas April Windows Sodinokibi

revil ransomware family link GOLD SOUTHFIELD group operate ransomwareasaservice raas April Windows Sodinokibi

revil ransomware family link GOLD SOUTHFIELD group operate ransomwareasaservice raas April Sodinokibi

revil revil organization manufacturing transportation electric sector highly configurable share code similarity GandCrab raas

revil revil organization manufacturing transportation electric sector highly configurable share code similarity GandCrab RaaS Windows

revil organization manufacturing transportation electric sector highly configurable share code similarity GandCrab RaaS Windows

revil revil organization manufacturing transportation electric sector highly configurable share code similarity GandCrab raas Windows Sodin

revil organization manufacturing transportation electric sector highly configurable share code similarity GandCrab raas Windows Sodin

revil organization manufacturing transportation electric sector highly configurable share code similarity GandCrab raas Sodin

revil revil organization manufacturing transportation electric sector highly configurable share code similarity GandCrab RaaS Windows Sodinokibi

revil organization manufacturing transportation electric sector highly configurable share code similarity GandCrab RaaS Windows Sodinokibi

revil organization manufacturing transportation electric sector highly configurable share code similarity GandCrab raas Sodinokibi

revil Citation Secureworks REvil September Citation Intel REvil March Citation Group IB Ransomware

revil Citation Secureworks REvil September Citation Intel REvil March Citation Group IB Ransomware window

citation Secureworks REvil September Citation Intel REvil March Citation Group IB Ransomware window

revil Citation Secureworks REvil September Citation Intel REvil March Citation Group IB Ransomware Windows Sodin

citation Secureworks REvil September Citation Intel REvil March Citation Group IB Ransomware Windows Sodin

citation Secureworks REvil September Citation Intel REvil March Citation Group IB Ransomware Sodin

revil Citation Secureworks REvil September Citation Intel REvil March Citation Group IB Ransomware Windows Sodinokibi

citation Secureworks REvil September Citation Intel REvil March Citation Group IB Ransomware Windows Sodinokibi

citation Secureworks REvil September Citation Intel REvil March Citation Group IB Ransomware Sodinokibi

Ryuk Ryuk ransomware design target enterprise environment attack

Ryuk Ryuk ransomware design target enterprise environment attack window

Ryuk ransomware design target enterprise environment attack window

Ryuk Citation CrowdStrike Ryuk January Citation FireEye Ryuk Trickbot January Citation FireEye fin apr

Ryuk Citation CrowdStrike Ryuk January Citation FireEye Ryuk Trickbot January Citation FireEye FIN Apr window

citation CrowdStrike Ryuk January Citation FireEye Ryuk Trickbot January Citation FireEye FIN Apr window

Stuxnet Stuxnet publicly report piece malware specifically target industrial control system device

Stuxnet Stuxnet publicly report piece malware specifically target industrial control system device window

Stuxnet publicly report piece malware specifically target industrial control system device window

Stuxnet Stuxnet publicly report piece malware specifically target industrial control system device Windows wstuxnet

Stuxnet publicly report piece malware specifically target industrial control system device Windows wstuxnet

Stuxnet publicly report piece malware specifically target industrial control system device wstuxnet

Stuxnet Stuxnet large complex piece malware utilize multiple different behavior include multiple zeroday vulnerabilitie sophisticated Windows rootkit network infection routine

Stuxnet Stuxnet large complex piece malware utilize multiple different behavior include multiple zeroday vulnerabilitie sophisticated Windows rootkit network infection routine window

Stuxnet large complex piece malware utilize multiple different behavior include multiple zeroday vulnerabilitie sophisticated Windows rootkit network infection routine window

Stuxnet Stuxnet large complex piece malware utilize multiple different behavior include multiple zeroday vulnerabilitie sophisticated Windows rootkit network infection routine Windows wstuxnet

Stuxnet large complex piece malware utilize multiple different behavior include multiple zeroday vulnerabilitie sophisticated Windows rootkit network infection routine Windows wstuxnet

Stuxnet large complex piece malware utilize multiple different behavior include multiple zeroday vulnerabilitie sophisticated Windows rootkit network infection routine wstuxnet

Stuxnet Citation Symantec W Stuxnet DossierCitation CISA ICS Advisory ICSACitation ESET Stuxnet MicroscopeCitation Langer Stuxnet Stuxnet discover component early November

Stuxnet Citation Symantec W Stuxnet DossierCitation CISA ICS Advisory ICSACitation ESET Stuxnet MicroscopeCitation Langer Stuxnet Stuxnet discover component early November window

citation Symantec W Stuxnet DossierCitation CISA ICS Advisory ICSACitation ESET Stuxnet MicroscopeCitation Langer Stuxnet Stuxnet discover component early November window

Stuxnet Citation Symantec W Stuxnet DossierCitation CISA ICS Advisory ICSACitation ESET Stuxnet MicroscopeCitation Langer Stuxnet Stuxnet discover component early November Windows wstuxnet

citation Symantec W Stuxnet DossierCitation CISA ICS Advisory ICSACitation ESET Stuxnet MicroscopeCitation Langer Stuxnet Stuxnet discover component early November Windows wstuxnet

citation Symantec W Stuxnet DossierCitation CISA ICS Advisory ICSACitation ESET Stuxnet MicroscopeCitation Langer Stuxnet Stuxnet discover component early November wstuxnet

Triton Triton attack framework build interact Triconex Safety Instrumented System SIS controller

Triton Citation Blake Johnson Dan Caban Marina Krotofil Dan Scali Nathan Brubaker Christopher Glyer December citation Dragos December citation DHS CISA February Citation Schneider Electric January citation Julian Gutmanis March Citation Schneider December Citation Jos Wetzels January

VPNFilter VPNFilter multistage modular platform versatile capability support intelligencecollection destructive cyber attack operation

VPNFilter VPNFilter module packet sniffer ps collect traffic pass infected device allow theft website credential monitoring Modbus SCADA protocol

VPNFilter citation William Largent June citation Carl Hurd March

WannaCry WannaCry ransomware see global attack affect country Windows

WannaCry WannaCry ransomware see global attack affect country Windows WCry

WannaCry ransomware see global attack affect country Windows WCry

WannaCry WannaCry ransomware see global attack affect country Windows WanaCry

WannaCry ransomware see global attack affect country Windows WanaCry

WannaCry WannaCry ransomware see global attack affect country Windows WanaCrypt

WannaCry ransomware see global attack affect country Windows WanaCrypt

WannaCry WannaCry ransomware see global attack affect country Windows WanaCryptr

WannaCry ransomware see global attack affect country Windows WanaCryptr

WannaCry contain wormlike feature spread computer network SMBv exploit eternalblue

WannaCry contain wormlike feature spread computer network SMBv exploit EternalBlue Windows

contain wormlike feature spread computer network SMBv exploit EternalBlue Windows

WannaCry contain wormlike feature spread computer network SMBv exploit EternalBlue Windows WCry

contain wormlike feature spread computer network SMBv exploit EternalBlue Windows WCry

contain wormlike feature spread computer network SMBv exploit EternalBlue WCry

WannaCry contain wormlike feature spread computer network SMBv exploit EternalBlue Windows WanaCry

contain wormlike feature spread computer network SMBv exploit EternalBlue Windows WanaCry

contain wormlike feature spread computer network SMBv exploit EternalBlue WanaCry

WannaCry contain wormlike feature spread computer network SMBv exploit EternalBlue Windows WanaCrypt

contain wormlike feature spread computer network SMBv exploit EternalBlue Windows WanaCrypt

contain wormlike feature spread computer network SMBv exploit EternalBlue WanaCrypt

WannaCry contain wormlike feature spread computer network SMBv exploit EternalBlue Windows WanaCryptr

contain wormlike feature spread computer network SMBv exploit EternalBlue Windows WanaCryptr

contain wormlike feature spread computer network SMBv exploit EternalBlue WanaCryptr

WannaCry Citation LogRhythm wannacrycitation USCERT WannaCry Citation Washington Post WannaCry Citation FireEye WannaCry

WannaCry Citation LogRhythm wannacrycitation USCERT WannaCry Citation Washington Post WannaCry Citation FireEye WannaCry window

citation LogRhythm wannacrycitation USCERT WannaCry Citation Washington Post WannaCry Citation FireEye WannaCry window

WannaCry Citation LogRhythm wannacrycitation USCERT WannaCry Citation Washington Post WannaCry Citation FireEye WannaCry Windows WCry

citation LogRhythm wannacrycitation USCERT WannaCry Citation Washington Post WannaCry Citation FireEye WannaCry Windows WCry

citation LogRhythm wannacrycitation USCERT WannaCry Citation Washington Post WannaCry Citation FireEye WannaCry wcry

WannaCry Citation LogRhythm wannacrycitation USCERT WannaCry Citation Washington Post WannaCry Citation FireEye WannaCry Windows WanaCry

citation LogRhythm wannacrycitation USCERT WannaCry Citation Washington Post WannaCry Citation FireEye WannaCry Windows WanaCry

citation LogRhythm wannacrycitation USCERT WannaCry Citation Washington Post WannaCry Citation FireEye WannaCry wanacry

WannaCry Citation LogRhythm wannacrycitation USCERT WannaCry Citation Washington Post WannaCry Citation FireEye WannaCry Windows WanaCrypt

citation LogRhythm wannacrycitation USCERT WannaCry Citation Washington Post WannaCry Citation FireEye WannaCry Windows WanaCrypt

citation LogRhythm wannacrycitation USCERT WannaCry Citation Washington Post WannaCry Citation FireEye WannaCry WanaCrypt

WannaCry Citation LogRhythm wannacrycitation USCERT WannaCry Citation Washington Post WannaCry Citation FireEye WannaCry Windows WanaCryptr

citation LogRhythm wannacrycitation USCERT WannaCry Citation Washington Post WannaCry Citation FireEye WannaCry Windows WanaCryptr

citation LogRhythm wannacrycitation USCERT WannaCry Citation Washington Post WannaCry Citation FireEye WannaCry WanaCryptr

ACADMedreA acadmedrea collect information relate autocad application

datum Information Repositories acadmedrea collect information relate autocad application

acadmedrea datum Information Repositories acadmedrea collect information relate autocad application

acadmedrea worm collect AutoCAD dwg file drawing information repository

datum information repository worm collect AutoCAD dwg file drawing information repository

acadmedrea datum information repository worm collect AutoCAD dwg file drawing information repository

theft Operational Information acadmedrea collect AutoCad file drawing

acadmedrea theft Operational Information acadmedrea collect AutoCad file drawing

theft Operational Information drawing contain operational information

acadmedrea theft Operational Information drawing contain operational information

BackdoorOldrea OPC component BackdoorOldrea gather detail connect device send c attacker analyze

OPC component BackdoorOldrea gather detail connect device send c attacker analyze

Automated Collection OPC component BackdoorOldrea gather detail connect device send c attacker analyze

BackdoorOldrea Automated Collection OPC component BackdoorOldrea gather detail connect device send c attacker analyze

Automated Collection Citation Daavid Hentunen Antti Tikkanen June

BackdoorOldrea Automated Collection Citation Daavid Hentunen Antti Tikkanen June

BackdoorOldrea BackdoorOldrea payload cause multiple common OPC platform intermittently crash

BackdoorOldrea payload cause multiple common OPC platform intermittently crash

denial Service BackdoorOldrea payload cause multiple common OPC platform intermittently crash

