CISA Issues Warning About Malicious Tools Targeting ICS/SCADA Devices

What does the advisory say?

• The tools developed by threat actors can enable scanning, compromising, and controlling of affected ICS/SCADA devices. 
• The advisory highlights that OPC Unified Architecture (OPC UA) servers and multiple versions of Programmable Logic Controllers (PLCs) from Schneider Electric, and OMRON are vulnerable to such attacks initiated by these custom tools. 
• These tools have a modular architecture that can enable threat actors to conduct highly-automated exploits against targeted devices. 
• In addition, one of these tools can be used to exploit a known vulnerability in the ASRock-signed motherboard driver (tracked as CVE-2020-15368) to execute malicious code in the Windows kernel.
• By compromising and maintaining full system access to ICS/SCADA devices, APT actors can elevate privileges, move laterally within an OT environment, and disrupt critical devices or functions.

A new PIPEDREAM malware identified

• To add more trouble, researchers at Dragos revealed details about a new Incotroller (PIPEDREAM) malware designed to target ICS and SCADA systems.
• The malware accomplishes a far-reaching impact through a series of five components - EVILSCHOLAR, BADOMEN, DUSTTUNNEL, MOUSEHOLE, and LAZYCARGO. 
• Associated with Chernovite, PIPEDREAM can manipulate a wide variety of PLC and industrial software. It can attack ubiquitous industrial technologies from the likes of CODESYS, Modbus, and OPC UA.

Conclusion