* [Blog](https://www2.paloaltonetworks.com/blog)
* [Palo Alto Networks](https://www2.paloaltonetworks.com/blog/corporate/)
* [SCADA \& ICS](https://www2.paloaltonetworks.com/blog/category/scada-ics/)
* CrashOverride/Industroyer...

# CrashOverride/Industroyer: Protections for Palo Alto Networks Customers

[](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww2.paloaltonetworks.com%2Fblog%2F2017%2F06%2Fcrashoverrideindustroyer-protections-palo-alto-networks-customers%2F)  
[](https://twitter.com/share?text=CrashOverride%2FIndustroyer%3A+Protections+for+Palo+Alto+Networks+Customers&url=https%3A%2F%2Fwww2.paloaltonetworks.com%2Fblog%2F2017%2F06%2Fcrashoverrideindustroyer-protections-palo-alto-networks-customers%2F)  
[](https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww2.paloaltonetworks.com%2Fblog%2F2017%2F06%2Fcrashoverrideindustroyer-protections-palo-alto-networks-customers%2F&title=CrashOverride%2FIndustroyer%3A+Protections+for+Palo+Alto+Networks+Customers&summary=&source=)  
[](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https://www2.paloaltonetworks.com/blog/2017/06/crashoverrideindustroyer-protections-palo-alto-networks-customers/&ts=markdown)  
\[\](mailto:?subject=CrashOverride/Industroyer: Protections for Palo Alto Networks Customers)  
Link copied  
By [Del Rodillas](https://www.paloaltonetworks.com/blog/author/del-rodillas/?ts=markdown "Posts by Del Rodillas")  
Jun 14, 2017  
3 minutes  
[SCADA \& ICS](https://www.paloaltonetworks.com/blog/category/scada-ics/?ts=markdown)  
[CrashOverride](https://www.paloaltonetworks.com/blog/tag/crashoverride/?ts=markdown)  
[ICS](https://www.paloaltonetworks.com/blog/tag/ics/?ts=markdown)  
[Industroyer](https://www.paloaltonetworks.com/blog/tag/industroyer/?ts=markdown)  
[next-generation firewall](https://www.paloaltonetworks.com/blog/tag/next-generation-firewall/?ts=markdown)  
[SCADA](https://www.paloaltonetworks.com/blog/tag/scada/?ts=markdown)  
[Security Platform](https://www.paloaltonetworks.com/blog/tag/security-platform/?ts=markdown)

This week, the [Industrial Control System (ICS)](https://en.wikipedia.org/wiki/Industrial_control_system) community was again abuzz after reports of a new ICS-specific malware researchers are calling CrashOverride or Industroyer. Several reports indicate that CrashOverride or Industroyer could be the tool used in the December 17, 2016 power outage in the Ukraine.

It's imperative that ICS/SCADA environments adopt next-generation cybersecurity capabilities to prevent and mitigate malware threats such as CrashOverride. Below we describe protections in place for Palo Alto Networks customers.

### Protections with Palo Alto Networks

CrashOverride/Industroyer prompts several questions from our ICS user base. Here's how our customers are protected:

1. **WildFire** - As of June 14, our WildFire database had 9 samples of CrashOverride/Industroyer. These samples included payloads covering functionality for various phases of the attack lifecycle including Reconnaissance, Remote Access, Loss of Control (ICS modules), and Destruction (Wiper). All samples were determined to be Malware by WildFire.Bottom-line: if this malware enters a customer's WildFire-protected network, it will be quickly flagged as malware and new protections for stopping the payload and C2 communications will be created and shared automatically.
2. **Threat Prevention** -- We highly recommend WildFire for the most rapid network-based protection from zero-day attacks. However, users who don't have that can use our Threat Prevention service to stop known payloads, exploits, and communications associated with CrashOverride/Industroyer, applying Threat Prevention profiles in firewall policy. Anti-virus signatures are now available for the known variants of CrashOverride/Industroyer and can be applied to provide protections.
3. **AutoFocus** -- Our threat intelligence tool, AutoFocus, currently has a tag for CrashOverride/Industroyer ("Industroyer") which includes IoCs from the ESET and Dragos reports. Users of the AutoFocus service will be able to use these tags to quickly correlate their network traffic with the aggregate threat intelligence for CrashOverride/Industroyer in the Palo Alto Networks threat intelligence cloud then prioritize their incident response activities as needed.
4. **MineMeld**-- MineMeld is an open source tool that allows user to aggregate, enforce and share threat intelligence. For example, some customers aggregate intelligence feeds from E-ISAC, Palo Alto Networks and other third-party intelligence services then automatically update enforcements on the Palo Alto Networks Next-generation Firewall to block known bad IP addresses via Dynamic Block Lists.You can similarly leverage MineMeld to simplify and automate the process of translating future intelligence you get on CrashOverride/Industroyer to enforcement on your security devices.
5. **Traps Advanced Endpoint Protection** -- If one of the CrashOverride/Industroyer payloads were to somehow make its way directly to the endpoint, say via a USB device or via another host on a flat network, Traps will be able to submit the file to WildFire. Given that CrashOverride payloads have "Malware" verdicts, it will not be executed per the WildFire protection module.
6. **ICS Protocol Visibility and Control**-- Our next-generation firewall also has the capability to identify and control ICS-specific network protocols via App-ID technology as well as via zone protection profiles. This capability can be used to whitelist and blacklist protocol traffic even to the command level for some ICS protocols. Where relevant, User-ID can be coupled with App-ID to monitor and control role-based access.

