What is Industroyer2 and how does it differ from the original Industroyer malware?

Industroyer2 is a variant of the Industroyer malware family, deployed as a single Windows executable (108_100.exe) and executed via a scheduled task. Unlike the original Industroyer from 2016, which was a fully modular platform supporting multiple ICS protocols, Industroyer2 only implements the IEC-104 protocol to communicate with industrial equipment such as protection relays in electrical substations. Industroyer2 is highly configurable, with its configuration hardcoded in the executable, whereas the original Industroyer stored configuration in a separate .INI file. This means attackers must recompile Industroyer2 for each new victim or environment.

How was Industroyer2 deployed in real-world attacks?

Industroyer2 was deployed as a single Windows executable named 108_100.exe and executed using a scheduled task. The PE timestamp suggests attackers planned their attack for more than two weeks before deployment.

How is Industroyer2's configuration managed compared to the original Industroyer?

Industroyer2 contains a detailed configuration hardcoded in its executable body, which drives the malware's actions. In contrast, the original Industroyer stored its configuration in a separate .INI file. This change means attackers must recompile Industroyer2 for each new victim or environment.

How often has the Industroyer malware family been deployed?

The Industroyer malware family has only been deployed twice, with a five-year gap between each version. This limited deployment suggests that the need to recompile Industroyer2 for each victim is not a significant limitation for its operators.

What similarities exist between Industroyer2 and the original Industroyer?

Industroyer2 shares a number of code similarities with the payload 104.dll of the original Industroyer. ESET assesses with high confidence that Industroyer2 was built using the same source code as the original variant.

Why is Industroyer2 considered highly configurable?

Industroyer2 is considered highly configurable because it contains a detailed configuration hardcoded in its body, allowing attackers to tailor its actions for each specific target environment. However, this also means the malware must be recompiled for each new victim.

What features does the Cymulate platform offer for threat validation?

Cymulate offers continuous threat validation through automated attack simulations, a unified platform combining Breach and Attack Simulation (BAS), Continuous Automated Red Teaming (CART), and Exposure Analytics. It provides attack path discovery, automated mitigation, AI-powered optimization, complete kill chain coverage, and an extensive threat library with over 100,000 attack actions updated daily.

How does Cymulate's Threat Validation solution differ from manual pen tests and traditional BAS?

Cymulate's Exposure Validation provides automated, continuous security testing with a library of over 100,000 attack actions aligned to the full kill chain and MITRE ATT&CK, updated daily. Unlike infrequent manual pen tests or traditional BAS tools, Cymulate offers easy, out-of-the-box control integrations and automated mitigation, pushing threat updates directly to security controls for actionable remediation.

What is Cymulate's 'Threat (IoC) updates' feature and how does it improve threat resilience?

The 'Threat (IoC) updates' feature provides recommended Indicators of Compromise (IoCs) that can be directly applied to security controls. These IoCs can be exported via the UI or API in plain text or STIX format, enabling control owners to quickly build defenses against new threats and improve overall threat resilience.

What integrations does Cymulate support?

Cymulate integrates with a wide range of security technologies, including Akamai Guardicore (Network Security), AWS GuardDuty (Cloud Security), BlackBerry Cylance OPTICS, Carbon Black EDR, Check Point CloudGuard, Cisco Secure Endpoint, CrowdStrike Falcon, Wiz, SentinelOne, and more. For a complete list, visit the Partnerships and Integrations page.

How does Cymulate Exposure Validation support a threat-informed defense strategy?

Cymulate Exposure Validation continuously validates security controls against the latest threats and attack techniques, ensuring that defenses are always prepared for current and emerging adversarial methods.

What are the key capabilities and benefits of using Cymulate?

Cymulate delivers continuous threat validation, unified platform capabilities, attack path discovery, automated mitigation, AI-powered optimization, and complete kill chain coverage. Key benefits include up to a 52% reduction in critical exposures, a 60% increase in team efficiency, 40X faster threat validation, and an 81% reduction in cyber risk within four months.

Who can benefit from using Cymulate?

Cymulate is designed for CISOs and security leaders, SecOps teams, Red Teams, and Vulnerability Management teams across organizations of all sizes and industries, including finance, healthcare, retail, media, transportation, and manufacturing.

What are some real-world case studies demonstrating Cymulate's effectiveness?

Hertz Israel reduced cyber risk by 81% in four months using Cymulate. Nemours Children's Health improved detection and response in hybrid and cloud environments. Saffron Building Society proved compliance with financial regulators. More case studies are available on the Cymulate Customers page.

How does Cymulate address the needs of different security personas?

Cymulate tailors its solutions for CISOs (providing metrics and risk prioritization), SecOps teams (automating processes and improving efficiency), Red Teams (offensive testing with a large attack library), and Vulnerability Management teams (automated validation and prioritization).

What feedback have customers given about Cymulate's ease of use?

Customers consistently praise Cymulate for its intuitive interface and ease of use. For example, Raphael Ferreira, Cybersecurity Manager, stated, 'Cymulate is easy to implement and use—all you need to do is click a few buttons, and you receive a lot of practical insights into how you can improve your security posture.'

How quickly can Cymulate be implemented?

Cymulate is designed for rapid deployment, operating in agentless mode with no need for additional hardware or complex configurations. Customers can start running simulations almost immediately after deployment. Comprehensive support and educational resources are available to assist with onboarding.