BackdoorOldrea Denial Service BackdoorOldrea payload cause multiple common OPC platform intermittently crash

BackdoorOldrea cause denial service effect application reliant OPC communication

cause denial service effect application reliant OPC communication

denial Service cause denial service effect application reliant OPC communication

BackdoorOldrea Denial Service cause denial service effect application reliant OPC communication

BackdoorOldrea BackdoorOldrea payload capability enumerate OPC tag addition generic OPC server information

BackdoorOldrea payload capability enumerate OPC tag addition generic OPC server information

point Tag Identification BackdoorOldrea payload capability enumerate OPC tag addition generic OPC server information

BackdoorOldrea Point Tag Identification BackdoorOldrea payload capability enumerate OPC tag addition generic OPC server information

BackdoorOldrea server datum tag name provide information name function control device

server datum tag name provide information name function control device

point Tag Identification server datum tag name provide information name function control device

BackdoorOldrea Point Tag Identification server datum tag name provide information name function control device

BackdoorOldrea Citation ICSCERT August citation Daavid Hentunen Antti Tikkanen June

citation ICSCERT August citation Daavid Hentunen Antti Tikkanen June

point Tag Identification Citation ICSCERT August citation Daavid Hentunen Antti Tikkanen June

BackdoorOldrea Point Tag Identification Citation ICSCERT August citation Daavid Hentunen Antti Tikkanen June

BackdoorOldrea BackdoorOldrea ICS malware plugin rely Windows networking wnet discover server include OPC server reachable compromise machine network

BackdoorOldrea ICS malware plugin rely Windows networking wnet discover server include OPC server reachable compromise machine network

Remote System Discovery BackdoorOldrea ICS malware plugin rely Windows networking wnet discover server include OPC server reachable compromise machine network

BackdoorOldrea Remote System Discovery BackdoorOldrea ICS malware plugin rely Windows networking wnet discover server include OPC server reachable compromise machine network

BackdoorOldrea Citation Julian Rrushi Hassan Farhangi Clay Howey Kelly Carmichael Joey Dabell December

citation Julian Rrushi Hassan Farhangi Clay Howey Kelly Carmichael Joey Dabell December

Remote System Discovery Citation Julian Rrushi Hassan Farhangi Clay Howey Kelly Carmichael Joey Dabell December

BackdoorOldrea Remote System Discovery Citation Julian Rrushi Hassan Farhangi Clay Howey Kelly Carmichael Joey Dabell December

BackdoorOldrea BackdoorOldrea payload gather server information include clsid server Program ID OPC version vendor information run state group count server bandwidth

BackdoorOldrea payload gather server information include clsid server Program ID OPC version vendor information run state group count server bandwidth

Remote System Information Discovery BackdoorOldrea payload gather server information include clsid server Program ID OPC version vendor information run state group count server bandwidth

BackdoorOldrea Remote System Information Discovery BackdoorOldrea payload gather server information include clsid server Program ID OPC version vendor information run state group count server bandwidth

BackdoorOldrea information help indicate role server control process

Remote System Information Discovery information help indicate role server control process

BackdoorOldrea Remote System Information Discovery information help indicate role server control process

Remote System Information Discovery Citation ICSCERT August citation Daavid Hentunen Antti Tikkanen June

BackdoorOldrea Remote System Information Discovery Citation ICSCERT August citation Daavid Hentunen Antti Tikkanen June

BackdoorOldrea BackdoorOldrea RAT distribute trojanize installer attach email

Spearphishing Attachment BackdoorOldrea RAT distribute trojanize installer attach email

BackdoorOldrea Spearphishing Attachment BackdoorOldrea RAT distribute trojanize installer attach email

Spearphishing Attachment Citation Daavid Hentunen Antti Tikkanen June

BackdoorOldrea Spearphishing Attachment Citation Daavid Hentunen Antti Tikkanen June

BackdoorOldrea BackdoorOldrea RAT distribute trojanize installer plant compromise vendor site

BackdoorOldrea RAT distribute trojanize installer plant compromise vendor site

supply chain compromise BackdoorOldrea RAT distribute trojanize installer plant compromise vendor site

BackdoorOldrea supply chain compromise BackdoorOldrea RAT distribute trojanize installer plant compromise vendor site

supply chain Compromise Citation Daavid Hentunen Antti Tikkanen June

BackdoorOldrea supply chain Compromise Citation Daavid Hentunen Antti Tikkanen June

BackdoorOldrea Execution BackdoorOldrea rely user open trojanize installer attach email

execution BackdoorOldrea rely user open trojanize installer attach email

user Execution Execution BackdoorOldrea rely user open trojanize installer attach email

BackdoorOldrea User Execution Execution BackdoorOldrea rely user open trojanize installer attach email

BackdoorOldrea Citation Daavid Hentunen Antti Tikkanen June Citation Kyle Wilhoit

citation Daavid Hentunen Antti Tikkanen June Citation Kyle Wilhoit

User execution Citation Daavid Hentunen Antti Tikkanen June Citation Kyle Wilhoit

BackdoorOldrea User Execution Citation Daavid Hentunen Antti Tikkanen June Citation Kyle Wilhoit

bad rabbit bad rabbit ransomware spread driveby attack insecure website compromise

bad rabbit ransomware spread driveby attack insecure website compromise

Driveby compromise Bad rabbit ransomware spread driveby attack insecure website compromise

bad rabbit Driveby compromise Bad rabbit ransomware spread driveby attack insecure website compromise

bad rabbit target visit legitimate website malware dropper download threat actor infrastructure

target visit legitimate website malware dropper download threat actor infrastructure

Driveby Compromise target visit legitimate website malware dropper download threat actor infrastructure

bad rabbit Driveby Compromise target visit legitimate website malware dropper download threat actor infrastructure

bad Rabbit Citation Orkhan Mamedov Fedor Sinitsyn Anton Ivanov October

Driveby Compromise Citation Orkhan Mamedov Fedor Sinitsyn Anton Ivanov October

bad Rabbit Driveby Compromise Citation Orkhan Mamedov Fedor Sinitsyn Anton Ivanov October

bad rabbit Bad Rabbit initially infect network mean exploit particularly SMBvtargeting MS vulnerability spread industrial network

bad Rabbit initially infect network mean exploit particularly SMBvtargeting MS vulnerability spread industrial network

exploitation Remote Services Bad Rabbit initially infect network mean exploit particularly SMBvtargeting MS vulnerability spread industrial network

bad Rabbit exploitation Remote Services Bad Rabbit initially infect network mean exploit particularly SMBvtargeting MS vulnerability spread industrial network

bad Rabbit exploitation Remote Services Citation Joe Slowik April

bad rabbit bad rabbit laterally industrial network mean SMB service

Lateral Tool transfer Bad rabbit laterally industrial network mean SMB service

bad Rabbit Lateral Tool transfer Bad rabbit laterally industrial network mean SMB service

bad rabbit transportation organization Ukraine suffer infect Bad Rabbit result computer encrypt accord medium report

transportation organization Ukraine suffer infect Bad Rabbit result computer encrypt accord medium report

loss Productivity Revenue transportation organization Ukraine suffer infect Bad Rabbit result computer encrypt accord medium report

bad rabbit Loss Productivity Revenue transportation organization Ukraine suffer infect Bad Rabbit result computer encrypt accord medium report

bad rabbit Loss Productivity Revenue Citation MarcEtienne MLveill October

bad rabbit User execution Bad Rabbit disguise Adobe Flash installer

bad rabbit User execution file open start lock infected computer

User Execution Citation Orkhan Mamedov Fedor Sinitsyn Anton Ivanov October

bad rabbit User Execution Citation Orkhan Mamedov Fedor Sinitsyn Anton Ivanov October

BlackEnergy Sandworm Team target energy sector organization wide reach email spearphishe campaign

Sandworm Team target energy sector organization wide reach email spearphishe campaign

Spearphishing Attachment Sandworm Team target energy sector organization wide reach email spearphishe campaign

BlackEnergy Spearphishing Attachment Sandworm Team target energy sector organization wide reach email spearphishe campaign

BlackEnergy Adversaries utilize malicious Microsoft Word document attachment

Spearphishing Attachment Adversaries utilize malicious Microsoft Word document attachment

BlackEnergy Spearphishing Attachment Adversaries utilize malicious Microsoft Word document attachment

BlackEnergy Spearphishing Attachment Citation Booz Allen Hamilton

BlackEnergy Sandworm Team use http post request contact external command control server

Sandworm Team use http post request contact external command control server

Standard Application Layer Protocol Sandworm Team use http post request contact external command control server

BlackEnergy Standard Application Layer Protocol Sandworm Team use http post request contact external command control server

Standard Application Layer Protocol Citation Booz Allen Hamilton

BlackEnergy Standard Application Layer Protocol Citation Booz Allen Hamilton

BlackEnergy Sandworm Team utilize valid user administrator credential addition create new administrator account maintain presence

Sandworm Team utilize valid user administrator credential addition create new administrator account maintain presence

Valid Accounts Sandworm Team utilize valid user administrator credential addition create new administrator account maintain presence

BlackEnergy Valid Accounts Sandworm Team utilize valid user administrator credential addition create new administrator account maintain presence

Conficker Conficker infection nuclear power plant force facility temporarily shutdown

Conficker infection nuclear power plant force facility temporarily shutdown

loss availability Conficker infection nuclear power plant force facility temporarily shutdown

conficker loss availability Conficker infection nuclear power plant force facility temporarily shutdown

Conficker Conficker infection nuclear power plant force facility shutdown security procedure involve event staff scan computer system go regular check motion put plant production

Conficker infection nuclear power plant force facility shutdown security procedure involve event staff scan computer system go regular check motion put plant production

loss Productivity Revenue Conficker infection nuclear power plant force facility shutdown security procedure involve event staff scan computer system go regular check motion put plant production

Conficker Loss Productivity Revenue Conficker infection nuclear power plant force facility shutdown security procedure involve event staff scan computer system go regular check motion put plant production

Conficker Loss Productivity Revenue Citation Catalin Cimpanu April

replication Removable Media Conficker exploit Windows drive share

conficker replication Removable Media Conficker exploit Windows drive share

conficker infect computer Conficker automatically copy visible open drive share computer inside network

infect computer Conficker automatically copy visible open drive share computer inside network

replication Removable medium infect computer Conficker automatically copy visible open drive share computer inside network

conficker replication Removable medium infect computer Conficker automatically copy visible open drive share computer inside network

Conficker Citation Symantec June nuclear power plant official suspect bring Conficker accident usb thumb drive home computer find power plant facility

citation Symantec June nuclear power plant official suspect bring Conficker accident usb thumb drive home computer find power plant facility

replication Removable Media Citation Symantec June nuclear power plant official suspect bring Conficker accident usb thumb drive home computer find power plant facility

conficker replication Removable Media Citation Symantec June nuclear power plant official suspect bring Conficker accident usb thumb drive home computer find power plant facility

conficker replication Removable Media Citation Catalin Cimpanu April

Duqu Duqu download additional module collection datum information repository

Duqu download additional module collection datum information repository

datum Information Repositories Duqu download additional module collection datum information repository

Duqu Data Information Repositories Duqu download additional module collection datum information repository

datum information repository module name infostealer infostealer reconnaissance

Duqu Data information repository module name infostealer infostealer reconnaissance

