Beyond botnets: Autonomous Firmware Zombie Attack in industrial control systems

Seyed Ali Alavi, Hamed Pourvali Moghadam and Amir Hossein Jahangir

International Journal of Critical Infrastructure Protection, 2025, vol. 48, issue C

Abstract: This paper introduces a novel cyberattack vector called the ”Autonomous Firmware Zombie Attack.” Unlike traditional zombie attacks that rely on botnets and direct network control, this method enables attackers to covertly modify the firmware of substation Intelligent Electronic Devices (IEDs) and other firmware-based appliances, including critical industrial equipment, without requiring an active network connection, leaving minimal trace and making an offensive attack with only one infected device instead of a set of multiple devices in botnets. Unlike conventional cyber threats, this method allows attackers to manipulate devices to cause substantial damage while leaving minimal trace, thus evading traditional detection techniques. This study demonstrates the potential of the Autonomous Firmware Zombie Attack (AFZA), which causes substantial damage while evading conventional detection techniques. We first run such an attack on a series of IEDs as proof of concept for this issue. Then, we compare this approach to traditional remote control attacks, highlighting its unique advantages and implications for industrial control system security. This research underscores the critical need for a robust cybersecurity framework tailored to industrial control systems and advances our understanding of the complex risk landscape threatening critical infrastructures.

Keywords: Cyberattack; Cybersecurity; Industrial equipment; Industrial control systems; Industrial networks; Power substation; Zombie (search for similar items in EconPapers)
Date: 2025
References: Add references at CitEc
Citations:

Downloads: (external link)
http://www.sciencedirect.com/science/article/pii/S1874548224000702
Full text for ScienceDirect subscribers only

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:eee:ijocip:v:48:y:2025:i:c:s1874548224000702

DOI: 10.1016/j.ijcip.2024.100729

Access Statistics for this article

International Journal of Critical Infrastructure Protection is currently edited by Leon Strous

More articles in International Journal of Critical Infrastructure Protection from Elsevier
Bibliographic data for series maintained by Catherine Liu ().