FrostyGoop and the cyber cold war: how malware cut off critical infrastructure in Lviv

What happened in Lviv

Dragos, a firm that specializes in industrial systems security (ICS and OT), analyzed the incident and identified the malware behind the attack, naming it FrostyGoop. The attacker did not reach for a sophisticated exploit. They used Modbus, an ordinary industrial protocol.

This was not a data leak or a locked inbox. It was a physical result of a cyberattack: cold apartments in the middle of winter. That is exactly what separates an attack on OT from a typical IT incident.

Modbus, a protocol with no authentication

Modbus is one of the most common communication protocols in industry, designed in 1979. Despite its age it is still everywhere, because it is simple and rarely fails. Devices from practically every major automation vendor support it.

The catch is that Modbus predates the moment network security became a topic. Its TCP/IP version has no authentication and no authorization. To send a command to a device, you only need its IP address, a port (usually 502), and the device identifier.

How FrostyGoop works

FrostyGoop is a Windows program written in Go that uses publicly available Modbus libraries. It behaves like an ordinary Modbus TCP/IP client: it can read and overwrite device registers.

That is where its power lies. Registers hold the parameters that control how industrial equipment runs. By writing wrong values into them, an attacker changes how the hardware actually behaves. Worse, FrostyGoop traffic looks like legitimate Modbus communication, so it is hard to tell apart from normal system activity.

According to Dragos, the attackers most likely got into the victim's network through a flaw in a router, then sent malicious commands straight to the ENCO heating system controllers. They also remotely downgraded the devices, so the readings turned inaccurate and operators lost visibility into what was happening.

How dangerous this kind of attack is

The biggest risk lies with Modbus TCP/IP devices exposed straight to the internet. Since the protocol asks for no authentication, anyone who reaches them can try to change register values.

The scale is real. Dragos estimated that of roughly 640,000 devices with port 502 open on the internet, about 46,000 may be vulnerable. The second tier of risk is devices on internal networks: once an attacker is inside, they become an easy target.

How to protect Modbus and OT devices

One rule matters most: industrial devices should not be directly reachable from the internet. Beyond that, add further layers of protection, mapped to the mitigations in MITRE ATT&CK for ICS.

What FrostyGoop teaches

FrostyGoop showed that an attack on OT is not theory. A simple protocol without authentication, a device exposed to the network, and a router flaw were enough to cut heat to hundreds of buildings.

For anyone who owns critical infrastructure, the takeaway is practical: OT security is not an add-on to IT, it is a condition for staying operational and keeping people safe.

Want to check whether your industrial devices are exposed and open to an attack like this? Book a free consultation. We will map the attack surface of your OT environment and tell you what to secure first.