Version 15.1 → 16.0
Software — ICS ATT&CK Changelog
Added Software
| Description |
|---|
| [Fuxnet](https://attack.mitre.org/software/S1157) is malware designed to impact the industrial network infrastructure managing control system sensors for utility operations in Moscow. [Fuxnet](https://attack.mitre.org/software/S1157) is linked to an entity referred to as the Blackjack hacking group, which is assessed to be linked to Ukrainian intelligence services.(Citation: Claroty Fuxnet 2024) |
Modified Software
| Modified Description View changes side-by-side |
|---|
| [VPNFilter](https://attack.mitre.org/software/S1010) is a multi-stage, modular platform with versatile capabilities to support both intelligence-collection and destructive cyber attack operations. [VPNFilter](https://attack.mitre.org/software/S1010) modules such as its packet sniffer ('ps') can collect traffic that passes through an infected device, allowing the theft of website credentials and monitoring of Modbus SCADA protocols. (Citation: William Largent June 2018) (Citation: Carl Hurd March 2019) [VPNFilter](https://attack.mitre.org/software/S1010) was assessed to be replaced by [Sandworm Team](https://attack.mitre.org/groups/G0034) with [Cyclops Blink](https://attack.mitre.org/software/S0687) starting in 2019.(Citation: NCSC CISA Cyclops Blink Advisory February 2022) |
Details
Dictionary Item Added
| Field | Old value | New value |
|---|---|---|
| x_mitre_platforms | ['Network', 'Linux'] |
Values Changed
| Field | Old value | New value |
|---|---|---|
| modified | 2024-03-07 18:57:15.800000+00:00 | 2024-08-15 22:01:22.169000+00:00 |
| description | [VPNFilter](https://attack.mitre.org/software/S1010) is a multi-stage, modular platform with versatile capabilities to support both intelligence-collection and destructive cyber attack operations. [VPNFilter](https://attack.mitre.org/software/S1010) modules such as its packet sniffer ('ps') can collect traffic that passes through an infected device, allowing the theft of website credentials and monitoring of Modbus SCADA protocols. (Citation: William Largent June 2018) (Citation: Carl Hurd March 2019) | [VPNFilter](https://attack.mitre.org/software/S1010) is a multi-stage, modular platform with versatile capabilities to support both intelligence-collection and destructive cyber attack operations. [VPNFilter](https://attack.mitre.org/software/S1010) modules such as its packet sniffer ('ps') can collect traffic that passes through an infected device, allowing the theft of website credentials and monitoring of Modbus SCADA protocols. (Citation: William Largent June 2018) (Citation: Carl Hurd March 2019) [VPNFilter](https://attack.mitre.org/software/S1010) was assessed to be replaced by [Sandworm Team](https://attack.mitre.org/groups/G0034) with [Cyclops Blink](https://attack.mitre.org/software/S0687) starting in 2019.(Citation: NCSC CISA Cyclops Blink Advisory February 2022) |
| x_mitre_version | 1.1 | 2.0 |
Iterable Item Added
| Field | Old value | New value |
|---|---|---|
| external_references | {'source_name': 'NCSC CISA Cyclops Blink Advisory February 2022', 'description': 'NCSC, CISA, FBI, NSA. (2022, February 23). New Sandworm malware Cyclops Blink replaces VPNFilter. Retrieved March 3, 2022.', 'url': 'https://www.ncsc.gov.uk/news/joint-advisory-shows-new-sandworm-malware-cyclops-blink-replaces-vpnfilter'} | |
| x_mitre_domains | enterprise-attack |