Simple ‘FrostyGoop’ malware responsible for turning off Ukrainians’ heat in January attack

Dragos reported a Modbus-targeting ICS malware named FrostyGoop that caused heat outages for more than 600 apartment buildings in Ukraine for two days. The attackers reportedly gained initial access via a MikroTik router vulnerability, spent about 10 months establishing access and credentials, and connected from Moscow-based IP addresses before the outage; Dragos tracks the activity as TAT2024-24. Although described as technically simple and written in Go, FrostyGoop is notable as the first observed ICS malware using Modbus to create a physical disruption, illustrating growing risks to critical infrastructure.