Duqu Duqu purpose gather intelligence datum asset entity industrial infrastructure system manufacturer industrial sector order easily conduct future attack party Citation Symantec

Duqu purpose gather intelligence datum asset entity industrial infrastructure system manufacturer industrial sector order easily conduct future attack party Citation Symantec

theft Operational Information Duqu purpose gather intelligence datum asset entity industrial infrastructure system manufacturer industrial sector order easily conduct future attack party Citation Symantec

Duqu Theft Operational Information Duqu purpose gather intelligence datum asset entity industrial infrastructure system manufacturer industrial sector order easily conduct future attack party Citation Symantec

EKANS EKANS infection result temporary production loss Honda manufacturing plant

EKANS infection result temporary production loss Honda manufacturing plant

loss Productivity Revenue EKANS infection result temporary production loss Honda manufacturing plant

EKANS Loss Productivity Revenue EKANS infection result temporary production loss Honda manufacturing plant

EKANS Masquerading EKANS masquerade valid executable filename updateexe

EKANS valid program use process updateexe perform background software update

valid program use process updateexe perform background software update

masquerade valid program use process updateexe perform background software update

EKANS masquerade valid program use process updateexe perform background software update

EKANS EKANS perform dns lookup internal domain associate target network identify deploy intend system

EKANS perform dns lookup internal domain associate target network identify deploy intend system

Network Connection Enumeration EKANS perform dns lookup internal domain associate target network identify deploy intend system

EKANS Network Connection Enumeration EKANS perform dns lookup internal domain associate target network identify deploy intend system

Network Connection Enumeration Citation Ben Hunter Fred Gutierrez July

EKANS Network Connection Enumeration Citation Ben Hunter Fred Gutierrez July

ekan encrypt process EKANS kill process match process define killlist

encrypt process EKANS kill process match process define killlist

service stop encrypt process EKANS kill process match process define killlist

EKANS Service stop encrypt process EKANS kill process match process define killlist

EKANS Citation Daniel Kapellmann Zafra Keith Lunden Nathan Brubaker Jeremy Kennelly July Citation Daniel Kapellmann Zafra Keith Lunden Nathan Brubaker Jeremy Kennelly July EKANS utilize netsh command implement firewall rule block remote communication device

citation Daniel Kapellmann Zafra Keith Lunden Nathan Brubaker Jeremy Kennelly July Citation Daniel Kapellmann Zafra Keith Lunden Nathan Brubaker Jeremy Kennelly July EKANS utilize netsh command implement firewall rule block remote communication device

service stop Citation Daniel Kapellmann Zafra Keith Lunden Nathan Brubaker Jeremy Kennelly July Citation Daniel Kapellmann Zafra Keith Lunden Nathan Brubaker Jeremy Kennelly July EKANS utilize netsh command implement firewall rule block remote communication device

EKANS Service stop Citation Daniel Kapellmann Zafra Keith Lunden Nathan Brubaker Jeremy Kennelly July Citation Daniel Kapellmann Zafra Keith Lunden Nathan Brubaker Jeremy Kennelly July EKANS utilize netsh command implement firewall rule block remote communication device

Flame Flame builtin module gather information compromise computer

datum information Repositories Flame builtin module gather information compromise computer

Flame Data Information Repositories Flame builtin module gather information compromise computer

datum Information Repositories Citation Kevin Savage Branko Spasojevic

Flame Data Information Repositories Citation Kevin Savage Branko Spasojevic

Flame Flame collect autocad design datum visio diagram document contain operational information

flame collect autocad design datum visio diagram document contain operational information

theft Operational Information Flame collect autocad design datum visio diagram document contain operational information

Flame Theft Operational Information Flame collect autocad design datum visio diagram document contain operational information

theft Operational Information Citation Kevin Savage Branko Spasojevic

Flame Theft Operational Information Citation Kevin Savage Branko Spasojevic

Industroyer Industroyer SPIROTEC DoS module place victim device firmware update mode

Industroyer SPIROTEC DoS module place victim device firmware update mode

activate Firmware Update Mode Industroyer SPIROTEC DoS module place victim device firmware update mode

Industroyer activate Firmware Update Mode Industroyer SPIROTEC DoS module place victim device firmware update mode

Industroyer legitimate use case normal circumstance case adversary prevent SPIROTEC perform design protective function

legitimate use case normal circumstance case adversary prevent SPIROTEC perform design protective function

activate Firmware Update Mode legitimate use case normal circumstance case adversary prevent SPIROTEC perform design protective function

Industroyer activate Firmware Update Mode legitimate use case normal circumstance case adversary prevent SPIROTEC perform design protective function

Industroyer result normal safeguard disabled leave unprotected link electric transmission

result normal safeguard disabled leave unprotected link electric transmission

activate Firmware Update Mode result normal safeguard disabled leave unprotected link electric transmission

Industroyer activate Firmware Update Mode result normal safeguard disabled leave unprotected link electric transmission

Industroyer activate Firmware Update Mode citation Joe Slowik August

Industroyer Industroyer automatically collect protocol object datum learn control device environment

Industroyer automatically collect protocol object datum learn control device environment

Automated Collection Industroyer automatically collect protocol object datum learn control device environment

Industroyer Automated Collection Industroyer automatically collect protocol object datum learn control device environment

Industroyer Automated Collection Citation Anton Cherepanov ESET June

Industroyer Industroyer com port configuration file actual communication com port open prevent process access

Industroyer com port configuration file actual communication com port open prevent process access

Block Command message Industroyer com port configuration file actual communication com port open prevent process access

Industroyer Block Command message Industroyer com port configuration file actual communication com port open prevent process access

Industroyer IEC payload component able maintain control rtu device

Block Command Message IEC payload component able maintain control rtu device

Industroyer Block Command Message IEC payload component able maintain control rtu device

Industroyer Block Command Message Citation Anton Cherepanov ESET June

Industroyer Industroyer use com port configuration file communication com port open prevent process access

Industroyer use com port configuration file communication com port open prevent process access

block report Message Industroyer use com port configuration file communication com port open prevent process access

Industroyer Block report Message Industroyer use com port configuration file communication com port open prevent process access

block report message block process operator get report message device

Industroyer Block report message block process operator get report message device

Industroyer Block report Message Citation Anton Cherepanov ESET June

block Serial COM Industroyer com port configuration file actual communication com port open prevent process access

Industroyer Block Serial COM Industroyer com port configuration file actual communication com port open prevent process access

block Serial COM IEC payload component able maintain control rtu device

Industroyer Block Serial COM IEC payload component able maintain control rtu device

Industroyer Block Serial COM Citation Anton Cherepanov ESET June

Industroyer Industroyer iec module mode available perform attack

Brute Force IO Industroyer iec module mode available perform attack

Industroyer Brute Force IO Industroyer iec module mode available perform attack

Industroyer stage range mode gather information object address IOA send select execute packet switch state

stage range mode gather information object address IOA send select execute packet switch state

Brute Force IO stage range mode gather information object address IOA send select execute packet switch state

Industroyer Brute Force IO stage range mode gather information object address IOA send select execute packet switch state

Industroyer second stage range mode infinite loop switch state previously discover IOAs

second stage range mode infinite loop switch state previously discover IOAs

Brute Force IO second stage range mode infinite loop switch state previously discover IOAs

Industroyer Brute Force IO second stage range mode infinite loop switch state previously discover IOAs

Industroyer shift mode similar range mode instead stay range add shift value default range value

shift mode similar range mode instead stay range add shift value default range value

Brute Force IO Shift mode similar range mode instead stay range add shift value default range value

Industroyer Brute Force IO Shift mode similar range mode instead stay range add shift value default range value

Industroyer industroyer payload DLL supply attacker command line parameter supply main backdoor execute shell command command

industroyer payload DLL supply attacker command line parameter supply main backdoor execute shell command command

CommandLine interface industroyer payload DLL supply attacker command line parameter supply main backdoor execute shell command command

Industroyer CommandLine interface industroyer payload DLL supply attacker command line parameter supply main backdoor execute shell command command

Industroyer CommandLine Interface Citation Anton Cherepanov ESET June

Industroyer Industroyer attempt connect hardcoded internal proxy TCP default Squid proxy

industroyer attempt connect hardcoded internal proxy TCP default Squid proxy

connection proxy Industroyer attempt connect hardcoded internal proxy TCP default Squid proxy

Industroyer Connection proxy Industroyer attempt connect hardcoded internal proxy TCP default Squid proxy

Industroyer establish backdoor attempt reach external c server internal proxy

establish backdoor attempt reach external c server internal proxy

connection proxy establish backdoor attempt reach external c server internal proxy

Industroyer Connection proxy establish backdoor attempt reach external c server internal proxy

Industroyer Industroyer destructive wiper overwrite ICS configuration file hard drive map network drive specifically target ABB PCM configuration file

Industroyer destructive wiper overwrite ICS configuration file hard drive map network drive specifically target ABB PCM configuration file

data destruction Industroyer destructive wiper overwrite ICS configuration file hard drive map network drive specifically target ABB PCM configuration file

Industroyer Data destruction Industroyer destructive wiper overwrite ICS configuration file hard drive map network drive specifically target ABB PCM configuration file

Industroyer Industroyer able block serial com channel temporarily cause denial control

Industroyer able block serial com channel temporarily cause denial control

denial Control Industroyer able block serial com channel temporarily cause denial control

industroyer Denial Control Industroyer able block serial com channel temporarily cause denial control

Industroyer industroyer siprotec dos module exploit CVE vulnerability order render Siemens siprotec device unresponsive

Industroyer siprotec dos module exploit CVE vulnerability order render Siemens siprotec device unresponsive

denial Service Industroyer siprotec dos module exploit CVE vulnerability order render Siemens siprotec device unresponsive

industroyer Denial Service Industroyer siprotec dos module exploit CVE vulnerability order render Siemens siprotec device unresponsive

Industroyer vulnerability successfully exploit target device stop respond command reboot manually

vulnerability successfully exploit target device stop respond command reboot manually

denial Service vulnerability successfully exploit target device stop respond command reboot manually

industroyer Denial Service vulnerability successfully exploit target device stop respond command reboot manually

Industroyer Citation Anton Cherepanov ESET June tool execute send specifically craft packet port target ip address UDP

citation Anton Cherepanov ESET June tool execute send specifically craft packet port target ip address UDP

denial Service Citation Anton Cherepanov ESET June tool execute send specifically craft packet port target ip address UDP

industroyer Denial Service Citation Anton Cherepanov ESET June tool execute send specifically craft packet port target ip address UDP

industroyer Denial Service UDP packet contain follow byte payload x e

Industroyer Industroyer able block serial com channel temporarily cause denial view

Industroyer able block serial com channel temporarily cause denial view

denial View Industroyer able block serial com channel temporarily cause denial view

industroyer Denial View Industroyer able block serial com channel temporarily cause denial view

device RestartShutdown Industroyer siprotec dos module exploit CVE vulnerability order render Siemens siprotec device unresponsive

Industroyer Device RestartShutdown Industroyer siprotec dos module exploit CVE vulnerability order render Siemens siprotec device unresponsive

Industroyer vulnerability directly cause restart shutdown device device restart manually resume operation

vulnerability directly cause restart shutdown device device restart manually resume operation

device RestartShutdown vulnerability directly cause restart shutdown device device restart manually resume operation

