Logic Bomb

Updated 31 Jul 2026

•
def
- •
  malware that waits for a predefined event before activating — often planted by someone with a grudge
•
triggers
- •
  time bomb — activates at a specific time or date
- •
  user event — activates when a specific user action occurs
•
characteristics
- •
  difficult to identify in advance (no predefined signature) and difficult to recover from if it goes off
•
real-world examples
- •
  March 19–20, 2013 — a trojan disguised as a bank email hit South Korean organizations; the following day at 2 PM local time, a time-based logic bomb deleted storage and the master boot record on infected systems
- •
  December 17, 2016 — a logic bomb targeting a Ukrainian high-voltage substation's SCADA network began disabling electrical circuits at a predetermined time
•
prevention
- •
  difficult to recognize in advance since each is unique; rely on formal change control processes, electronic monitoring for unexpected changes (e.g., host-based intrusion detection, Tripwire), and constant auditing
•
related
- •
  Malware
- •
  SCADA - ICS
•
cards
- •
  Waht are the two trigger types for a logic bomb?
  - •
    Time bomb (a specific date/time) and user event (a specific action)

Linked references 2