Industroyer / CRASHOVERRIDE Substation Lab
In December 2016 the malware known as Industroyer (ESET) or CRASHOVERRIDE (Dragos) opened breakers at a Kyiv transmission substation by sending valid control commands over IEC 60870-5-104, IEC 61850 MMS/GOOSE and OPC DA — protocols that do not authenticate the sender — and knocked out Siemens SIPROTEC relays with a DoS (CVE-2015-5374). This lab puts you on the defending side: watch a one-line diagram trip and reclose as you work 12 events, and for each one pick the detection or response. It covers Industroyer2 (2022) too. Defender lens only — observed behaviour, detection and mitigation from public reporting, no exploit code or payloads.
The real job. More noise, a tighter clock.
Event 1 / 12
An unfamiliar station enumerates the RTU
At the transmission substation, a host on the control LAN opens an IEC 60870-5-104 session to an RTU and reads out its entire information-object list — every measurement and control point — then goes quiet.
Published fact: Industroyer’s 104 module first enumerated the RTU’s information objects to learn which addresses mapped to breaker controls before issuing any command. 104 carries no authentication, so a reachable host can simply ask.
Best detection or response?
Pick the detection or response for this event.
Substation response
Work the real 2016 Ukraine attack and its 2022 successor across 12 events. Watch the one-line diagram trip breakers, then pick the detection or response. Inspect the command path to see why the protocol accepted the command.
So far: 0 / 12 events handled.
Why these protocols accept the command
IEC 60870-5-104 (TCP 2404) and its serial parent 101 carry no authentication; IEC 61850 MMS (TCP 102) and GOOSE (L2 multicast) have no message authentication by default.
So the command is valid protocol from an unauthorised sender. You cannot fix the protocol — you control reachability and inspect content.
Live arena
4 activeadversary staging…
What this lab is
- A free, browser-based substation defense lab built on the real 2016 Ukraine grid attack (Industroyer / CRASHOVERRIDE) and its 2022 successor Industroyer2.
- Work 12 events on a live one-line diagram as breakers trip and reclose: RTU enumeration and breaker commands over IEC 60870-5-104, control writes over IEC 61850 MMS, spoofed GOOSE status, OPC DA writes, and the SIPROTEC relay DoS via CVE-2015-5374.
- For each event you choose the detection or response — protocol-aware DPI, source allow-listing, segmentation, baselining the IED data model, patching the relay DoS, or falling back to local manual control.
- The through-line is a protocol fact: IEC 101/104 and IEC 61850 (MMS/GOOSE) have no native authentication, so the malware opened breakers with valid commands from an unauthorised sender.
- Scored and graded S–D. Strictly educational and defender-focused — observed behaviour, detection and mitigation from public reporting (ESET, Dragos, CISA/CERT-UA). No exploit code or payloads.
Why the grid protocols accept the command
Industroyer is notable precisely because it did not need software vulnerabilities to open breakers. It used the grid's own telecontrol protocols as designed. IEC 60870-5-104 (the TCP/IP form on port 2404, with its serial parent 101) and IEC 61850 — MMS over TCP 102 and GOOSE as Layer-2 multicast on the station bus — all assume a trusted, private network and carry no native authentication of the sender. A single-command ASDU that opens a breaker is indistinguishable, to the device, whether it came from the real master or an intruder on the same segment.
The 2016 malware was modular: separate payloads spoke 101, 104, 61850 and OPC DA, it enumerated RTU information objects and IED data models to learn the breaker addresses, and it ran the open commands in a loop so operator recloses were immediately undone. A separate module used CVE-2015-5374 to make vulnerable SIPROTEC relays unresponsive, removing protection. Operators ultimately restored power by switching to manual, local operation — taking the hostile remote path out of the loop.
Industroyer2, seen in 2022 and analysed by ESET and CERT-UA, dropped the modular design for a single IEC 104 component with the target substation's addresses and timing compiled into the binary; it was detected and blocked before the intended outage. The lesson is unchanged across both: you cannot make these protocols authenticate, so you control who can reach the field devices, inspect the control traffic, and keep a manual fallback.
Frequently asked questions
What is the Industroyer / CRASHOVERRIDE lab?
A free, in-browser exercise based on the December 2016 cyberattack that cut power in Kyiv, Ukraine, using the malware known as Industroyer (ESET) or CRASHOVERRIDE (Dragos), plus its 2022 successor Industroyer2. You work a series of events on a substation one-line diagram while breakers trip and reclose, and for each event you pick the right detection or response. It is a defender-lens teaching simulation built from public reporting — no exploit code and no payloads.
Which protocols did Industroyer use, and why did they work?
Industroyer had modular payloads speaking IEC 60870-5-101 and IEC 60870-5-104 (the serial and TCP variants used widely in European transmission), IEC 61850 (MMS over TCP 102 and GOOSE, the station-bus protocols), and OPC DA. It opened breakers by sending valid control messages — for example 104 single-command ASDUs — because none of these protocols authenticate the sender. Any host that can reach the RTUs and IEDs is implicitly trusted to command them. Industroyer2 in 2022 reduced this to a single hardcoded 104 module aimed at one substation.
What was the SIPROTEC component (CVE-2015-5374)?
Industroyer carried a denial-of-service module that exploited CVE-2015-5374 in vulnerable Siemens SIPROTEC protective relays: a specially crafted UDP packet to port 50000 made the relay unresponsive until it was manually power-cycled. Used alongside the breaker manipulation, it removed automatic protection at the moment it was most needed. It is the one Industroyer component tied to a specific published CVE; the breaker-command modules used valid protocol, not a vulnerability.
How do you actually defend against this?
Because the protocols will not authenticate, defense is about controlling reachability and inspecting content. Segment the control network and broker IT-to-OT so few hosts can speak 104/61850 to field devices at all; allow-list the legitimate master for control commands; run protocol-aware deep packet inspection for 104 control ASDUs, 61850 MMS control writes and out-of-sequence GOOSE (stNum jumps); baseline IED data models to catch reconnaissance; patch the SIPROTEC DoS and filter UDP/50000; and keep local manual operation as the fallback when the remote path is compromised — which is exactly how operators restored power in 2016.