
In January 2024, hackers turned off the heating in 600 apartment buildings in Lviv, leaving residents without heat for two days in sub-zero temperatures.
Researchers from the cybersecurity company Dragos discovered that a new type of malware called FrostyGoop allowed attackers to turn off the heating system in hundreds of homes in Lviv. This software affected the energy company that provided the central heating, causing the heating control system to fail. The incident occurred between January 22 and 23, 2024, when the temperature in Lviv reached -2°C. According to researchers, it took almost two days to restore the system.
The attack began back in April 2023, when attackers used a vulnerability in a Mikrotik router to gain access to the victim’s network. Later, they established a web shell tunnel and obtained user credentials. On the day of the attack, the attackers initiated L2TP connections to IP addresses based in Moscow.
The incident in Lviv highlights the seriousness of the threats that arise due to vulnerabilities in critical infrastructure management systems. The use of the FrostyGoop malware, which is able to interact with ICS devices via the Modbus TCP protocol, shows the need to strengthen cyber security in the OT sector.