New Knowledge Pack Released (KP-2022-004)

This Knowledge Pack from Dragos describes the CHERNOVITE group and its PIPEDREAM ICS attack framework, detailing modular components (EVILSCHOLAR, BADOMEN, MOUSEHOLE, LAZYCARGO) that enable discovery, access, privilege escalation, and manipulation of Schneider Electric and Omron PLCs and related ICS protocols (CODESYS, Modbus, OPC UA, etc.). The pack provides over 250 characterizations and 500 detections — including protocol characterizations, YARA rules, signatures for tools like BITSAdmin, and scans for CVE-2022-22536 — to help detect, attribute, and mitigate these ICS-targeting capabilities.