Gold Open Source
ExplorePackagesVulnerabilitiesMCP Servers
Login
Gold Open Source

The authoritative source for production-ready open-source components. Every package, container image, AI model, and MCP server undergoes rigorous verification for security, malware, and license compliance.

Explore Gold

  • Explore Everything
  • Packages
  • Gold Packages
  • Container Images
  • AI Models
  • MCP Servers
  • Agent Skills
  • Chip Manufacturers

Security Data & Tools

  • Scan Your Dependencies
  • Trending Threats
  • Threat RSS Feeds
  • CVE Database
  • Actively Exploited (KEV)
  • SGZ Zero-Days
  • CWE Index
  • MITRE ATT&CK
  • Malicious Packages
  • Security Glossary
  • Supply-Chain Report
  • Developers (API & Badge)
  • Chrome Extension
  • Credits & Data Sources

Products

  • The Platform
  • ESSCM
  • Portal
  • TPRM
  • OSM
  • Cowork
  • Code / Runner
  • Guard

Use Cases

  • Know Your Software
  • Auto-Fix Vulnerabilities
  • Asset Discovery
  • AI Governance
  • MCP Server Security
  • Supply Chain Compliance
  • Zero-Day Discovery
  • All Use Cases

Company

  • About
  • Pricing
  • Blog
  • Documentation
  • Safeguard Academy
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 Gold Open Source. All rights reserved.

Built with care bySafeguard
Home/ATT&CK/Software/S0604
MITRE ATT&CK Malware

Industroyer (S0604)

CRASHOVERRIDEWin32/Industroyer
ShareXLinkedInRedditHN

[Industroyer](https://attack.mitre.org/software/S0604) is a sophisticated malware framework designed to cause an impact to the working processes of Industrial Control Systems (ICS), specifically components used in electrical substations.(Citation: ESET Industroyer) [Industroyer](https://attack.mitre.org/software/S0604) was used in the attacks on the Ukrainian power grid in December 2016.(Citation: Dragos Crashoverride 2017) This is the first publicly known malware specifically designed to target and impact operations in the electric grid.(Citation: Dragos Crashoverride 2018)

Platforms: Windows

▪Techniques implemented (44)

T1543.003Windows ServiceT1485Data DestructionT1046Network Service Discovery

▪Used by groups (1)

G0034Sandworm Team
S0604 on MITRE ATT&CK →
T1078Valid Accounts
T1554Compromise Host Software Binary
T1105Ingress Tool Transfer
T1018Remote System Discovery
T1083File and Directory Discovery
T1572Protocol Tunneling
T1016System Network Configuration Discovery
T1489Service Stop
T1041Exfiltration Over C2 Channel
T1071.001Web Protocols
T1090.003Multi-hop Proxy
T1082System Information Discovery
T1499.004Application or System Exploitation
T1140Deobfuscate/Decode Files or Information
T1012Query Registry
T1027Obfuscated Files or Information
T0846Remote System Discovery
T1701.002Windows Command Shell
T0884Connection Proxy
T0814Denial of Service
T1691.002Reporting Message
T0888Remote System Information Discovery
T0881Service Stop
T1691.001Command Message
T0831Manipulation of Control
T1695.001Serial COM
T0801Monitor Process State
T0800Activate Firmware Update Mode
T0840Network Connection Enumeration
T0816Device Restart/Shutdown
T0806Brute Force I/O
T0813Denial of Control
T0829Loss of View
T0815Denial of View
T0809Data Destruction
T0827Loss of Control
T0846.001Port Scan
T1692.001Command Message
T0802Automated Collection
T0832Manipulation of View
T0837Loss of Protection

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.