Volume 2Energy edition2024Last verified 16 sources, 6 primaryMalware link by Dragos assessment
In January 2024 attackers reached the heating controllers of a Lviv district, a vendor reports. It says 600+ buildings lost heat for two days. The city says the utility's crews had heat back in every building by 15:00 that day.
This entry sits on the top rung of the volume's consequence ladder: commands reached operational technology, and the victim's same-day statements corroborate a physical effect. What is disputed is scale. The vendor's numbers travelled; the utility's, published hours after the event with times attached, mostly did not. They are the best record here: failure at about 02:00, suspicion stated as suspicion, 175 of 324 heat points restarted by hand by 09:30, heat in every building by 15:00.
That is fallback capacity doing its job; that it kept this to a cold day is BlastWave's analysis, not a disclosed fact. The architecture did not do its job. Dragos reports the router, servers and controllers were not adequately segmented, and the controllers answered Modbus TCP, which has no authentication. Something outside could reach them, and they obeyed whoever did. Those are reachability and identity problems, not detection problems.
What is not known: How many people lost heat, and for how long, is disputed. Dragos says over 600 apartment buildings and almost two days; the city says heating was back in every Sykhiv building by 15:00 that day; the SBU says more than 600 households, quickly neutralised. No attacker is named: the only actor-linked evidence published is tunnelling to Moscow IP addresses. The router's vendor is not in the Dragos brief. The malware is tied to this incident by Dragos's assessment. No cost is disclosed.
Recommendation
Take the path away Nothing that faces the internet, edge router included, should route to a heating controller. Dragos found router, servers and controllers not adequately segmented.
Remove standing write access Modbus TCP obeys anyone who reaches it. Let only named engineering identities write registers or load firmware, inside a scheduled, logged window.
Make monitoring read one way Telemetry leaves the controller network through a one-way path, so the systems that watch the heat points cannot command them.
Sources: Lviv City Council site, 23 Jan 2024, 10:02 (utility statement); Suspilne Lviv, 23 Jan 2024 (15:00 update); Dragos intel brief, Jul 2024; SBU to The Record, 23 Jul 2024; Forescout, 2 Aug 2024. Full list with links.
Soft Spots: Scale and duration are disputed; the 15:00 update is read via local media. That the manual restart kept the outage short is BlastWave's analysis. MikroTik is press only; a 22 Jan start is Dragos as quoted by press. Neither is in the brief.
The full record
Every claim numbered to its source. Last updated .
Heat points in one Lviv district stopped at two in the morning and were restarted by hand the same day; six months later a vendor described a larger, longer outage. What is verified, what is only reported, and what is still unknown.
Summary
At about 02:00 on 23 January 2024, 324 heat points in Lviv's Sykhiv district stopped. The utility, Lvivteploenergo, suspected external interference, and its crews restarted them by hand; the city said heating was back in every building by 15:00. In July 2024 Dragos linked FrostyGoop malware to the attack by assessment. Scale and duration remain disputed.1,2,6
Timeline of the Lviv heating incident
Every date is tied to a source. Press reporting appears only as evidence of what was said.
BleepingComputer, reporting Dragos's findings on 23 July 2024, dates the initial access to this day and names the router as MikroTik. Neither detail is in either public revision of the Dragos brief as read; the brief says only that access was possibly gained "months earlier."2,4
The adversaries open L2TP connections to Moscow-based IP addresses, per Dragos.2
The individual heat points in Sykhiv fail. 324 of them stop, according to Lvivteploenergo.1
175 of the 324 heat points are working again. Crews are restarting them by going round, in manual mode.1
The Lviv City Council website publishes the utility's statement: it suspects external interference, law enforcement is verifying that, and it plans to restore all heat points by the end of the day.1
The City Council press service reports that Lvivteploenergo's repair crews have restored heating to all buildings in Sykhiv. Hot water is at 30%. The mayor reports the same on Facebook.6,7,8
Dragos finds multiple FrostyGoop binaries during routine triage of suspicious files and first assesses, with low confidence, that they were used for testing. The Cyber Security Situation Center of the Security Service of Ukraine later shares details of the January attack with Dragos.2,9
Dragos publishes its brief and blog: over 600 apartment buildings, remediation almost two days. The same day the SBU tells The Record that more than 600 households lost heating and hot water and that the consequences were quickly neutralized. Same-day press accounts of Dragos's findings name the router as MikroTik.2,3,4,9,10,11,12
Forescout publishes its analysis: the public samples are hard to connect to the incident as described, the case is "not as unprecedented as some reports might suggest," and the attack "may have affected fewer homes for a shorter period of time."5
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
Every Sykhiv building by 15:00 the same day, per the City Council press service; hot water at 30% at that hour6,7
Reported (city press service, via same-day local media)
How were the heat points restarted?