To learn more about the Palo Alto Networks platform and its use cases for ICS/SCADA, please take a look at our white paper "[Security Reference Blueprint for Industrial Control Systems](https://www.paloaltonetworks.com/resources/whitepapers/industrial-control-blueprint-reference)".

*** ** * ** ***

## Related Blogs

### [Points of View](https://www.paloaltonetworks.com/blog/category/points-of-view/?ts=markdown), [SCADA \& ICS](https://www.paloaltonetworks.com/blog/category/scada-ics/?ts=markdown), [Secure the Enterprise](https://www.paloaltonetworks.com/blog/category/secure-the-enterprise/?ts=markdown)

[#### In OT Environments, Security Must Not Be an Afterthought](https://www2.paloaltonetworks.com/blog/2018/08/ot-environments-security-must-not-afterthought/)

### [Predictions](https://www.paloaltonetworks.com/blog/category/predictions/?ts=markdown), [SCADA \& ICS](https://www.paloaltonetworks.com/blog/category/scada-ics/?ts=markdown)

[#### 2017 Cybersecurity Predictions: Successful Ransomware Attack Causes Critical Infrastructure Downtime](https://www2.paloaltonetworks.com/blog/2017/01/2017-cybersecurity-predictions-successful-ransomware-attack-causes-critical-infrastructure-downtime/)

### [Secure the Enterprise](https://www.paloaltonetworks.com/blog/category/secure-the-enterprise/?ts=markdown)

[#### 3 Ways SD-WAN Can Benefit Industrial Control System Environments](https://www2.paloaltonetworks.com/blog/2020/06/network-ics-and-scada/)

### [Firewall](https://www.paloaltonetworks.com/blog/category/firewall/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown), [SCADA \& ICS](https://www.paloaltonetworks.com/blog/category/scada-ics/?ts=markdown)

[#### PAN-OS 8.1: The Future of ICS SCADA With Secure Clouds](https://www2.paloaltonetworks.com/blog/2018/03/pan-os-8-1-future-ics-scada-secure-clouds/)

### [Firewall](https://www.paloaltonetworks.com/blog/category/firewall/?ts=markdown), [Products and Services](https://www.paloaltonetworks.com/blog/category/products-and-services/?ts=markdown), [SCADA \& ICS](https://www.paloaltonetworks.com/blog/category/scada-ics/?ts=markdown)

[#### Introducing the Ruggedized PA-220R Next-Generation Firewall](https://www2.paloaltonetworks.com/blog/2018/02/introducing-ruggedized-pa-220r-next-generation-firewall/)

### [SCADA \& ICS](https://www.paloaltonetworks.com/blog/category/scada-ics/?ts=markdown)

[#### Secure Your OT: Introducing Our New ICS Cybersecurity Hands-on Workshop](https://www2.paloaltonetworks.com/blog/2017/12/secure-ot-introducing-new-ics-cybersecurity-hands-workshop/)

### Subscribe to the Blog!

Sign up to receive must-read articles, Playbooks of the Week, new feature announcements, and more.
![spinner](https://www2.paloaltonetworks.com/blog/wp-content/themes/panwblog2023/dist/images/ajax-loader.gif) Sign up  
Please enter a valid email.  
By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown) and acknowledge our [Privacy Statement](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown). Please look for a confirmation email from us. If you don't receive it in the next 10 minutes, please check your spam folder.  
This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply.  
{#footer} {#footer}

