Summary
FrostyGoop (also tracked as BUSTLEBERM) was disclosed by Dragos on 23 July 2024. It is written in Go and interacts directly with industrial controllers over Modbus TCP (port 502) to read and modify values. Dragos describes it as the ninth ICS-specific malware ever found, and the first to use Modbus communications to achieve an impact on OT.
In January 2024 it was used against a municipal district energy company in Lviv, Ukraine. Attackers sent Modbus commands to ENCO controllers, causing inaccurate measurements and system malfunctions. That disrupted the heating supply to more than 600 apartment buildings for roughly two days in sub-zero temperatures. According to Dragos, the attackers had gained entry in April 2023 by exploiting a vulnerability in an internet-facing MikroTik router, nine months before the disruption.
Its significance is architectural, not incidental. Modbus has no authentication, so any host that can reach port 502 can issue commands with full authority. No exploit of the controller is needed.
Apa maksudnya untuk Malaysia? 🇲🇾
Modbus TCP is one of the most widely deployed industrial protocols. It’s common in utilities, manufacturing lines and building management systems, including in Malaysian commercial and industrial estates. Dragos cites more than 46,000 systems worldwide communicating over Modbus. FrostyGoop shows that an attacker with network reach to controllers needs no vulnerability in them: the protocol is the vulnerability.
- Check exposure first. Verify that no Modbus device in your IP space is reachable from the internet; public scan services such as Shodan and Censys index them. Also confirm none is reachable from the corporate network.
- Patch and harden edge routers. FrostyGoop’s entry point was an internet-facing router, the same class of edge-device weakness behind the 2025 Poland energy attack and the FortiBleed campaign in Malaysia.
- District cooling is Malaysia’s analogue to Lviv’s district heating. Building and district-cooling controllers deserve the same scrutiny as utility SCADA.
Details / TTPs (ATT&CK for ICS)
| Technique | Name | Observed behavior |
|---|---|---|
| T0869 | Standard Application Layer Protocol | Modbus TCP (port 502) used to talk to controllers |
| T0801 | Monitor Process State | Reads holding registers from ENCO controllers |
| T0836 | Modify Parameter | Setpoint/telemetry manipulation causing inaccurate readings and loss of heating |
Detection guidance
Prevention on legacy Modbus is often impossible, so frame defence as detection and segmentation:
- Baseline Modbus function-code usage per device, and alert on writes from unexpected sources, especially to devices that normally only receive reads.
- Enforce IT/OT segmentation so port 502 is never reachable from corporate or internet space.
- Monitor edge routers for unexpected configuration changes and new administrative access.
IoCs
Indicators are published in Dragos’ FrostyGoop report. Rectifyq’s MISP-ICS-OT feed carries OT threat events for ingestion.
References
- Cybersecurity Dive, Dragos warns of novel malware targeting industrial control systems (23 Jul 2024): https://www.cybersecuritydive.com/news/dragos-malware-industrial-control-systems/722125/
- MITRE ATT&CK, FrostyGoop (S1165): https://attack.mitre.org/software/S1165/