By hand, crews going round in manual mode; 175 running by 09:301
Verified
How many buildings lost heat?
Three parties, three units: 324 heat points (utility), over 600 apartment buildings (Dragos), more than 600 households (SBU)1,2,3
Contested
How long did the outage last?
Heating back by 15:00 the same day (city) against almost two days (Dragos)2,6,9
Contested
Was it a cyberattack?
On the day, the utility said it suspected external interference and law enforcement was checking. The SBU called it a cyberattack in July 20241,3
Reported (SBU statement, via The Record)
Was FrostyGoop used?
Dragos assesses it was. Forescout finds the public samples hard to connect to the incident2,5
Researcher finding
How did the attackers get in?
Possibly an undetermined vulnerability in an externally facing router, months earlier (Dragos)2
Researcher finding
Which router vendor?
MikroTik in same-day press; not named in either public revision of the Dragos brief2,4
Reported only
Who did it?
Not named. Dragos does not attribute; the only actor-linked evidence published is connections to Moscow-based IP addresses2
Undisclosed
Incident cost
No figure published
Undisclosed
How many people in Lviv lost heat, and for how long?
The record holds three sizes and two durations for the same night, from three parties, and it has not settled which is right. The utility counted heat points, Dragos counted apartment buildings and the Security Service of Ukraine counted households. Any use of one figure on this page carries the others.
Lvivteploenergo, 23 January 2024: 324 individual heat points stopped at about 02:00; 175 running again by 09:30.1
Lviv City Council press service, 23 January 2024: as of 15:00, the utility's repair crews had restored heating to all buildings in Sykhiv; hot water at 30%.6,7,8
Dragos, July 2024: "this facility fed over 600 apartment buildings"; "the attack disrupted the power supply to heating services to over 600 apartment buildings"; "Remediation of the incident took almost two days."2 Dragos's blog the same day describes "a two-day loss of heating to customers."9
The SBU, to The Record, 23 July 2024: a temporary shutdown of heating and hot water for more than 600 households; the consequences of the cyberattack "were quickly neutralized."3
The Dragos brief uses the 600 figure twice: once as the customer base the facility "fed" and once as what the attack disrupted. The first is a customer base, not an impact count.2 Mark Graham, described by CyberScoop as Dragos's technical director, told reporters of a loss of heating to over 600 apartment buildings "for almost 48 hours."11,12 Forescout wrote on 2 August 2024 that the attack "may have affected fewer homes for a shorter period of time."5
In fairness to Dragos, remediating a controller fleet and getting heat back into radiators can be different finish lines, and both can be true. But Dragos's blog and its technical director both describe a loss of heating of about two days, and that is the claim the utility's same-day record does not support. Hot water lagged: it was at 30% at 15:00, and its full restoration time was not found in any record we read.6,9,12
One step here is BlastWave's arithmetic, not anyone's disclosure: an apartment building in Sykhiv holds dozens of households, so buildings and households sit roughly an order of magnitude apart, and the 600 figure may have travelled between accounts with its unit changing. On that reading the three figures cannot all describe the same outage at the same grain.
What did the Lviv heating utility say on the day?
It said the heat points had failed, that it suspected external interference, and that law enforcement was checking: suspicion, stated as suspicion. The statement was published on the Lviv City Council website at 10:02 on 23 January 2024, quoting the utility. The utility's own post was not located.
"Маємо підозри на зовнішнє втручання, однак ця інформація зараз перевіряється правоохоронними органами"
The same statement gave numbers with times on them: the failure at about 02:00, 324 heat points stopped, workers restarting them "методом обходу, в ручному режимі" (going round, in manual mode), and 175 working as of 09:30. It said: "До кінця дня плануємо повністю відновити роботу усіх ІТП і відновити подачу тепла" (by end of day we plan to fully restore all heat points and heat supply).1 By 15:00, the city's press service reported heating back in every Sykhiv building.6
Some same-day reports were firmer than the utility. LB.ua's English rendering had the utility saying a hacker attack disrupted the heat supply management system, with restoration estimated at 21:00.13 Those are not the utility's words as published by the City Council, and Varianty attributes the "hacker attack" wording to the city hotline, not the utility.1,14 The description of the incident as a cyberattack on Lvivteploenergo comes from the SBU, six months later.3
How did the attackers reach the heating controllers?
