FrostyGoop’s Zoom-In: A Closer Look into the Malware Artifacts, Behaviors and Network Communications

Palo Alto Networks Unit 42 analyzed FrostyGoop/BUSTLEBERM, an OT-centric Golang malware that issues Modbus TCP commands to ENCO control devices and was tied to a real-world disruption of heating services for 600+ residential buildings in Ukraine; the report provides sample and network analysis, configuration and library indicators, go-encrypt tooling correlation, exposed ENCO device telemetry, and multiple SHA256 IoCs to support detection and mitigation.