How Russia-Linked Malware Cut Heat to 600 Ukrainian Buildings in Deep Winter

Russia-linked malware targeted a heating utility in Lviv, Ukraine, cutting off heat and hot water to 600 buildings for 48 hours in January. The attack used a new type of malware named FrostyGoop, allowing hackers to manipulate temperature readings and disrupt the heating system. The malware interacted with industrial control systems via the Modbus protocol, a common but insecure communication method. The hackers gained access to the network in April 2023 through a vulnerable router and remotely targeted ENCO control devices. While the attack has not been officially linked to the Russian government, experts believe it fits into Russia's broader strategy of targeting Ukrainian critical infrastructure. The incident highlights the evolving tactics in Russia's decade-long campaign against Ukraine, combining physical and digital attacks to undermine the country's resilience. The attack on the heating utility in the midst of winter exemplifies the psychological warfare aimed at weakening Ukraine's resolve to resist Russian aggression.