Dragos says possibly through a router at the network edge, months earlier, and that nothing inside the network stopped commands reaching the controllers. Its brief hedges the first step:
"possibly gained access to the victim network months earlier by exploiting an undetermined vulnerability in an externally facing router"
After that, Dragos reports, the adversaries deployed a web shell and retrieved the contents of the Security Account Manager (SAM) hive for credentials, and in January 2024 opened L2TP connections to Moscow-based IP addresses.2,15 Dragos reports that the router, management servers and heating controllers were not adequately segmented, and that the controllers were ENCO controllers answering Modbus TCP, a protocol with no authentication built in.2
"The adversaries sent Modbus commands to ENCO controllers, causing inaccurate measurements and system malfunctions"
Dragos also reports the adversaries downgraded the controllers' firmware to a version without monitoring.2 The utility's statements corroborate the physical effect, heat points stopping and being restarted by hand, not the mechanism; the mechanism is Dragos's account.1,2
BleepingComputer, SecurityWeek, CyberScoop and TechCrunch, all on 23 July 2024, named the router as MikroTik, and BleepingComputer dated the initial access to 17 April 2023.4,10,11,12 Neither public revision of the Dragos brief names a router vendor in its extractable text, and the April 2023 date is in press only. "Possibly," "undetermined" and the vendor's name belong together.
Is FrostyGoop the first malware to use Modbus in an attack?
Dragos's claim is narrower than the headlines: it is about achieving an impact over Modbus TCP, not about using Modbus. Dragos's sentence:
"the first ICS-specific malware that uses Modbus TCP communications to achieve an impact on operational technology"
Pipedream, described by Mandiant in April 2022, already carried a tool (CODECALL) that read and wrote device registers over Modbus; it was never shown deployed.16 Forescout argued on 2 August 2024 that the use of Modbus in attacks is far from new, that hacktivist scripts had already used it, and that FrostyGoop is "not as unprecedented as some reports might suggest."5
Dragos counted over 46,000 internet-exposed ICS devices communicating over Modbus TCP at the time of its July 2024 brief.2
Who was behind FrostyGoop, and is the malware really linked to Lviv?
No one is named, and the malware's link to Lviv is an assessment. Dragos does not attribute the attack. What it published is that in January 2024 the adversaries opened L2TP connections to Moscow-based IP addresses: an observation about infrastructure, not an attribution.2,3 The SBU's statement to The Record names no actor, and no government has published an attribution as of late September 2026.3
Dragos found the FrostyGoop binaries in routine triage of suspicious files in April 2024; no record we read says they were recovered from the victim's network. Dragos first read them, with low confidence, as test tools. After the Security Service of Ukraine's Cyber Security Situation Center shared details of the January attack, Dragos assessed that FrostyGoop was used to facilitate it.2,9 Forescout, which notes Mandiant originally tracked the malware as BUSTLEBERM, found it "challenging to connect" the publicly available malware to the incident as described.5 The link is a reasonable assessment, written here as one.
What is still not known about FrostyGoop
How many people lost heat, and for how long. Three parties give three units, and the record has not settled which is right.1,2,3
When hot water was fully restored. It was at 30% at 15:00 on 23 January; no record we read gives a full restoration time.6
Who carried out the attack. Dragos does not attribute, and no government attribution has been published as of late September 2026.2
Which router was exploited, and when. The vendor name and the April 2023 date are in press only.4
When the attack began. BleepingComputer quotes Dragos as saying it ran "during the late evening on 22 January 2024, through 23 January"; that sentence is not in the extractable text of either brief revision.4
Whether the public FrostyGoop samples are the ones used in Lviv. The link is Dragos's assessment.2,5
The Ukrainian text of the SBU's statement. It is known only in English translation.3
Whether any government advisory exists. None from CISA or CERT-UA was located as of late September 2026.
The incident's cost.
Claims about FrostyGoop the record does not support
Widely repeated claim
What the record says
"FrostyGoop cut heat to 600 apartment buildings for two days."
That is Dragos's account. The city reported heating back in every Sykhiv building by 15:00 the same day, and the SBU said more than 600 households, quickly neutralized. Scale and duration are disputed.3,6,9
"The attackers got in through a MikroTik router."
Dragos says access was "possibly" gained through an "undetermined vulnerability" in an externally facing router and names no vendor in either public revision of its brief. MikroTik is in same-day press.2,4
"Russia-linked hackers froze Lviv."
Dragos does not attribute. The only actor-linked evidence published is connections to Moscow-based IP addresses, an observation about infrastructure. The SBU's statement names no one.2,3
"FrostyGoop is the first malware to use Modbus in an attack."
