Last December, hackers with suspected ties to Russia caused a power outage in Ukraine in a deliberate attempt to leave households without electricity during what's typically one of the coldest months of the year. Now, the advanced malware that triggered the power failure has been found in the wild. This discovery is prompting concerns that the attack tools could be repurposed or reused in new sabotage operations, possibly by unrelated hacking groups.

"Crash Override," as security firm Dragos has named the tool platform , is the first known malware framework designed to attack electric grid systems. Dragos researchers said it was used successfully in what may have been a dress rehearsal on a December 17 hack on an electric transmission substation in Kiev. While the Kiev outage lasted only a few hours, several features of the malware that weren't turned on in the December hack have the potential to cause disruptions that persist for as long as a week. Crash Override is a completely new platform that was far more advanced than the general-purpose tools the same group used to attack Ukraine's power grid in December 2015

What makes Crash Override so sophisticated is its ability to use the same arcane technical protocols that individual electric grid systems rely on to communicate with one another. As such, the malware is more notable for its mastery of the industrial processes used by global grid operators than its robust code. Its fluency in the low-level grid languages allowed it to instruct Ukrainian devices to de-energize and re-energize substation lines, a capability not seen in the attack a year earlier that used a much cruder set of tools and techniques. The concern is that "Industroyer"—the other name given to the malware—can be used against a broad range of electric systems around the world.

In a separate report published Monday, researchers from antivirus provider Eset explained:

Industroyer is a particularly dangerous threat, since it is capable of controlling electricity substation switches and circuit breakers directly. To do so, it uses industrial communication protocols used worldwide in power-supply infrastructure, transportation control systems, and other critical infrastructure systems (such as water and gas). These switches and circuit breakers are digital equivalents of analogue switches; technically they can be engineered to perform various functions. Thus, the potential impact may range from simply turning off power distribution, cascading failures and more serious damage to equipment. The severity may also vary from one substation to another, as well. Needless to say, disruption of such systems can directly or indirectly affect the functioning of vital services. Industroyer's dangerousness lies in the fact that it uses protocols in the way they were designed to be used. The problem is that these protocols were designed decades ago, and back then industrial systems were meant to be isolated from the outside world. Thus, their communication protocols were not designed with security in mind. That means that the attackers didn't need to be looking for protocol vulnerabilities; all they needed was to teach the malware "to speak" those protocols.

Joe Slowik, the Dragos researcher who led the investigation into Crash Override, told Ars that he located the malware after colleagues at Eset provided the cryptographic hashes of some of the malware they believed was used in the attacks. Asked if that meant the Crash Override code was available to other potential hacker groups, Slowik wrote: "Yes, this is true for those with access to particular repositories of commercial data. Now that this information is public and information (such as file hashes) are in the hands of the broader community, it is reasonable to expect that others will obtain samples and analyze them for non-defensive purposes."

Damage amplifiers

The fluency in at least four international communications protocols used in electric grids is a testament to the "tradecraft" of Crash Override. The mastery means that the team that developed the malware had extensive experience with the way electric grid systems work.

The platform combined that expertise with more traditional malware techniques that could amplify the damage. One option causes targeted systems to report incorrect information after an outage has been caused, such as showing a circuit breaker is closed when it's really open. The information can be falsified in a way that prevents system operators from successfully troubleshooting the cause of the failure.

A second potentially more severe amplifier attack can neutralize protective systems by preventing one relay from communicating with another. The attack works by exploiting a known vulnerability in a control system manufactured by Siemens. The option exploiting the Siemens SIPROTEC vulnerability was likely included because the device was used by the Ukrainian site targeted last December. Dragos said the amplifying attack would likely not be effective because it wasn't scalable, meaning it didn't appear to work against large numbers of devices at once. Still, its presence is significant because such bugs can easily be fixed in updates. More important, the attack demonstrates an approach that uses multiple techniques to expand the destructive capabilities of the malware.

Aside from its ability to interoperate with existing electric grid equipment, Crash Override appears typical of much of the professionally developed malware found in the wild these days. Command servers that issue commands are mostly obscured using the Tor anonymity network. Crash Override also contains a spare backdoor mechanism that attackers can use to maintain control of infected systems in the event the primary backdoor is discovered and removed. Crash Override also includes a data wiper component attackers can use to destroy evidence of the attack.

Sandworm

Dragos said the people who developed Crash Override have direct ties to a hacking group called "Sandworm." Many researchers suspect Sandworm is Russian, based on its choice of targets, technical expertise, and the specific malware the group has used over the years. In 2014, researchers with security firm iSIGHT Partners uncovered a hacking campaign that company researchers said was the work of Sandworm that targeted NATO, the Ukrainian and Polish governments, and European Industries. One of the hacking group's calling cards was BlackEnergy, a tool that was once used in denial-of-service attacks but was later used in espionage campaigns.

A revamped version of BlackEnergy was one of two pieces of malware found on the Ukrainian computers compromised in the 2015 attack. The attackers used BlackEnergy3 to break into the corporate networks of the targeted power companies and then further encroach into the supervisory control and data acquisition systems the companies used to generate and transmit electricity. Based on the reconnaissance BlackEnergy3 performed, the attackers were able to use legitimate functionality commonly found in power distribution and transmission to trigger a failure that caused more than 225,000 people to go without power for more than six hours.

Crash Override would appear to be a slightly more evolved manifestation of that reconnaissance. Its modular design means that individual pieces can be removed and added as needed to target individual electrical grids, or it means Crash Override could possibly extend its reach into new industries. While comparisons to Stuxnet—the US- and Israeli-developed worm that targeted Iran's nuclear program—are exaggerated, the existence of the platform is nonetheless significant, particularly if newer, improved versions become more widely available or used.