The Trojan Horse Malware & Password “Cracking” Ecosystem Targeting Industrial Operators

Dragos discovered a criminal ecosystem selling trojanized PLC/HMI/project-file “password cracking” tools that exploit a firmware flaw in Automation Direct DirectLogic 06 (CVE-2022-2003) to reveal passwords and drop Sality malware; the malware establishes a P2P botnet, persists via file/kernel infection and autorun propagation, hijacks cryptocurrency clipboard addresses, and can interfere with AV updates. The report reproduces the serial exploit (and over Ethernet), lists many affected vendors/products, notes responsible disclosure and firmware fixes, and warns engineers to avoid running untrusted tools and to seek vendor/Dragos assistance.