Industroyer Device RestartShutdown vulnerability directly cause restart shutdown device device restart manually resume operation

Industroyer Device RestartShutdown Citation Anton Cherepanov ESET June

Industroyer Industroyer datum wiper component remove registry image path system overwrite file render system unusable

industroyer datum wiper component remove registry image path system overwrite file render system unusable

loss Control Industroyer datum wiper component remove registry image path system overwrite file render system unusable

Industroyer Loss Control Industroyer datum wiper component remove registry image path system overwrite file render system unusable

Industroyer Industroyer contain module leverage vulnerability Siemens SIPROTEC relay CVE create denial Service automate protective relay

Industroyer contain module leverage vulnerability Siemens SIPROTEC relay CVE create denial Service automate protective relay

loss Protection Industroyer contain module leverage vulnerability Siemens SIPROTEC relay CVE create denial Service automate protective relay

Industroyer Loss Protection Industroyer contain module leverage vulnerability Siemens SIPROTEC relay CVE create denial Service automate protective relay

loss View Industroyer datum wiper component remove registry image path system overwrite file render system unusable

Industroyer Loss View Industroyer datum wiper component remove registry image path system overwrite file render system unusable

Industroyer Industroyer toggle breaker open state utilize unauthorized command message

industroyer toggle breaker open state utilize unauthorized command message

manipulation Control Industroyer toggle breaker open state utilize unauthorized command message

Industroyer Manipulation Control Industroyer toggle breaker open state utilize unauthorized command message

Industroyer Manipulation Control Citation Anton Cherepanov ESET June

Industroyer Industroyer OPC module brute force value send x status target system equate Primary Variable limit misdirect operator understand protective relay status

Industroyer OPC module brute force value send x status target system equate Primary Variable limit misdirect operator understand protective relay status

manipulation View Industroyer OPC module brute force value send x status target system equate Primary Variable limit misdirect operator understand protective relay status

Industroyer Manipulation View Industroyer OPC module brute force value send x status target system equate Primary Variable limit misdirect operator understand protective relay status

Industroyer Manipulation View Citation Anton Cherepanov ESET June

Industroyer Industroyer OPC IEC protocol module include ability send stval request read status operational variable

Industroyer OPC IEC protocol module include ability send stval request read status operational variable

monitor Process State industroyer OPC IEC protocol module include ability send stval request read status operational variable

Industroyer Monitor Process State industroyer OPC IEC protocol module include ability send stval request read status operational variable

Industroyer Monitor Process State Citation Anton Cherepanov ESET June

Industroyer Industroyer contain iec module enumerate connected network adapter determine TCPIP subnet mask

Industroyer contain iec module enumerate connected network adapter determine TCPIP subnet mask

Network Connection Enumeration Industroyer contain iec module enumerate connected network adapter determine TCPIP subnet mask

Industroyer Network Connection Enumeration Industroyer contain iec module enumerate connected network adapter determine TCPIP subnet mask

Network Connection Enumeration Citation Anton Cherepanov ESET June

Industroyer Network Connection Enumeration Citation Anton Cherepanov ESET June

Industroyer Industroyer IEC payload component ability discover relevant device infected host network subnet attempt connect port

Industroyer IEC payload component ability discover relevant device infected host network subnet attempt connect port

Remote System Discovery Industroyer IEC payload component ability discover relevant device infected host network subnet attempt connect port

Industroyer Remote System Discovery Industroyer IEC payload component ability discover relevant device infected host network subnet attempt connect port

Industroyer Remote System Discovery Citation Anton Cherepanov ESET June

Industroyer Industroyer iec module include range mode discover Information object Addresses IOAs enumerate

Industroyer iec module include range mode discover Information object Addresses IOAs enumerate

Remote System Information Discovery Industroyer IEC module include range mode discover Information object Addresses IOAs enumerate

Industroyer Remote System Information Discovery Industroyer IEC module include range mode discover Information object Addresses IOAs enumerate

Remote System Information Discovery Citation Anton Cherepanov ESET June

Industroyer Remote System Information Discovery Citation Anton Cherepanov ESET June

Industroyer Industroyer OPC da module use iopcbrowseserveraddressspace look item follow string ctlSelOn ctlOperOn ctlSelOff ctlOperOff Pos stval

Industroyer OPC DA module use iopcbrowseserveraddressspace look item follow string ctlSelOn ctlOperOn ctlSelOff ctlOperOff Pos stval

Remote System Information Discovery Industroyer OPC da module use iopcbrowseserveraddressspace look item follow string ctlSelOn ctlOperOn ctlSelOff ctlOperOff Pos stval

Industroyer Remote System Information Discovery Industroyer OPC da module use iopcbrowseserveraddressspace look item follow string ctlSelOn ctlOperOn ctlSelOff ctlOperOff Pos stval

Industroyer Industroyer componentsend domainspecific MMSgetNameListrequest determine logical node device support

Industroyer componentsend domainspecific MMSgetNameListrequest determine logical node device support

Remote System Information Discovery Industroyer componentsend domainspecific MMSgetNameListrequest determine logical node device support

Industroyer Remote System Information Discovery Industroyer componentsend domainspecific MMSgetNameListrequest determine logical node device support

Industroyer search logical node CSW value indicate device perform circuit breaker switch control function

search logical node CSW value indicate device perform circuit breaker switch control function

Remote System Information Discovery search logical node CSW value indicate device perform circuit breaker switch control function

Industroyer Remote System Information Discovery search logical node CSW value indicate device perform circuit breaker switch control function

Industroyer Industroyer capability stop service login user stop service user

Industroyer capability stop service login user stop service user

service stop Industroyer capability stop service login user stop service user

Industroyer Service stop Industroyer capability stop service login user stop service user

Industroyer protocol payload Industroyer send unauthorized command rtu change state equipment

protocol payload Industroyer send unauthorized command rtu change state equipment

Unauthorized Command Message protocol payload Industroyer send unauthorized command rtu change state equipment

Industroyer Unauthorized Command Message protocol payload Industroyer send unauthorized command rtu change state equipment

Unauthorized Command Message Citation Anton Cherepanov ESET June

Industroyer Unauthorized Command Message Citation Anton Cherepanov ESET June

KillDisk KillDisk able delete system file system unbootable target different type file deletion

KillDisk able delete system file system unbootable target different type file deletion

data destruction KillDisk able delete system file system unbootable target different type file deletion

KillDisk Data Destruction KillDisk able delete system file system unbootable target different type file deletion

KillDisk KillDisk delete application security setup system event log Windows system

KillDisk delete application security setup system event log Windows system

Indicator Removal Host KillDisk delete application security setup system event log Windows system

KillDisk Indicator Removal Host KillDisk delete application security setup system event log Windows system

KillDisk KillDisk erase master boot record MBR system log leave system unusable

KillDisk erase master boot record MBR system log leave system unusable

loss View KillDisk erase master boot record MBR system log leave system unusable

KillDisk Loss View KillDisk erase master boot record MBR system log leave system unusable

KillDisk KillDisk look terminate nonstandard process ICS application

service stop KillDisk look terminate nonstandard process ICS application

KillDisk Service stop KillDisk look terminate nonstandard process ICS application

lockergoga Norsk Hydros production system impact lockergoga infection

loss Control Norsk Hydros production system impact lockergoga infection

lockergoga Loss Control Norsk Hydros production system impact lockergoga infection

LockerGoga result loss control force company switch manual operation

loss Control result loss control force company switch manual operation

lockergoga Loss Control result loss control force company switch manual operation

lockergoga Norsk Hydro attempt recover lockergoga infection manufacturing location switch manual nonit drive operation

Norsk Hydro attempt recover lockergoga infection manufacturing location switch manual nonit drive operation

loss Productivity Revenue Norsk Hydro attempt recover lockergoga infection manufacturing location switch manual nonit drive operation

lockergoga Loss Productivity Revenue Norsk Hydro attempt recover lockergoga infection manufacturing location switch manual nonit drive operation

loss Productivity Revenue Manual operation result loss productivity

lockergoga Loss Productivity Revenue Manual operation result loss productivity

loss Productivity Revenue Citation Kevin Beaumont Citation Hydro

lockergoga Loss Productivity Revenue Citation Kevin Beaumont Citation Hydro

loss view Norsk Hydros production system impact lockergoga infection

lockergoga loss view Norsk Hydros production system impact lockergoga infection

LockerGoga result loss view force company switch manual operation

loss View result loss view force company switch manual operation

lockergoga loss View result loss view force company switch manual operation

NotPetya NotPetya initially infect network mean exploit particularly SMBvtargeting MS vulnerability spread industrial network

NotPetya initially infect network mean exploit particularly SMBvtargeting MS vulnerability spread industrial network

exploitation Remote Services NotPetya initially infect network mean exploit particularly SMBvtargeting MS vulnerability spread industrial network

NotPetya Exploitation Remote Services NotPetya initially infect network mean exploit particularly SMBvtargeting MS vulnerability spread industrial network

Lateral Tool Transfer NotPetya laterally industrial network mean SMB service

NotPetya Lateral Tool Transfer NotPetya laterally industrial network mean SMB service

NotPetya NotPetya disrupt manufacturing facility supply vaccine result halt production inability meet demand specific vaccine

NotPetya disrupt manufacturing facility supply vaccine result halt production inability meet demand specific vaccine

loss Productivity Revenue NotPetya disrupt manufacturing facility supply vaccine result halt production inability meet demand specific vaccine

NotPetya Loss Productivity Revenue NotPetya disrupt manufacturing facility supply vaccine result halt production inability meet demand specific vaccine

NotPetya Citation David Voreacos Katherine Chinglinsky Riley Griffin December

citation David Voreacos Katherine Chinglinsky Riley Griffin December

loss Productivity Revenue Citation David Voreacos Katherine Chinglinsky Riley Griffin December

NotPetya Loss Productivity Revenue Citation David Voreacos Katherine Chinglinsky Riley Griffin December

PLCBlaster PLCBlaster stop execution user program target enable transfer code

PLCBlaster stop execution user program target enable transfer code

change Operating Mode PLCBlaster stop execution user program target enable transfer code

PLCBlaster Change Operating Mode PLCBlaster stop execution user program target enable transfer code

change Operating Mode worm copy target subsequently start target PLC

PLCBlaster Change Operating Mode worm copy target subsequently start target PLC

PLCBlaster Citation Spenneberg Ralf Maik Brggemann Hendrik Schwartke March

change Operating Mode Citation Spenneberg Ralf Maik Brggemann Hendrik Schwartke March

PLCBlaster Change Operating Mode Citation Spenneberg Ralf Maik Brggemann Hendrik Schwartke March

PLCBlaster Denial Service execution PLC stop violate cycle time limit

PLCBlaster PLCBlaster implement endless loop trigger error condition PLC impact dos

PLCBlaster implement endless loop trigger error condition PLC impact dos

denial Service PLCBlaster implement endless loop trigger error condition PLC impact dos

PLCBlaster Denial Service PLCBlaster implement endless loop trigger error condition PLC impact dos

denial Service Citation Spenneberg Ralf Maik Brggemann Hendrik Schwartke March

PLCBlaster Denial Service Citation Spenneberg Ralf Maik Brggemann Hendrik Schwartke March

PLCBlaster Manipulate IO Image POU POKE value process image modify

Manipulate IO Image Citation Spenneberg Ralf Maik Brggemann Hendrik Schwartke March

