Dragos-FrostyGoop-ICS-Malware-Intel-Brief.pdf

Dragos analyzes FrostyGoop, a Golang ICS-focused malware that uses Modbus TCP (port 502) to read and modify holding registers; the report links FrostyGoop to a confirmed January 2024 attack in Lviv, Ukraine that disrupted heating for 600+ buildings, details malware capabilities, configuration and network indicators, and provides OT-specific detection and mitigation guidance including SANS 5 critical controls.