Skip to page content

AEGLIX MIND

Intelligence for Africa and the Gulf

Reviewed campaign intelligence

FrostyGoop Incident

Historical · OTHER · Global

Last reviewed:

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. FrostyGoop Incident took place in January 2024 against a municipal district heating company in Ukraine. Following initial access via likely exploitation of external facing services, FrostyGoop was used to manipulate ENCO control systems via legitimate Modbus commands to impact the delivery of heating services to Ukrainian civilians.(Citation: Dragos FROSTYGOOP 2024)(Citation: Nozomi BUSTLEBERM 2024)

This is a historical record and does not establish current campaign activity.

Threat actor
Not established
Attribution confidence
Not established
First documented activity
2024-01-01
End date
Not established
Estimated victims
Not established
Reported impact
Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

  1. Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

    Source: MITRE ATT&CK

  2. Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

    Source: MITRE ATT&CK

MITRE ATT&CK techniques

  • T1003.002 · Security Account Manager

    Credential Access — During FrostyGoop Incident, the adversary retrieved the contents of the Security Account Manager (SAM) hive in the victim environment for credential capture.(Citation: Dragos FROSTYGOOP 2024)

  • T1071 · Application Layer Protocol

    Command And Control — During FrostyGoop Incident, the adversary initiated Layer Two Tunnelling Protocol (L2TP) connections to Moscow-based IP addresses.(Citation: Dragos FROSTYGOOP 2024)

  • T1505.003 · Web Shell

    Persistence — FrostyGoop Incident deployed a ReGeorg variant web shell to impacted systems following initial access for persistence.(Citation: Dragos FROSTYGOOP 2024)

  • T1689 · Downgrade Attack

    Defense Impairment — During FrostyGoop Incident, the adversary downgraded firmware on victim devices in order to impair visibility into the process environment.(Citation: Dragos FROSTYGOOP 2024)

  • T1190 · Exploit Public-Facing Application

    Initial Access — FrostyGoop Incident was likely enabled by the adversary exploiting an unknown vulnerability in an external-facing router.(Citation: Dragos FROSTYGOOP 2024)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

  • MITRE ATT&CK C0041

    Official MITRE ATT&CK campaign record C0041. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.