PLCBlaster Manipulate IO Image Citation Spenneberg Ralf Maik Brggemann Hendrik Schwartke March

PLCBlaster Modify Controller task original code target untouched

PLCBlaster Modify Controller task OB automatically detect PLC execute

Modify Controller Tasking Citation Spenneberg Ralf Maik Brggemann Hendrik Schwartke March

PLCBlaster Modify Controller Tasking Citation Spenneberg Ralf Maik Brggemann Hendrik Schwartke March

PLCBlaster PLCBlaster copy Program Organization Units POU target device

Modify Program PLCBlaster copy Program Organization Units POU target device

PLCBlaster Modify Program PLCBlaster copy Program Organization Units POU target device

PLCBlaster Modify Program pou include Data Block Function Function Block

Modify Program Citation Spenneberg Ralf Maik Brggemann Hendrik Schwartke March

PLCBlaster Modify Program Citation Spenneberg Ralf Maik Brggemann Hendrik Schwartke March

PLCBlaster PLCBlaster use system function block tcon TDISCON initiate destroy tcp connection arbitrary system

PLCBlaster use system function block tcon TDISCON initiate destroy tcp connection arbitrary system

native API PLCBlaster use system function block tcon TDISCON initiate destroy tcp connection arbitrary system

PLCBlaster native api PLCBlaster use system function block tcon TDISCON initiate destroy tcp connection arbitrary system

PLCBlaster Buffers send receive connection TRCV und TSEND system function block

buffer send receive connection TRCV und TSEND system function block

native api Buffers send receive connection TRCV und TSEND system function block

PLCBlaster native api Buffers send receive connection TRCV und TSEND system function block

native API Citation Spenneberg Ralf Maik Brggemann Hendrik Schwartke March

PLCBlaster native API Citation Spenneberg Ralf Maik Brggemann Hendrik Schwartke March

PLCBlaster PLCBlaster utilize PLC communication management api load executable Program Organization unit

PLCBlaster utilize PLC communication management api load executable Program Organization unit

program Download PLCBlaster utilize PLC communication management api load executable Program Organization unit

PLCBlaster Program Download PLCBlaster utilize PLC communication management api load executable Program Organization unit

program Download Citation Spenneberg Ralf Maik Brggemann Hendrik Schwartke March

PLCBlaster Program Download Citation Spenneberg Ralf Maik Brggemann Hendrik Schwartke March

PLCBlaster PLCBlaster scan network find Siemens S PLC device infect

Remote System Discovery PLCBlaster scan network find Siemens S PLC device infect

PLCBlaster Remote System Discovery PLCBlaster scan network find Siemens S PLC device infect

Remote System Discovery locate device check service listen TCP port

PLCBlaster Remote System Discovery locate device check service listen TCP port

Remote System Discovery Citation Spenneberg Ralf Maik Brggemann Hendrik Schwartke March

PLCBlaster Remote System Discovery Citation Spenneberg Ralf Maik Brggemann Hendrik Schwartke March

revil revil malware gain access organization network encrypt sensitive file OT equipment

revil malware gain access organization network encrypt sensitive file OT equipment

loss Productivity Revenue revil malware gain access organization network encrypt sensitive file OT equipment

revil Loss Productivity Revenue revil malware gain access organization network encrypt sensitive file OT equipment

loss Productivity Revenue Citation Selena Larson Camille Singleton December

revil Loss Productivity Revenue Citation Selena Larson Camille Singleton December

revil REvil search Ahnlab autoupexe service run target system inject payload exist process

revil search Ahnlab autoupexe service run target system inject payload exist process

masquerade revil search Ahnlab autoupexe service run target system inject payload exist process

revil Masquerading revil search Ahnlab autoupexe service run target system inject payload exist process

REvil REvil use SMB protocol encrypt file locate remotely connect file share

REvil use SMB protocol encrypt file locate remotely connect file share

Remote Services REvil use SMB protocol encrypt file locate remotely connect file share

REvil Remote Services REvil use SMB protocol encrypt file locate remotely connect file share

REvil REvil utilize JavaScript WScript PowerShell script execute

Scripting REvil utilize JavaScript WScript PowerShell script execute

revil Scripting REvil utilize JavaScript WScript PowerShell script execute

revil malicious JavaScript attachment obfuscate PowerShell script execute malware

malicious JavaScript attachment obfuscate PowerShell script execute malware

script malicious JavaScript attachment obfuscate PowerShell script execute malware

revil scripting malicious JavaScript attachment obfuscate PowerShell script execute malware

revil REvil search process list prc field configuration file terminate process

revil search process list prc field configuration file terminate process

service stop revil search process list prc field configuration file terminate process

REvil Service stop revil search process list prc field configuration file terminate process

REvil REvil send https post message randomly generate url communicate remote server

revil send https post message randomly generate url communicate remote server

Standard Application Layer Protocol REvil send https post message randomly generate url communicate remote server

REvil Standard Application Layer Protocol REvil send https post message randomly generate url communicate remote server

revil Citation Tom Fakterman August Citation SecureWorks September

Standard Application Layer Protocol Citation Tom Fakterman August Citation SecureWorks September

REvil Standard Application Layer Protocol Citation Tom Fakterman August Citation SecureWorks September

REvil REvil send exfiltrate datum victim system https post message send c system

revil send exfiltrate datum victim system https post message send c system

theft Operational Information REvil send exfiltrate datum victim system https post message send c system

REvil Theft Operational Information REvil send exfiltrate datum victim system https post message send c system

REvil Citation McAfee Labs October Citation SecureWorks September

theft Operational Information Citation McAfee Labs October Citation SecureWorks September

REvil Theft Operational Information Citation McAfee Labs October Citation SecureWorks September

REvil REvil initially execute user click JavaScript file include phishe email zip attachment

REvil initially execute user click JavaScript file include phishe email zip attachment

user Execution REvil initially execute user click JavaScript file include phishe email zip attachment

revil User Execution REvil initially execute user click JavaScript file include phishe email zip attachment

Ryuk enterprise resource plan ERP manufacturing server lose Ryuk attack

enterprise resource plan ERP manufacturing server lose Ryuk attack

loss Productivity Revenue enterprise resource plan ERP manufacturing server lose Ryuk attack

Ryuk Loss Productivity Revenue enterprise resource plan ERP manufacturing server lose Ryuk attack

Ryuk manufacturing process rely paper exist order shop floor open

loss Productivity Revenue manufacturing process rely paper exist order shop floor open

Ryuk Loss Productivity Revenue manufacturing process rely paper exist order shop floor open

Stuxnet Stuxnet store execute SQL code extract execute Stuxnet save cab file xpcmdshell follow command set s masterxp cmdshell extrac y t tx execs Citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet store execute SQL code extract execute Stuxnet save cab file xpcmdshell follow command set s masterxp cmdshell extrac y t tx execs Citation Nicolas Falliere Liam O Murchu Eric Chien February

CommandLine Interface Stuxnet store execute SQL code extract execute Stuxnet save cab file xpcmdshell follow command set s masterxp cmdshell extrac y t tx execs Citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet CommandLine Interface Stuxnet store execute SQL code extract execute Stuxnet save cab file xpcmdshell follow command set s masterxp cmdshell extrac y t tx execs Citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet Stuxnet attempt contact command control server port send basic information computer compromise

Stuxnet attempt contact command control server port send basic information computer compromise

Commonly Port Stuxnet attempt contact command control server port send basic information computer compromise

Stuxnet Commonly Port Stuxnet attempt contact command control server port send basic information computer compromise

Stuxnet Citation Nicolas Falliere Liam O Murchu Eric Chien February

Commonly Port Citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet Commonly Port Citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet Stuxnet use default password hardcode WinCC software database server mechanism propagate nearby system

Stuxnet use default password hardcode WinCC software database server mechanism propagate nearby system

default Credentials Stuxnet use default password hardcode WinCC software database server mechanism propagate nearby system

Stuxnet Default Credentials Stuxnet use default password hardcode WinCC software database server mechanism propagate nearby system

default Credentials Citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet Default Credentials Citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet Stuxnet execute malicious SQL command WinCC database server propagate remote system

Stuxnet execute malicious SQL command WinCC database server propagate remote system

exploitation Remote Services Stuxnet execute malicious SQL command WinCC database server propagate remote system

Stuxnet Exploitation Remote Services Stuxnet execute malicious SQL command WinCC database server propagate remote system

Stuxnet malicious SQL command include xpcmdshell spdumpdbilog spaddextendedproc

malicious SQL command include xpcmdshell spdumpdbilog spaddextendedproc

exploitation Remote Services malicious SQL command include xpcmdshell spdumpdbilog spaddextendedproc

Stuxnet Exploitation Remote Services malicious SQL command include xpcmdshell spdumpdbilog spaddextendedproc

exploitation Remote Services Citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet Exploitation Remote Services Citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet Stuxnet modify Import Address Tables dll hook specific api open project file

Stuxnet modify Import Address Tables dll hook specific api open project file

hook Stuxnet modify Import Address Tables dll hook specific api open project file

Stuxnet Hooking Stuxnet modify Import Address Tables dll hook specific api open project file

hooking Citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet Hooking Citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet Stuxnet copy input area IO image data block second interval copy form second recording input area

Stuxnet copy input area IO image data block second interval copy form second recording input area

IO Image Stuxnet copy input area IO image data block second interval copy form second recording input area

Stuxnet IO Image Stuxnet copy input area IO image data block second interval copy form second recording input area

Stuxnet IO Image input area contain information pass PLC peripheral

IO Image Citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet IO Image Citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet Stuxnet send SQL statement create table insert binary value table

Stuxnet send SQL statement create table insert binary value table

Lateral Tool Transfer Stuxnet send SQL statement create table insert binary value table

Stuxnet Lateral Tool Transfer Stuxnet send SQL statement create table insert binary value table

Stuxnet binary value hex string representation main Stuxnet DLL executable file form resource update configuration datum block

binary value hex string representation main Stuxnet DLL executable file form resource update configuration datum block

Lateral Tool Transfer binary value hex string representation main Stuxnet DLL executable file form resource update configuration datum block

Stuxnet Lateral Tool Transfer binary value hex string representation main Stuxnet DLL executable file form resource update configuration datum block

Lateral Tool Transfer Citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet Lateral Tool Transfer Citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet peripheral output write sequence c intercept output ensure write process image output

peripheral output write sequence c intercept output ensure write process image output

Manipulate IO Image peripheral output write sequence c intercept output ensure write process image output

Stuxnet Manipulate IO Image peripheral output write sequence c intercept output ensure write process image output

Stuxnet output instruction PLC send device change operate behavior

Manipulate IO Image output instruction PLC send device change operate behavior

Stuxnet Manipulate IO Image output instruction PLC send device change operate behavior

Stuxnet intercept peripheral output Stuxnet prevent operator notice unauthorized command send peripheral

intercept peripheral output Stuxnet prevent operator notice unauthorized command send peripheral

Manipulate IO Image intercept peripheral output Stuxnet prevent operator notice unauthorized command send peripheral

Stuxnet Manipulate IO Image intercept peripheral output Stuxnet prevent operator notice unauthorized command send peripheral

Manipulate IO Image Citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet Manipulate IO Image Citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet Stuxnet reprogram PLC change critical parameter way legitimate command override intercept

