COSMICENERGY Malware Is Not an Immediate Threat to Industrial Control Systems

Dragos analyzed the COSMICENERGY ICS malware and determined it is not an immediate threat to operational technology: the codebase is immature, contains errors, and there is no evidence of active deployment. The report contrasts COSMICENERGY with more dangerous threats like CRASHOVERRIDE and Industroyer2, recommends monitoring MS SQL servers (including xp_cmdshell alerts), auditing systems, and coordinating with vendors, and suggests the tool may be intended for training or detection development rather than operational attacks.