OT: PIPEDREAM malware

[A_G]

Anyone else heard of PIPEDREAM? Is it a real threat or hype? What can we do to protect control systems from malware (other than refusing to connect the system to the internet)?

https://www.dragos.com/blog/industr...malware-targeting-industrial-control-systems/

https://www.dragos.com/threat/chernovite/

 

[croakus]

https://www.wired.com/story/pipedream-ics-malware/

 

[lostcontrol]

Interesting it mentions codesys & Omron..
To best of my knowledge, Omron does not support codesys..

 

[plvlce]

Interesting it mentions codesys & Omron..
To best of my knowledge, Omron does not support codesys..

And Wired's stock photo is of an AB (PLC 5 I believe), which definitely would not be codesys. If the person who wrote their article is the one who selected the picture, I'm very skeptical it was someone with any real knowledge of PLCs.

 

[LadderLogic]

More accurate and specific details here:

https://www.mandiant.com/resources/incontroller-state-sponsored-ics-tool

 

[A_G]

More accurate and specific details here:

https://www.mandiant.com/resources/incontroller-state-sponsored-ics-tool

Good info in the Mandiant article including a section on Mitigations.

I found more info on Mitigations here:
https://www.cisa.gov/uscert/ncas/alerts/aa22-103a