Stuxnet reprogram PLC change critical parameter way legitimate command override intercept

manipulation Control Stuxnet reprogram PLC change critical parameter way legitimate command override intercept

Stuxnet Manipulation Control Stuxnet reprogram PLC change critical parameter way legitimate command override intercept

Stuxnet addition Stuxnet apply inappropriate command sequence parameter cause damage property

addition Stuxnet apply inappropriate command sequence parameter cause damage property

manipulation Control addition Stuxnet apply inappropriate command sequence parameter cause damage property

Stuxnet Manipulation Control addition Stuxnet apply inappropriate command sequence parameter cause damage property

manipulation Control Citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet Manipulation Control Citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet Stuxnet manipulate view operator replay process input manipulate IO image evade detection inhibit protection function

Stuxnet manipulate view operator replay process input manipulate IO image evade detection inhibit protection function

manipulation View Stuxnet manipulate view operator replay process input manipulate IO image evade detection inhibit protection function

Stuxnet Manipulation View Stuxnet manipulate view operator replay process input manipulate IO image evade detection inhibit protection function

Stuxnet Citation Ralph Langner November citation Nicolas Falliere Liam O Murchu Eric Chien February

citation Ralph Langner November citation Nicolas Falliere Liam O Murchu Eric Chien February

manipulation View Citation Ralph Langner November citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet Manipulation View Citation Ralph Langner November citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet Stuxnet rename sotbxdxdll dll responsible handle communication PLC

Stuxnet rename sotbxdxdll dll responsible handle communication PLC

masquerade Stuxnet rename sotbxdxdll dll responsible handle communication PLC

Stuxnet Masquerading Stuxnet rename sotbxdxdll dll responsible handle communication PLC

Stuxnet replace dll file version allow intercept call access PLC

masquerade replace dll file version allow intercept call access PLC

Stuxnet Masquerading replace dll file version allow intercept call access PLC

masquerade Citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet Masquerading Citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet Stuxnet infect OB malicious code sequence execute start cycle

Modify Controller Tasking Stuxnet infect OB malicious code sequence execute start cycle

Stuxnet Modify Controller Tasking Stuxnet infect OB malicious code sequence execute start cycle

Modify Controller Tasking OB act watchdog certain condition stop execution OB

Stuxnet Modify Controller Tasking OB act watchdog certain condition stop execution OB

Modify Controller Tasking Citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet Modify Controller Tasking Citation Nicolas Falliere Liam O Murchu Eric Chien February

Modify Parameter state Stuxnet send network burst DPSEND primitive

Stuxnet Modify Parameter state Stuxnet send network burst DPSEND primitive

Modify Parameter datum frame instruction frequency converter drive

Stuxnet Modify Parameter datum frame instruction frequency converter drive

Stuxnet example frame contain record change maximum frequency speed motor operate

example frame contain record change maximum frequency speed motor operate

Modify Parameter example frame contain record change maximum frequency speed motor operate

Stuxnet Modify Parameter example frame contain record change maximum frequency speed motor operate

Stuxnet frequency converter drive consist parameter remotely configure Profibus

frequency converter drive consist parameter remotely configure Profibus

Modify Parameter frequency converter drive consist parameter remotely configure Profibus

Stuxnet Modify Parameter frequency converter drive consist parameter remotely configure Profibus

Modify Parameter write new value parameter change behavior device

Stuxnet Modify Parameter write new value parameter change behavior device

Modify Parameter Citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet Modify Parameter Citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet Stuxnet infect PLCs different code depend characteristic target system

Stuxnet infect PLCs different code depend characteristic target system

Modify Program Stuxnet infect PLCs different code depend characteristic target system

Stuxnet Modify Program Stuxnet infect PLCs different code depend characteristic target system

Stuxnet infection sequence consist code block datum block download PLC alter behavior

infection sequence consist code block datum block download PLC alter behavior

Modify Program infection sequence consist code block datum block download PLC alter behavior

Stuxnet Modify Program infection sequence consist code block datum block download PLC alter behavior

Modify Program Citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet Modify Program Citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet Stuxnet examine field record DPRECV monitor determine target system particular state operation

Stuxnet examine field record DPRECV monitor determine target system particular state operation

Monitor Process State Stuxnet examine field record DPRECV monitor determine target system particular state operation

Stuxnet Monitor Process State Stuxnet examine field record DPRECV monitor determine target system particular state operation

Monitor Process State Citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet Monitor Process State Citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet Stuxnet call system function block operating system run PLC

native api Stuxnet call system function block operating system run PLC

stuxnet native api Stuxnet call system function block operating system run PLC

Stuxnet execute system task read system clock SFC generate data block fly

execute system task read system clock SFC generate data block fly

native api execute system task read system clock SFC generate data block fly

stuxnet native api execute system task read system clock SFC generate data block fly

native API Citation Nicolas Falliere Liam O Murchu Eric Chien February

stuxnet native API Citation Nicolas Falliere Liam O Murchu Eric Chien February

network Sniffing DPRECV standard function block network coprocessor

Stuxnet Network Sniffing DPRECV standard function block network coprocessor

Stuxnet receive network frame Profibus standard industrial network bus distribute IO

receive network frame Profibus standard industrial network bus distribute IO

network sniffing receive network frame Profibus standard industrial network bus distribute IO

Stuxnet Network sniffing receive network frame Profibus standard industrial network bus distribute IO

Stuxnet Network sniff original block copy FC replace malicious block

Stuxnet time function receive packet malicious Stuxnet block take control original dprecv FC perform postprocessing packet datum

time function receive packet malicious Stuxnet block take control original dprecv FC perform postprocessing packet datum

network Sniffing time function receive packet malicious Stuxnet block take control original dprecv FC perform postprocessing packet datum

Stuxnet Network Sniffing time function receive packet malicious Stuxnet block take control original dprecv FC perform postprocessing packet datum

Stuxnet replace dprecv block later refer DPRECV monitor mean monitor datum send frequency converter drive cpu CP Profibus communication module

replace dprecv block later refer DPRECV monitor mean monitor datum send frequency converter drive cpu CP Profibus communication module

network Sniffing replace dprecv block later refer DPRECV monitor mean monitor datum send frequency converter drive cpu CP Profibus communication module

Stuxnet Network Sniffing replace dprecv block later refer DPRECV monitor mean monitor datum send frequency converter drive cpu CP Profibus communication module

network Sniffing Citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet Network Sniffing Citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet Stuxnet infection sequence consist code block datum block download PLC alter behavior

stuxnet infection sequence consist code block datum block download PLC alter behavior

program Download Stuxnet infection sequence consist code block datum block download PLC alter behavior

Stuxnet Program Download Stuxnet infection sequence consist code block datum block download PLC alter behavior

program Download Citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet Program Download Citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet Stuxnet copy step project way automatically execute Step project load

Stuxnet copy step project way automatically execute Step project load

project File Infection Stuxnet copy step project way automatically execute Step project load

Stuxnet Project File Infection Stuxnet copy step project way automatically execute Step project load

project File Infection Citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet Project File Infection Citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet Stuxnet malicious SQL command WinCC database server propagate remote system

Stuxnet malicious SQL command WinCC database server propagate remote system

Remote Services Stuxnet malicious SQL command WinCC database server propagate remote system

Stuxnet Remote Services Stuxnet malicious SQL command WinCC database server propagate remote system

Remote Services malicious SQL command include xpcmdshell spdumpdbilog spaddextendedproc

Stuxnet Remote Services malicious SQL command include xpcmdshell spdumpdbilog spaddextendedproc

Remote Services Citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet Remote Services Citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet Stuxnet enumerate parse System Data Blocks SDB sblkfindfirst sblkfindnext API call sotbxdxdll

Stuxnet enumerate parse System Data Blocks SDB sblkfindfirst sblkfindnext API call sotbxdxdll

Remote System Information Discovery Stuxnet enumerate parse System Data Blocks SDB sblkfindfirst sblkfindnext API call sotbxdxdll

Stuxnet Remote System Information Discovery Stuxnet enumerate parse System Data Blocks SDB sblkfindfirst sblkfindnext API call sotbxdxdll

Remote System Information Discovery Stuxnet find sdb dword offset h equal CBCh

Stuxnet Remote System Information Discovery Stuxnet find sdb dword offset h equal CBCh

Stuxnet specify system use Profibus communication processor module CP

Remote System Information Discovery specify system use Profibus communication processor module CP

Stuxnet Remote System Information Discovery specify system use Profibus communication processor module CP

Remote System Information Discovery addition specific value search count h h

Stuxnet Remote System Information Discovery addition specific value search count h h

Stuxnet h assign number KFCV appear frequency converter drive know variable frequency drive manufacture Fararo Paya Teheran Iran

h assign number KFCV appear frequency converter drive know variable frequency drive manufacture Fararo Paya Teheran Iran

Remote System Information Discovery h assign number KFCV appear frequency converter drive know variable frequency drive manufacture Fararo Paya Teheran Iran

Stuxnet Remote System Information Discovery h assign number KFCV appear frequency converter drive know variable frequency drive manufacture Fararo Paya Teheran Iran

Stuxnet h assign Vacon NX frequency converter drive manufacture Vacon base Finland

h assign Vacon NX frequency converter drive manufacture Vacon base Finland

Remote System Information Discovery h assign Vacon NX frequency converter drive manufacture Vacon base Finland

Stuxnet Remote System Information Discovery h assign Vacon NX frequency converter drive manufacture Vacon base Finland

Remote System Information Discovery Citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet Remote System Information Discovery Citation Nicolas Falliere Liam O Murchu Eric Chien February

replication Removable Media Stuxnet able selfreplicate spread removable drive

Stuxnet Replication Removable Media Stuxnet able selfreplicate spread removable drive

Stuxnet willing insider unknown party contractor bring removable medium target environment

willing insider unknown party contractor bring removable medium target environment

replication Removable medium willing insider unknown party contractor bring removable medium target environment

Stuxnet Replication Removable medium willing insider unknown party contractor bring removable medium target environment

Stuxnet Citation Nicolas Falliere Liam O Murchu Eric Chien February early version Stuxnet rely physical installation infect target system infected configuration file carry usb stick open

citation Nicolas Falliere Liam O Murchu Eric Chien February early version Stuxnet rely physical installation infect target system infected configuration file carry usb stick open

replication Removable Media Citation Nicolas Falliere Liam O Murchu Eric Chien February early version Stuxnet rely physical installation infect target system infected configuration file carry usb stick open

Stuxnet Replication Removable Media Citation Nicolas Falliere Liam O Murchu Eric Chien February early version Stuxnet rely physical installation infect target system infected configuration file carry usb stick open

Stuxnet Replication Removable Media Citation Ralph Langner November

Stuxnet Rootkit Stuxnet rootkit contain entirely fake sotbxdxdll

Stuxnet order continue exist undetected PLC need account follow situation read request malicious code block read request infected block OB OB DPRECV write request overwrite Stuxnets code

order continue exist undetected PLC need account follow situation read request malicious code block read request infected block OB OB DPRECV write request overwrite Stuxnets code

rootkit order continue exist undetected PLC need account follow situation read request malicious code block read request infected block OB OB DPRECV write request overwrite Stuxnets code

Stuxnet Rootkit order continue exist undetected PLC need account follow situation read request malicious code block read request infected block OB OB DPRECV write request overwrite Stuxnets code