## Products and Services

* [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security?ts=markdown)

* [Secure AI by Design](https://www.paloaltonetworks.com/precision-ai-security/secure-ai-by-design?ts=markdown)

* [Prisma AIRS](https://www.paloaltonetworks.com/prisma/prisma-ai-runtime-security?ts=markdown)

* [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security?ts=markdown)

* [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions?ts=markdown)

* [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention?ts=markdown)

* [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering?ts=markdown)

* [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire?ts=markdown)

* [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security?ts=markdown)

* [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown)

* [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security?ts=markdown)

* [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown)

* [Industrial OT Security](https://www.paloaltonetworks.com/network-security/medical-device-security?ts=markdown)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown)

* [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall?ts=markdown)

* [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations?ts=markdown)

* [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls?ts=markdown)

* [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager?ts=markdown)

* [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription?ts=markdown)

* [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os?ts=markdown)

* [Panorama](https://www.paloaltonetworks.com/network-security/panorama?ts=markdown)

* [Secure Access Service Edge](https://www.paloaltonetworks.com/sase?ts=markdown)

* [Prisma SASE](https://www.paloaltonetworks.com/sase?ts=markdown)

* [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration?ts=markdown)

* [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem?ts=markdown)

* [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention?ts=markdown)

* [Prisma Access](https://www.paloaltonetworks.com/sase/access?ts=markdown)

* [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser?ts=markdown)

* [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan?ts=markdown)

* [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation?ts=markdown)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security?ts=markdown)

* [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex?ts=markdown)

* [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown)

* [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud?ts=markdown)

* [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security?ts=markdown)

* [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security?ts=markdown)

* [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security?ts=markdown)

* [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud?ts=markdown)

* [AI-Driven SOC](https://www.paloaltonetworks.com/cortex?ts=markdown)

* [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam?ts=markdown)

* [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr?ts=markdown)

* [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar?ts=markdown)

* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse?ts=markdown)

* [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response?ts=markdown)

* [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam?ts=markdown)

* [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42?ts=markdown)

* [Proactive Assessments](https://www.paloaltonetworks.com/unit42/assess?ts=markdown)

* [Incident Response](https://www.paloaltonetworks.com/unit42/respond?ts=markdown)

* [Transform Your Security Strategy](https://www.paloaltonetworks.com/unit42/transform?ts=markdown)

* [Discover Threat Intelligence](https://www.paloaltonetworks.com/unit42/threat-intelligence-partners?ts=markdown)

## Company

* [About Us](https://www.paloaltonetworks.com/about-us?ts=markdown)
* [Careers](https://jobs.paloaltonetworks.com/en/)
* [Contact Us](https://www.paloaltonetworks.com/company/contact-sales?ts=markdown)
* [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility?ts=markdown)
* [Customers](https://www.paloaltonetworks.com/customers?ts=markdown)
* [Investor Relations](https://investors.paloaltonetworks.com/)
* [Location](https://www.paloaltonetworks.com/about-us/locations?ts=markdown)
* [Newsroom](https://www.paloaltonetworks.com/company/newsroom?ts=markdown)

## Popular Links

* [Blog](https://www.paloaltonetworks.com/blog/?ts=markdown)
* [Communities](https://www.paloaltonetworks.com/communities?ts=markdown)
* [Content Library](https://www.paloaltonetworks.com/resources?ts=markdown)
* [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia?ts=markdown)
* [Event Center](https://events.paloaltonetworks.com/)
* [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center)
* [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z?ts=markdown)
* [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/compliance?ts=markdown)
* [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure?ts=markdown)
* [Sitemap](https://www.paloaltonetworks.com/sitemap?ts=markdown)
* [Tech Docs](https://docs.paloaltonetworks.com/)
* [Unit 42](https://unit42.paloaltonetworks.com/)
* [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd)
  ![PAN logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg)
* [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy?ts=markdown)
* [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center?ts=markdown)
* [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use?ts=markdown)
* [Documents](https://www.paloaltonetworks.com/legal?ts=markdown)

Copyright © 2026 Palo Alto Networks. All Rights Reserved

* [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks)
* [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector?ts=markdown)
* [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/)
* [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks)
* [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks)
* EN  
  Select your language