Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Between June 2023 and April of 2024 the allegedly Ukrainian state-sponsored group Blackjack carried out a destructive attack utilizing their FuxNet malware against the Moskollektor company responsible for (among other things) monitoring water and sewage sensor networks in Moscow.
3 distinct techniques documented for this family, organized by ATT&CK tactic.
the user manual suggests retrieving firmware updates via FTP from a Telnet or SSH shell on the serial converter itself... The iRZ RUH2 3G is similarly Linux-based and has the ability to push firmware updates via its web interface, though SSH shell access is possible too... FuxNet malware over either SSH or a proprietary sensor management protocol
The CERT-PL report mentions two cases of attackers connecting to IED's FTP service using default credentials in order to delete essential files... the attacker compromised them via SSH using root accounts with default credentials in order to subsequently wipe the filesystem.
The attacker compromised them via SSH using root accounts with default credentials in order to subsequently wipe the filesystem... Wipers can focus on erasing general or specific disk contents but also on structural metadata such as disk partition tables (MBR, GPT). | The easiest way to wipe raw disk contents or structure metadata... After raw disk access has been obtained, the disk can be wiped in several ways including: Simply overwriting its contents with any sort of pattern
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
OT-focused destructive malware that targeted sensor gateways, used embedded wiping techniques, and then performed flash cycle exhaustion to permanently damage device storage.
A destructive malware used against Linux-based cellular routers and gateways in Russian water and sewage monitoring infrastructure. It locked out remote access, shut down communications, wiped filesystems through multiple methods, and attempted to physically destroy NAND flash through cycle exhaustion.
Referenced as background on recent OT malware discoveries.
Wiper malware used in destructive attacks (described in the content as "Stuxnet on steroids").
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.