“INCONTROLLER” / “PIPEDREAM” ICS Toolkit Targeting Energy Sector

This advisory analyzes Incontroller/Pipedream — a modular toolkit attributed to a suspected state-sponsored actor (“Chernovite”) targeting electric and gas OT environments. The toolkit enables discovery, credential brute-forcing, PLC manipulation (Schneider, Omron), OPC UA access, PLC implants, and uses an ASRock driver exploit (CVE-2020-15368) for privilege escalation; no confirmed in-the-wild destructive deployments are reported, and detection/mitigation guidance is provided.