ALT-37 · Analysis · 23 Oct 2026
Industroyer and Industroyer2: malware that speaks grid
In 2016 a malware framework switched off part of Kyiv's power by talking directly to substation equipment. In 2022 its successor was found and stopped before its scheduled launch. Two attacks, one lesson.
- 17 Dec 2016Outage at a substation north of Kyiv.
- Jun 2017ESET publishes its analysis of Industroyer.
- Apr 2022Industroyer2 discovered with CERT-UA; the planned attack for 8 April is averted.
What changed from 2015
The 2015 attackers drove the utilities' own systems by hand. Industroyer automated the attack by speaking the protocols that substation devices use — tools that could, in principle, be reused against grids elsewhere. Industroyer2 was a leaner version targeting only IEC 104, configured for one specific target.
Our reading
Analysis — Altumptic's interpretation of the sources below.
- Industrial protocols designed for trusted networks authenticate nothing.
- Detection at the right moment turned a 2022 blackout into a non-event.
- Adversaries iterate; defenders who share findings iterate faster.
What to do
- Monitor industrial protocol traffic for commands from unexpected sources.
- Segment control networks so that IT compromise does not reach substations.
- Share indicators with national CERTs and sector peers quickly.
Sources
- ESET — Industroyer: biggest threat to industrial control systems since Stuxnet (2017)
- ESET — Industroyer2: Industroyer reloaded (2022)
Altumptic has no involvement in these incidents and no non-public information about them. Figures are as reported by the sources above on the dates given.
Cite this entry
Altumptic Lab (2026). ALT-37 — Industroyer and Industroyer2: malware that speaks grid. 23 Oct 2026. altumptic.com/research/industroyer-2016-2022