Malware Campaign Against Industrial Systems Almost 3 Years Old

ICS-CERT reported a long-running campaign (since Jan 2012) compromising HMI products (GE Cimplicity, Advantech/Broadwin WebAccess, Siemens WinCC) with BlackEnergy variants; some infections involved exploitation of a known Cimplicity vulnerability, others have unknown initial vectors. The malware was used for network reconnaissance and lateral movement, ICS-CERT found no confirmed process manipulation but warned of prolonged dwell time and noted forensic links (shared C2) to the Sandworm campaign, urging asset owners to look for and report compromises.