What core problems does Cymulate solve for security teams?

Cymulate addresses overwhelming threat volumes, lack of visibility, unclear risk prioritization, and resource constraints by providing continuous threat validation, exposure prioritization, improved resilience, operational efficiency, and collaboration across teams.

What are the most common pain points Cymulate customers face?

Common pain points include fragmented security tools, resource constraints, unclear risk prioritization, cloud complexity, communication barriers, inadequate threat simulation, operational inefficiencies in vulnerability management, and post-breach recovery challenges. Cymulate addresses these with automation, integration, and actionable insights.

How does Cymulate help organizations prioritize risk and exposures?

Cymulate validates exploitability and ranks exposures based on prevention and detection capabilities, business context, and threat intelligence, enabling organizations to focus on the most critical vulnerabilities.

How does Cymulate address challenges in cloud security validation?

Cymulate secures hybrid and cloud infrastructures through automated compliance and regulatory testing, helping organizations address new attack surfaces and validation challenges introduced by cloud environments.

What is Cymulate's pricing model?

Cymulate operates on a subscription-based pricing model tailored to each organization's requirements. Pricing depends on the chosen package, number of assets, and scenarios selected. For a detailed quote, schedule a demo with the Cymulate team.

What security and compliance certifications does Cymulate hold?

Cymulate holds SOC2 Type II, ISO 27001:2013, ISO 27701, ISO 27017, and CSA STAR Level 1 certifications, demonstrating adherence to industry-leading security and privacy standards.

How does Cymulate ensure data security and privacy?

Cymulate ensures data security through encryption in transit (TLS 1.2+) and at rest (AES-256), secure AWS-hosted data centers, a tested disaster recovery plan, and a strict Secure Development Lifecycle (SDLC). The platform is GDPR compliant and includes mandatory 2FA, RBAC, IP address restrictions, and TLS encryption for its Help Center.

How does Cymulate compare to other security validation platforms?

Cymulate stands out with its unified platform combining BAS, CART, and Exposure Analytics, continuous 24/7 threat validation, AI-powered optimization, complete kill chain coverage, ease of use, and proven results such as a 52% reduction in critical exposures and an 81% reduction in cyber risk within four months.

What are the advantages of Cymulate for different types of users?

CISOs benefit from quantifiable metrics and risk prioritization, SecOps teams from automation and efficiency, Red Teams from a large attack simulation library, and Vulnerability Management teams from automated validation and prioritization.

What support options are available for Cymulate customers?

Cymulate provides email support, real-time chat support, a knowledge base with technical articles and videos, webinars, e-books, and an AI chatbot for querying the knowledge base and creating AI templates.

What are the technical requirements for deploying Cymulate?

Cymulate operates in agentless mode, requiring no additional hardware or dedicated servers. Customers are responsible for providing necessary equipment, infrastructure, and third-party software as per Cymulate’s prerequisites. The platform is designed for seamless integration into existing workflows.

What is Gartner's prediction regarding threat exposure findings by 2028?

Gartner predicts that by 2028, more than half of threat exposure findings will result from nontechnical vulnerabilities, requiring a fundamental shift in security priorities as these risks surpass traditional IT concerns.

How can I access the Threat Exposure Validation Impact Report 2025?

You can download the full Threat Exposure Validation Impact Report 2025 for detailed insights on CTEM, automation and AI, cloud exposure validation, and threat prevention optimization.

What types of cyber threats does the financial services sector face?

The financial services sector faces sophisticated cyber threats such as ransomware, phishing, and advanced persistent threats (APTs), requiring robust security controls for both internal systems and customer-facing applications.

Where can I watch the video 'npm Under Siege: Worms, Toolchains and the Next Evolution of Supply Chain Attacks'?

You can watch the video npm Under Siege: Worms, Toolchains and the Next Evolution of Supply Chain Attacks on Cymulate's official YouTube channel.

Industroyer2: Industroyer reloaded

April 14, 2022

Industroyer2 was deployed as a single Windows executable named 108_100.exe and executed using a scheduled task. According to the PE timestamp, suggesting that attackers had planned their attack for more than two weeks. Industroyer2 only implements the IEC-104 (aka IEC 60870-5-104) protocol to communicate with industrial equipment. This includes protection relays, used in electrical substations. This is a slight change from the 2016 Industroyer variant that is a fully-modular platform with payloads for multiple ICS protocols. Industroyer2 shares number of code similarities with the payload 104.dll of Industroyer. ESET assesses with high confidence that the new variant was built using the same source code. Industroyer2 is highly configurable. It contains a detailed configuration hardcoded in its body, driving the malware actions. This is different from Industroyer, stores configuration in a separate .INI file. Thus, attackers need to recompile Industroyer2 for each new victim or environment. However, given that the Industroyer* malware family has only been deployed twice, with a five year gap between each version, this is probably not a limitation for Sandworm operators.

Featured Resources

View More Resources

blog

When a Web Search Becomes a Backdoor: Remote Code Execution in Codex CLI via Prompt Injection and Binary Hijacking on Windows

Ilan Kalendarov, Security Research Team LeadBen Zamir, Security ResearcherElad Beber, Security Researcher As AI coding agents gain deeper access to

Data Sheet

Cymulate Vero AI

Cymulate Vero AI delivers secure, domain-specific cybersecurity AI with private infrastructure and zero customer data training.