Stuxnet Rootkit Stuxnet contain code monitor intercept type request

Stuxnet rootkit modify request Stuxnets PLC code discover damage

rootkit rootkit modify request Stuxnets PLC code discover damage

Stuxnet Rootkit rootkit modify request Stuxnets PLC code discover damage

Standard Application Layer Protocol Stuxnet use thread monitor data block DB sequence b

Stuxnet Standard Application Layer Protocol Stuxnet use thread monitor data block DB sequence b

Standard Application Layer Protocol thread constantly run probe block minute

Stuxnet Standard Application Layer Protocol thread constantly run probe block minute

Stuxnet infected PLC block DB find contain special magic value Stuxnet identify block DB block datum read write

infected PLC block DB find contain special magic value Stuxnet identify block DB block datum read write

Standard Application Layer Protocol infected PLC block DB find contain special magic value Stuxnet identify block DB block datum read write

Stuxnet Standard Application Layer Protocol infected PLC block DB find contain special magic value Stuxnet identify block DB block datum read write

Stuxnet thread likely optimize way sequence b work modify behavior step editor open

thread likely optimize way sequence b work modify behavior step editor open

Standard Application Layer Protocol thread likely optimize way sequence b work modify behavior step editor open

Stuxnet Standard Application Layer Protocol thread likely optimize way sequence b work modify behavior step editor open

Standard Application Layer Protocol Citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet Standard Application Layer Protocol Citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet Stuxnet infect dll associate WinCC simatic manager responsible open project file

Stuxnet infect dll associate WinCC simatic manager responsible open project file

user execution Stuxnet infect dll associate WinCC simatic manager responsible open project file

Stuxnet User Execution Stuxnet infect dll associate WinCC simatic manager responsible open project file

Stuxnet user open uninfected project file compromise manager file infect Stuxnet code

user open uninfected project file compromise manager file infect Stuxnet code

user execution user open uninfected project file compromise manager file infect Stuxnet code

Stuxnet User execution user open uninfected project file compromise manager file infect Stuxnet code

Stuxnet infected project open simatic manager modify data file trigger search xyzdll file

infected project open simatic manager modify data file trigger search xyzdll file

user execution infected project open simatic manager modify data file trigger search xyzdll file

Stuxnet User Execution infected project open simatic manager modify data file trigger search xyzdll file

Stuxnet xyzdll file find specify location malicious dll load execute manager

xyzdll file find specify location malicious dll load execute manager

user execution xyzdll file find specify location malicious dll load execute manager

Stuxnet User execution xyzdll file find specify location malicious dll load execute manager

User Execution Citation Nicolas Falliere Liam O Murchu Eric Chien February

Stuxnet User Execution Citation Nicolas Falliere Liam O Murchu Eric Chien February

change Operating Mode Triton ability halt run program TriStation protocol

Triton Change Operating Mode Triton ability halt run program TriStation protocol

change Operating Mode TsHipy contain instance halt run function execute

Triton Change Operating Mode TsHipy contain instance halt run function execute

Triton Triton use TriStations default UDP port communicate device

Commonly Port Triton use TriStations default UDP port communicate device

Triton Commonly Port Triton use TriStations default UDP port communicate device

Triton Triton contain file name tscnamespy contain default definition program state tsprogstate

Triton contain file name tscnamespy contain default definition program state tsprogstate

detect Operating Mode Triton contain file name tscnamespy contain default definition program state tsprogstate

Triton Detect Operating Mode Triton contain file name tscnamespy contain default definition program state tsprogstate

Triton Triton leverage reconstruct TriStation protocol framework trigger api relate program download program allocation program change

Triton leverage reconstruct TriStation protocol framework trigger api relate program download program allocation program change

execution API Triton leverage reconstruct TriStation protocol framework trigger api relate program download program allocation program change

Triton Execution API Triton leverage reconstruct TriStation protocol framework trigger api relate program download program allocation program change

Triton Triton disable firmware RAMROM consistency check inject payload imainbin firmware memory region

Triton disable firmware RAMROM consistency check inject payload imainbin firmware memory region

exploitation Evasion Triton disable firmware RAMROM consistency check inject payload imainbin firmware memory region

Triton Exploitation Evasion Triton disable firmware RAMROM consistency check inject payload imainbin firmware memory region

Triton Citation DHS CISA February Citation ICSCERT December Citation Schneider Electric January Triconex system include continuous mean detection include checksum firmware program integrity memory memory reference integrity configuration

citation DHS CISA February Citation ICSCERT December Citation Schneider Electric January Triconex system include continuous mean detection include checksum firmware program integrity memory memory reference integrity configuration

exploitation Evasion Citation DHS CISA February Citation ICSCERT December Citation Schneider Electric January Triconex system include continuous mean detection include checksum firmware program integrity memory memory reference integrity configuration

Triton Exploitation Evasion Citation DHS CISA February Citation ICSCERT December Citation Schneider Electric January Triconex system include continuous mean detection include checksum firmware program integrity memory memory reference integrity configuration

Triton Exploitation Evasion Citation Office Nuclear Reactor regulation

Triton Triton leverage previouslyunknown vulnerability affect Tricon MP firmware version allow insecurelywritten system exploit achieve arbitrary byte write primitive gain supervisor privilege

Triton leverage previouslyunknown vulnerability affect Tricon MP firmware version allow insecurelywritten system exploit achieve arbitrary byte write primitive gain supervisor privilege

exploitation Privilege Escalation Triton leverage previouslyunknown vulnerability affect Tricon MP firmware version allow insecurelywritten system exploit achieve arbitrary byte write primitive gain supervisor privilege

Triton Exploitation Privilege Escalation Triton leverage previouslyunknown vulnerability affect Tricon MP firmware version allow insecurelywritten system exploit achieve arbitrary byte write primitive gain supervisor privilege

Triton Exploitation Privilege Escalation Citation DHS CISA February

Triton Triton injector injectbin change function pointer main processor diagnostic datum TriStation command address imainbin execute prior normal handler

Triton injector injectbin change function pointer main processor diagnostic datum TriStation command address imainbin execute prior normal handler

hook Triton injector injectbin change function pointer main processor diagnostic datum TriStation command address imainbin execute prior normal handler

Triton Hooking Triton injector injectbin change function pointer main processor diagnostic datum TriStation command address imainbin execute prior normal handler

Triton Triton reset controller previous state TriStation fail write dummy program memory likely attempt antiforensic

Triton reset controller previous state TriStation fail write dummy program memory likely attempt antiforensic

Indicator Removal Host Triton reset controller previous state TriStation fail write dummy program memory likely attempt antiforensic

Triton Indicator Removal Host Triton reset controller previous state TriStation fail write dummy program memory likely attempt antiforensic

Triton Triton capability reprogram SIS logic allow unsafe condition persist reprogram SIS allow unsafe state DCS create unsafe state hazard

Triton capability reprogram SIS logic allow unsafe condition persist reprogram SIS allow unsafe state DCS create unsafe state hazard

loss Safety Triton capability reprogram SIS logic allow unsafe condition persist reprogram SIS allow unsafe state DCS create unsafe state hazard

Triton Loss Safety Triton capability reprogram SIS logic allow unsafe condition persist reprogram SIS allow unsafe state DCS create unsafe state hazard

Triton Citation Blake Johnson Dan Caban Marina Krotofil Dan Scali Nathan Brubaker Christopher Glyer December

citation Blake Johnson Dan Caban Marina Krotofil Dan Scali Nathan Brubaker Christopher Glyer December

loss Safety Citation Blake Johnson Dan Caban Marina Krotofil Dan Scali Nathan Brubaker Christopher Glyer December

Triton Loss Safety Citation Blake Johnson Dan Caban Marina Krotofil Dan Scali Nathan Brubaker Christopher Glyer December

Triton Triton injector injectbin masquerade standard compile PowerPC program Tricon

Triton injector injectbin masquerade standard compile PowerPC program Tricon

masquerade Triton injector injectbin masquerade standard compile PowerPC program Tricon

Triton Masquerading Triton injector injectbin masquerade standard compile PowerPC program Tricon

Triton Triton configure masquerade trilogexe Triconex software analyze SIS log

Triton configure masquerade trilogexe Triconex software analyze SIS log

masquerade Triton configure masquerade trilogexe Triconex software analyze SIS log

Triton Masquerading Triton configure masquerade trilogexe Triconex software analyze SIS log

masquerade Citation Blake Johnson Dan Caban Marina Krotofil Dan Scali Nathan Brubaker Christopher Glyer December

Triton Masquerading Citation Blake Johnson Dan Caban Marina Krotofil Dan Scali Nathan Brubaker Christopher Glyer December

Triton Triton argumentsetting injectbin shellcode add program table Tricon execute firmware cycle

Triton argumentsetting injectbin shellcode add program table Tricon execute firmware cycle

Modify Controller Tasking Triton argumentsetting injectbin shellcode add program table Tricon execute firmware cycle

Triton Modify Controller Tasking Triton argumentsetting injectbin shellcode add program table Tricon execute firmware cycle

Modify Controller Tasking Citation DHS CISA February Citation Jos Wetzels January

Triton Modify Controller Tasking Citation DHS CISA February Citation Jos Wetzels January

Triton Triton imainbin payload take command TsHiExplReadRamEx TsHiExplWriteRamEx TsHiExplExec function perform operation controller memory register syscall write PowerPC shellcode

Triton imainbin payload take command TsHiExplReadRamEx TsHiExplWriteRamEx TsHiExplExec function perform operation controller memory register syscall write PowerPC shellcode

native API Triton imainbin payload take command TsHiExplReadRamEx TsHiExplWriteRamEx TsHiExplExec function perform operation controller memory register syscall write PowerPC shellcode

Triton native API Triton imainbin payload take command TsHiExplReadRamEx TsHiExplWriteRamEx TsHiExplExec function perform operation controller memory register syscall write PowerPC shellcode

Triton Triton leverage TriStation protocol download program Triconex Safety Instrumented System

Triton leverage TriStation protocol download program Triconex Safety Instrumented System

program Download Triton leverage TriStation protocol download program Triconex Safety Instrumented System

Triton Program Download Triton leverage TriStation protocol download program Triconex Safety Instrumented System

program upload Triton call SafeAppendProgramMod transfer payload Tricon

Triton Program upload Triton call SafeAppendProgramMod transfer payload Tricon

Triton Triton use Python script capable detect Triconex controller network send specific udp broadcast packet port

Triton use Python script capable detect Triconex controller network send specific udp broadcast packet port

Remote System Discovery Triton use Python script capable detect Triconex controller network send specific udp broadcast packet port

Triton Remote System Discovery Triton use Python script capable detect Triconex controller network send specific udp broadcast packet port

Triton Triton communicate Triconex controller custom component framework write entirely Python

Triton communicate Triconex controller custom component framework write entirely Python

Scripting Triton communicate Triconex controller custom component framework write entirely Python

Triton Scripting Triton communicate Triconex controller custom component framework write entirely Python

Triton module implement TriStation communication protocol support component find separate file libraryzip main script employ functionality compile standalone pyexe Windows executable trilogexe include Python environment

module implement TriStation communication protocol support component find separate file libraryzip main script employ functionality compile standalone pyexe Windows executable trilogexe include Python environment

script module implement TriStation communication protocol support component find separate file libraryzip main script employ functionality compile standalone pyexe Windows executable trilogexe include Python environment

