FrostyGoop: Defending ICS Against Protocol Exploits

An attacker on an OT network does not need malware that evades your defenses. FrostyGoop proves the point. Dragos discovered the industrial control system (ICS) malware in April 2024, and Ukraine’s Cyber Security Situation Center (CSSC) shared details of the incident behind it. FrostyGoop speaks Modbus TCP natively and sends commands straight to field controllers. In January 2024 in Lviv, the attack cut heating to more than 600 apartment buildings, and remediation took almost two days while residents faced sub-zero temperatures.

• FrostyGoop is the first reported ICS malware to abuse Modbus TCP for control system manipulation with real-world impact (SANS), and the ninth known ICS malware (Dragos).
• Anomaly-based NDR and log analytics strain against FrostyGoop because the malware operates with precise, native awareness of ICS protocol values and opcodes, not the noisy behavior these tools are tuned to flag.
• Modbus and BACnet were built without authentication or encryption, making protocol-specific exploits a structural weakness in most OT environments rather than a misconfiguration.
• OT deception, specifically PLC decoys with native Modbus and BACnet support, surfaces FrostyGoop-style reconnaissance before the exploit executes, at the leaf-switch layer where core-switch NDR has no visibility.
• Acalvio ShadowPlex runs additively alongside existing OT monitoring. In the U.S. Navy’s Cyber Resilient Systems ANTX exercise in mid-2025, Acalvio delivered 100 percent true positives and denied 80 percent of attacker objectives.

FrostyGoop is ICS malware that communicates with field devices over Modbus TCP to send unauthorized commands, manipulate control values, and modify operational parameters. It gives an attacker direct influence over physical processes without going through legitimate control software.

FrostyGoop fact file

The FrostyGoop attack moved from an internet-facing router to the heating controllers in six steps, as documented by MITRE (campaign C0041), Dragos, and SANS:

1. Entry: attackers likely exploited an unknown vulnerability in an external-facing router (MITRE).
2. Credentials: they retrieved the SAM hive to capture credentials (MITRE).
3. Persistence: a ReGeorg variant web shell kept access open (MITRE).
4. Tunneling: L2TP connections ran to Moscow-based IP addresses (MITRE, Dragos).
5. Manipulation: Modbus commands to ENCO controllers altered parameters and downgraded firmware, so controllers reported incorrect measurements and operators lost visibility (MITRE).
6. Impact: heating was lost to more than 600 apartment buildings in sub-zero temperatures (Dragos).

SANS notes that the attackers sent the Modbus commands from their own environment through the tunnel, so the malware did not need to run on hosts inside the victim network.

ICS protocol-specific malware turns a protocol’s normal commands into a weapon against physical processes.

• A different target: malware has traditionally targeted IT infrastructure, but OT assets run on protocols built for administration and monitoring rather than general computing. Modbus is one of the most widely deployed, used across PLCs and other field devices.
• Direct control: FrostyGoop reads and writes holding registers over Modbus to set the values that govern controller operation.
• Physical impact: in the Ukraine incident, commands modified control parameters so controllers reported incorrect measurements, and firmware was downgraded, causing loss of heating and loss of view (MITRE C0041).

Remote protocol exploits are hard to prevent because Modbus and BACnet provide no authentication or encryption, so every reachable device is a potential target, not just a misconfigured one.

• No built-in trust check: modern IT protocols such as HTTPS and TLS make a client prove it belongs before it can act. Most ICS protocols were defined before protocol-level security was a design consideration.
• A range of exploits: unauthorized clients issuing remote commands, man-in-the-middle interception, and replay attacks that resend previously captured commands.
• Wide exposure: Unit 42 counted about 1.09 million Modbus TCP devices exposed to the internet between 2 September and 2 October 2024.

The combination of an exploitable attack surface and mission-critical assets makes protocol exploits a serious threat vector, and it is why OT-specific detection matters as much as prevention in OT risk management.

OT security has long relied on network segmentation and air gapping to isolate assets and reduce exposure. Segmentation remains a necessary prevention control and stays essential for shrinking the OT attack surface.

ICS protocol-specific malware is pushing OT security toward an assume-compromise posture, because prevention controls have more than one way to be bypassed:

• Internet-facing OT assets: the exploit vector the Lviv district heating attack made concrete.
• Insider risk: plant administrators and contract staff, a route that does not depend on any network boundary at all.

A layered defense pairs prevention with active threat detection: segmentation limits what an attacker can reach, and detection shortens the distance between initial access and response once they reach it anyway. Dragos and SANS both recommend the SANS Five ICS Cybersecurity Critical Controls as the baseline for that layered approach. Watch the webinar Beyond segmentation: defending against ICS protocol exploits.

OT assets need a detection approach built around their constraints, not one inherited from IT.

• Endpoint tools: most OT assets cannot run security agents, which limits endpoint-centric tools such as EDR.
• Log analytics: log availability and format vary widely across vendors and device generations.
• Network detection: NDR analyzes traffic for known malicious patterns and anomalous behavior and is a reasonable baseline. It strains against protocol-specific malware for a structural reason: FrostyGoop operates with precise, native awareness of Modbus values and opcodes, so its traffic often does not deviate from what anomaly baselines expect. NDR is also typically deployed at the core switch, leaving a visibility gap for leaf-switch assets, including PLCs receiving unauthorized commands.

Closing that gap calls for OT-specific decoys: instrumented assets that represent real OT devices and that no legitimate process ever needs to touch. Any interaction with one is a high-fidelity signal on its own, without baselining or tuning, and the same decoys extend visibility to leaf-switch assets that core-switch NDR cannot see. Decoys need to be automated and deployed at scale to keep pace with attackers acting at machine speed; a handful of hand-built decoys will not hold up the way an autonomous deployment does. Deception works alongside NDR and log analytics here, not in place of them.

The real FrostyGoop attack ran from router exploit to credential theft to Modbus writes, and every one of those steps crossed the network before the payload ran. Consider how decoys change that sequence for an energy provider built on the Purdue reference architecture, where the OT security team deploys PLC decoys with native support for Modbus and BACnet, the protocol common in building automation systems.

An attacker gains access and stages FrostyGoop. Before deploying it against a specific target, the attacker runs reconnaissance to find exploitable PLCs, typically by scanning the subnet for devices responding on the Modbus port:

• What the decoys do: the sweep in step one surfaces decoy devices alongside real ones, and the OT security team is notified before step two runs.
• Why the alert is trustworthy: the question is why anything touched an asset no legitimate process should need. That question is the detection signal itself, not an inference built from weaker evidence elsewhere.
• The outcome: a response window before FrostyGoop’s payload executes. Acalvio ShadowPlex extends this protocol-aware decoy coverage across core and leaf switches. Learn more in Acalvio ShadowPlex in OT/ICS environments.

Each step of the real FrostyGoop attack maps to a MITRE ATT&CK technique, and decoys can surface some of those steps while others fall outside what deception covers.

The pattern is clear: decoys add the most signal in the middle of the attack, where credentials are reused and controllers are probed and written to, while perimeter hardening and router patching remain the controls for initial access.

Alt text: FrostyGoop attack path mapped to ATT&CK techniques and decoy detection points.