CHERNOVITE’s PIPEDREAM Malware Targeting Industrial Control Systems (ICS)

PIPEDREAM is a sophisticated, modular ICS malware toolkit attributed to the CHERNOVITE group that can manipulate PLCs and industrial software (including Omron, Schneider, CODESYS, Modbus, and OPC UA). Dragos reports the toolkit can execute 38% of known ICS attack techniques and 83% of ICS attack tactics, contains five major components (EVILSCHOLAR, BADOMEN, DUSTTUNNEL, MOUSEHOLE, LAZYCARGO), and — while highly capable of causing disruption or destruction — has not been observed performing destructive actions in the wild; the report provides detailed defensive mitigations and recommendations for ICS operators.