Dragos's claim is narrower: the first ICS-specific malware to use Modbus TCP to achieve an impact on OT. Pipedream carried a Modbus tool in 2022, never shown deployed, and Forescout disputes the novelty.2,5,16
"The utility confirmed a hacker attack on the day."
The utility said it suspected external interference and that law enforcement was checking. The "hacker attack" wording came from a press rendering and the city hotline.1,13,14
BlastWave analysis: the heat came back because people walked
Analysis, not a disclosed fact
This is one of the few entries where commands reached operational technology and something physical happened, with the victim's own same-day statements corroborating the effect. What is disputed is scale. The vendor's numbers travelled around the world; the utility's, published hours after the event with times attached, mostly did not. They are the best record here: failure at about 02:00, suspicion stated as suspicion, 175 of 324 heat points restarted by hand by 09:30, and, by the city's account, heat in every building by 15:00. That is fallback capacity doing its job, a district restarted on foot in about thirteen hours. That the manual path is what kept this to a cold day is BlastWave's analysis, not a disclosed fact.1,6
The architecture did not do its job. Dragos reports the router, management servers and heating controllers were not adequately segmented, and the controllers answered Modbus TCP, which has no authentication built in.2 Two conditions had to hold: something outside could reach the controllers, and the controllers would take an order from whoever reached them. Neither is a detection problem. Both are reachability and identity problems, and both were true long before the night in question. The argument is architecture, not the utility's competence.
Podcast: “A Pulse Is a Pulse” (8:59). Joe Baxter and Cam Cullen on why the utility's same-day record deserves to be read first, and why controllers that obey anyone who reaches them are the real problem.
Video: FrostyGoop Short (60 to 90 seconds).
Frequently asked questions
What happened in the Lviv heating cyber incident?
At about 02:00 on 23 January 2024, 324 individual heat points in the Sykhiv district of Lviv, Ukraine, stopped. The utility, Lvivteploenergo, said that morning it suspected external interference and that law enforcement was checking. Crews restarted the heat points by hand, and the Lviv City Council press service reported heating back in every Sykhiv building by 15:00 that day. In July 2024 Dragos linked the attack to FrostyGoop malware by assessment.
How many buildings lost heat in the FrostyGoop attack?
The record gives three figures in three units. Lvivteploenergo said on 23 January 2024 that 324 heat points stopped. Dragos wrote in July 2024 that the attack disrupted heating to over 600 apartment buildings. The Security Service of Ukraine told The Record on 23 July 2024 that more than 600 households lost heating and hot water. By BlastWave's arithmetic, buildings and households sit roughly an order of magnitude apart, so the figures cannot all describe the outage at the same grain.
Did Lviv residents go without heat for two days?
That is disputed. Dragos wrote in July 2024 that remediation took almost two days, and its blog described a two-day loss of heating. The Lviv City Council press service reported on 23 January 2024 that heating was restored to every building in Sykhiv by 15:00 the same day, with hot water at 30 percent at that hour. The SBU said the consequences were quickly neutralized.
Who was behind the FrostyGoop attack?
No one has been named. Dragos, which disclosed FrostyGoop in July 2024, does not attribute the attack. The only actor-linked evidence it published is that in January 2024 the adversaries opened L2TP connections to Moscow-based IP addresses, which is an observation about infrastructure. The Security Service of Ukraine's statement to reporters named no actor, and no government attribution had been published as of late September 2026.
How did the attackers get into the Lviv heating network?
Dragos wrote in July 2024 that the adversaries possibly gained access months earlier by exploiting an undetermined vulnerability in an externally facing router. It reported that the router, management servers and heating controllers were not adequately segmented, and that the controllers accepted Modbus TCP commands. Same-day press named the router as MikroTik, but neither public revision of the Dragos brief names a vendor.
Is FrostyGoop the first malware to attack using Modbus?
Dragos's July 2024 claim is narrower: FrostyGoop is the first ICS-specific malware that uses Modbus TCP communications to achieve an impact on operational technology. Pipedream, described by Mandiant in April 2022, already carried a Modbus read and write tool that was never shown deployed. Forescout wrote on 2 August 2024 that FrostyGoop is not as unprecedented as some reports might suggest.
Was FrostyGoop found on the Lviv utility's network?
No record we read says so. Dragos found FrostyGoop binaries during routine triage of suspicious files in April 2024 and first assessed, with low confidence, that they were used for testing. After the Security Service of Ukraine's situation center shared details of the January 2024 attack, Dragos assessed that FrostyGoop was used in it. Forescout wrote on 2 August 2024 that the public samples are challenging to connect to the incident as described.