Triton script module implement TriStation communication protocol support component find separate file libraryzip main script employ functionality compile standalone pyexe Windows executable trilogexe include Python environment

Triton Triton communicate implant utilize TriStation main processor diagnostic datum command look specifically craft packet body extract command value argument

Triton communicate implant utilize TriStation main processor diagnostic datum command look specifically craft packet body extract command value argument

Standard Application Layer Protocol Triton communicate implant utilize TriStation main processor diagnostic datum command look specifically craft packet body extract command value argument

Triton Standard Application Layer Protocol Triton communicate implant utilize TriStation main processor diagnostic datum command look specifically craft packet body extract command value argument

Standard Application Layer Protocol Citation Jos Wetzels January

Triton Standard Application Layer Protocol Citation Jos Wetzels January

Triton Triton able read write execute code memory safety controller arbitrary address device firmware region

Triton able read write execute code memory safety controller arbitrary address device firmware region

system Firmware Triton able read write execute code memory safety controller arbitrary address device firmware region

Triton System Firmware Triton able read write execute code memory safety controller arbitrary address device firmware region

Triton allow malware change run firmware memory modify device operate

system Firmware allow malware change run firmware memory modify device operate

Triton System Firmware allow malware change run firmware memory modify device operate

VPNFilter VPNFilter ssler module configure device iptable redirect traffic destine port local service listen port

VPNFilter ssler module configure device iptable redirect traffic destine port local service listen port

man Middle VPNFilter ssler module configure device iptable redirect traffic destine port local service listen port

VPNFilter Man Middle VPNFilter ssler module configure device iptable redirect traffic destine port local service listen port

VPNFilter outgoing web request port intercept ssler inspect ps module manipulate send legitimate http service

outgoing web request port intercept ssler inspect ps module manipulate send legitimate http service

man Middle outgoing web request port intercept ssler inspect ps module manipulate send legitimate http service

VPNFilter Man Middle outgoing web request port intercept ssler inspect ps module manipulate send legitimate http service

man Middle Citation William Largent June citation Carl Hurd March

VPNFilter Man Middle Citation William Largent June citation Carl Hurd March

VPNFilter VPNFilter packet sniffer look basic authentication monitor ICS traffic specific TPLINK RVPN

VPNFilter packet sniffer look basic authentication monitor ICS traffic specific TPLINK RVPN

network Sniffing VPNFilter packet sniffer look basic authentication monitor ICS traffic specific TPLINK RVPN

VPNFilter Network sniff VPNFilter packet sniffer look basic authentication monitor ICS traffic specific TPLINK RVPN

VPNFilter malware use raw socket look connection prespecified ip address look tcp packet byte large

malware use raw socket look connection prespecified ip address look tcp packet byte large

network Sniffing malware use raw socket look connection prespecified ip address look tcp packet byte large

VPNFilter Network Sniffing malware use raw socket look connection prespecified ip address look tcp packet byte large

VPNFilter Network Sniffing Packets port scan BasicAuth information log

VPNFilter allow credential harvesting communication device access modbusenabled HMI

allow credential harvesting communication device access modbusenabled HMI

network Sniffing allow credential harvesting communication device access modbusenabled HMI

VPNFilter Network sniffing allow credential harvesting communication device access modbusenabled HMI

network Sniffing Citation William Largent June citation Carl Hurd March

VPNFilter Network Sniffing Citation William Largent June citation Carl Hurd March

WannaCry WannaCry initially infect network mean exploit particularly SMBvtargeting MS vulnerability spread industrial network

WannaCry initially infect network mean exploit particularly SMBvtargeting MS vulnerability spread industrial network

exploitation Remote Services WannaCry initially infect network mean exploit particularly SMBvtargeting MS vulnerability spread industrial network

WannaCry exploitation Remote Services WannaCry initially infect network mean exploit particularly SMBvtargeting MS vulnerability spread industrial network

Lateral Tool transfer WannaCry laterally industrial network mean SMB service

WannaCry Lateral Tool transfer WannaCry laterally industrial network mean SMB service

worm theft steal repository relate operational information industrial file espionage draw datum contain collect capability application acadmedrea

wnet window version vendor user trojanize tag system supply state specialized site service server send run role rely reliant reachable provide protocol process point plugin platform plant payload open networking network multiple module modular map malware machine installer information indicate include icsspecific help group generic gather function execution enumerate energy email effect distribute discover device detail denial datum crash count control connect compromise component company communication common citation chain cause capability bandwidth backdoor attacker attach application analyze addition

window windiskcoderd website vulnerability visit user ukrainian transportation transfer threat target suffer start spread service selfpropagate secure sector result report ransomware rabbit organization open network medium mean malware loss lock list legitimate installer insecure infrastructure infect industrial file exploitation exploit execution dropper driveby download disguise consumer computer compromise citation bad attack affect actor

window variant valid utilize user use ukrainian toolkit target support server sector request reach presence post plugin organization new malware malicious maintain know institution include external evolve energy email document distribute design date criminal credential create control contact confrontation conduct command citation campaign botnet attack attachment apt adversary administrator addition actor account

worm window way vulnerability visible variant thumb target system suspect staff spread shutdown share security replication removable regular production procedure power plant open official nuclear network motion medium loss involve infection infect home force find facility exploit event drive disk detect copy conficker computer citation check bring belong availability accident

window use theft target system sector repository reconnaissance purpose platform party order network module modular manufacturer malware intelligence infrastructure information industrial gather future functionality extend entity download deployment datum conduct collection citation attack asset approach additional

write window variant valid utilize use updateexe update temporary target system stop software snakehose similar significant service sector rule result remote ransomware program production process platform plant perform operational network netsh multiple match masquerade manufacturing loss kill internal intend infection include implement identify healthcare firewall filename executable energy encrypt ekan eg domain disruption device deploy define communication common command citation case block background automotive associate appear

toolkit theft target sophisticated skywiper repository operational module information gather flamer flame document diagram datum country contain computer compromise collect citation builtin

work wiper window vulnerability view victim variable value utilize user use update unusable unresponsive unprotected understand unauthorized ukrainian udp transmission tool toggle tcp target system switch support supply substation subnet stval stop stay status state stage sophisticated siprotec similar shutdown shift shell service server serial sequence send select second search safeguard rtu resume result restart respond request report render remove relevant relay registry reboot read reach range proxy protocol protective process prevent power port place perform payload path parameter packet overwrite order operator operational operation operate open object normal node network monitor module mode misdirect message mask map manipulation malware maintain main loss loop look login logical link line limit leverage legitimate leave learn know item iopcbrowseserveraddressspace internal interface information infinite infect industroyer indicate include impact image iec host hardcode hard grid gather function framework force follow firmware file external exploit execute establish equipment equate environment enumerate electrical electric drive do discover disabled device determine destructive destruction design denial default datum datum da create craft control contain connection connect connect configuration componentsend component communication command com collect citation circumstance circuit channel change cause case capability byte brute breaker block backdoor available automate attempt attacker attack adversary address add adapter actual activate access ability

window variety variant unusable unbootable type tool threat terminate target system stop standalone setup service security render record ransomware random process overwrite observe nonstandard master malware loss look log leave incorporate file evolve event erase different destruction design deletion delete datum cyber component citation boot attack application additional actor able

window view tie system switch result report recover ransomware productivity production operation manufacturing manufacture manual loss lockergoga location infection industrial include impact firm european control company citation attempt attack

wormlike wiper window vulnerability vaccine think system supply structure start spread specific smbv service result recoverable ransomware purpose production network meet mean manufacture malware main loss intend infect industrial inability halt goldeneye form feature facility exploitation exploit encrypt disrupt disk destroy demand datum contain computer compromise citation attacker attack appear

worm violate value utilize user use untouched unit und trigger trcv transfer time tcon task target system store stop start service send scan run receive program process pou port poke plcblaster piece output original network native module modify manipulate management loop locate load listen limit initiate infect include implement impact image function find execution execute executable error endless enable device detect destroy denial cycle copy connection condition communication code citation check change buffer block attempt arbitrary api

zip window victim utilize user use transportation theft terminate target system stop sodin similarity share service server sensitive send sector search script run revil remote ransomwareasaservice ransomware raas protocol process post payload organization operate network message masquerade manufacture malware malicious loss locate list link inject include ib group generate gain file field family exist exfiltrate execute equipment encrypt email electric datum connect configuration configurable communicate code click citation attachment access

window target similarity shop share server resource rely ransomware process plan paper order open manufacturing loss lose floor fin exist environment enterprise design code citation attack apr

zeroday xpcmdshell wstuxnet write work window willing way watchdog vulnerabilitie view version variable valve value utilize user use update unknown uninfected undetected unauthorized type trigger transfer time thread temperature task target table system stuxnet string store stop stick step statement state start standard spread speed specify specific special spdumpdbilog sophisticated software sniff sniff situation simatic set server sequence send selfreplicate second search sdb save run routine rootkit responsible resource request reprogram representation report replication replay replace rename removable remote rely refer recording record receive read protection property propagate project program profibus processor process probe primitive prevent port piece physical peripheral perform password pass party particular parse parameter packet overwrite override output original order optimize operator operation operating operate open number notice new network need nearby native multiple motor monitor module modify minute medium mechanism mean maximum masquerade manufacture manipulation manipulate manager malware malicious main magic location load legitimate large know interval interface intercept instruction installation insider insert input inhibit information infection infect industrial include inappropriate image identify hooking hook hex hardcode handle generate function frequency frame form follow fly find file field fake extract exploitation exist execution execute executable example examine evade equal environment enumerate ensure editor early dword drive dll distribute discover different device determine detection depend default datum database data damage cycle current critical credential create cpu count copy coprocessor converter control contractor continue contain contact consist configure configuration condition computer compromise component complex communication command code clock citation characteristic change certain cause carry cab bus burst bring block binary behavior basic base attempt associate assign area apply appear api alter allow addition act account access able

write vulnerability version value utilize use upload unsafe udp tsprogstate tshipy tshiexplwriteramex tscnamespy trilogexe trigger table system support supervisor state standalone specific software shellcode separate send script safety run reset reprogram relate regulation register region reference reconstruct read ramrom pyexe protocol program processor privilege primitive previous preform powerpc port pointer persist perform payload packet operation operate normal network native module modify memory mean masquerade malware main loss look logic log leverage interact integrity instance insecurelywritten injector injectbin inject include implement implant imainbin hook hazard handler halt gain functionality function framework firmware find file fail extract exploitation exploit execution execute executable evasion environment employ dummy download disable diagnostic device detection detect definition default datum cycle custom create craft controller continuous contain consistency configure configuration condition component compile communication communicate command code citation checksum check change capable capability byte build broadcast body attempt attack argument arbitrary api antiforensic analyze allow allocation affect address add achieve able ability

website web versatile use traffic theft support ssler specific socket sniff sniffer sniff service send scan request redirect raw protocol port platform pass packet outgoing operation network multistage monitoring monitor module modular middle manipulate man malware look log local listen legitimate large iptable ip intercept intelligencecollection inspect information infect harvesting device destructive destine credential connection configure communication collect citation capability byte basic authentication attack allow address access

wormlike window wcry wannacrycitation wanacry vulnerability uscert transfer spread smbv service network mean infect industrial global feature exploitation exploit eternalblue country contain computer citation attack affect