Industroyer2 was malware aimed at high-voltage substations at a Ukrainian energy provider, scheduled to act on 8 April 2022. ESET and CERT-UA found and responded to it. ESET assessed with high confidence that the Sandworm group was responsible. The public write-up does not explain how the attackers got in.
What the malware did
ESET describes Industroyer2 as a new version of the 2016 Industroyer family. The older version was modular and spoke several industrial protocols. This one implements only IEC-104 (IEC 60870-5-104), a protocol that can reach protection relays in substations. The sample had eight device IP addresses written into it, so it was built for one specific environment rather than for general use.
That narrow design is the lesson. The attackers had studied the target network and compiled a tool to match it. ESET notes the sample was compiled on 23 March 2022, which suggests more than two weeks of planning before the scheduled run.
The wipers around it
Industroyer2 did not run alone. ESET documents CaddyWiper, a wiper loaded through a trojanized remote debugger tool. It ran on Windows machines and, later, on the machine that had run Industroyer2, with the apparent aim of removing traces. Separate wipers for Linux and Solaris systems were spread by a worm script.
So the plan had two parts: act on the control system, then destroy evidence on the IT side. A defender who only watches the control network would see one half of that plan.
What is known and what is not
Known from the ESET write-up:
- The scheduled destructive actions were set for 8 April 2022.
- ESET worked with CERT-UA to respond, remediate the affected network and protect it.
- ESET attributes the activity to Sandworm with high confidence.
Not stated in the article: how the attackers first compromised the victim, and how they moved from the IT network into the industrial control network. Treat any claim that fills that gap as unconfirmed unless it cites a primary source.
What operators can take from it
A few practical points follow from what is documented, without guessing at the missing parts.
- Know which hosts can talk to substation devices. A tool with eight hardcoded addresses only works if those addresses are reachable.
- Keep logs somewhere a wiper on the same machine cannot erase them.
- Test restoring a Windows, Linux and Solaris host, not just one platform.
- Treat remote debugging and admin tools on operator workstations as part of the attack surface.
Safeguard does not monitor substations. For the software side of an energy company, such as the build and dependency chain for internal tools, SBOM and dependency scanning can show what is installed; the free scan is at https://gold.safeguard.sh/scan.
Quick check
Did Industroyer2 cause a blackout?
According to the ESET write-up, the attack was a scheduled attempt against substations that ESET and CERT-UA responded to. The article describes an attempt to deploy the malware; it does not report a confirmed outage caused by it.
Is the initial access method known?
Not from the ESET article. It states that how the attackers compromised the victim and moved into the industrial network is not covered.
Sources
Last reviewed: 19 October 2026.