Primary sources are the utility's statement as published by the Lviv City Council and the dated publications of the researchers who worked the case. Local and international press are cited for official statements they carried, and otherwise only as evidence of what was said.
GovernmentLviv City Council, publishing the morning statement of LMKP Lvivteploenergo, "Через збій у системі теплопостачання Львівтеплоенерго частина Сихова без опалення і гарячої води" (Because of a failure in Lvivteploenergo's heat supply system, part of Sykhiv is without heating and hot water), 23 January 2024, 10:02. In Ukrainian. city-adm.lviv.ua
ResearcherDragos, "Impact of FrostyGoop ICS Malware on Connected OT Systems," intelligence brief, July 2024 (two public revisions). dragos.com · Brief (PDF) · Revised brief (PDF)
PressDaryna Antoniuk, "FrostyGoop malware left 600 Ukrainian households without heat this winter," The Record (Recorded Future News), 23 July 2024. Cited for the Security Service of Ukraine's statement, quoted there in English translation. therecord.media
PressBleepingComputer, report on FrostyGoop, 23 July 2024. Cited as evidence of what was said. bleepingcomputer.com
ResearcherForescout Research, Vedere Labs, "ICS Malware FrostyGoop/BUSTLEBERM: Insights Others Missed," 2 August 2024. forescout.com
PressSuspilne Lviv, report of 23 January 2024 (published 11:48, updated 17:36), carrying the Lviv City Council press service's afternoon update on heating in Sykhiv. In Ukrainian. Cited for the city's statement. suspilne.media
PressDaily Lviv, report of 23 January 2024, 14:09, on hot water reaching 30% of consumers in Sykhiv. In Ukrainian. Cited as evidence of what was said. dailylviv.com
PressVarianty, report of 23 January 2024, 15:59, carrying Mayor Andriy Sadovyi's Facebook statement that heat was restored in Sykhiv and hot water at 30%. In Ukrainian. Cited for the mayor's statement. varianty.lviv.ua
ResearcherDragos, "How to Protect Against FrostyGoop: ICS Malware Targeting Operational Technology," blog, 23 July 2024. dragos.com
PressSecurityWeek, report on FrostyGoop, 23 July 2024. Cited as evidence of what was said.
PressCyberScoop, report on FrostyGoop, 23 July 2024. Cited as evidence of what was said, and for Mark Graham's title at Dragos. cyberscoop.com
PressLorenzo Franceschi-Bicchierai, TechCrunch, 23 July 2024, with Dragos interviews and an emailed statement TechCrunch attributes to a spokesperson for "the Security Council of Ukraine" (machine-translated). Cited as evidence of what was said. techcrunch.com
PressLB.ua (English edition), report of 23 January 2024, 12:58. Cited as evidence of what was said.
PressVarianty, report attributing the "hacker attack" wording to the city hotline, 23 January 2024. In Ukrainian. Cited as evidence of what was said. varianty.lviv.ua
ResearcherMandiant, "INCONTROLLER: New State-Sponsored Cyber Attack Tools Target Multiple Industrial Control Systems," 13 April 2022. cloud.google.com
Cite this page
BlastWave. “FrostyGoop and the Lviv Heating Incident (2024): What Is Verified.” Hackopedia, Volume 2, FILE 043. Last verified 28 September 2026. https://hackopedia.blastwave.com/energy/frostygoop-2024/
Revision history
Date
Change
6 Oct 2026
Numbered FILE 043 in Hackopedia Volume 2, in the Energy edition.
28 Sep 2026
Final consistency check: the entry re-read against its sources and against the other Hackopedia entries that mention FrostyGoop. Confirmed that the three scale figures always appear together with their sources, that the 15:00 restoration is attributed to the city, and that the comparison of buildings and households remains labelled as BlastWave's arithmetic, since no source states building sizes.
26 Sep 2026
Full validation. Corrected the attribution of the 15:00 restoration from the utility to the Lviv City Council press service; replaced "published by the victim" with "given by," since the utility's own post was never located; labelled the buildings-to-households comparison as BlastWave's arithmetic; and corrected a TechCrunch citation to use TechCrunch's own attribution.
25 Sep 2026
Second verification. The utility's morning statement is now read at source on the Lviv City Council website and quoted in full. "At dawn" corrected to "that morning." Both public revisions of the Dragos brief read; neither names a router vendor. The 22 versus 23 January question settled as two different events.
24 Sep 2026
Volume 2 entry built from primary sources: the utility's same-day statements, the Dragos brief and blog, and the published researcher analyses.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
