Pipedream Malware Continues to Shred Industrial Systems
Indicators of Compromise
No domains found for this campaign
APT Groups1
<p><span style="font-size: 13px;">The CHERNOVITE threat group has been active <b>since 2021 </b>and is capable of disrupting, degrading, and potentially destroying industrial environments and physical processes within these environments. The group has developed a highly capable offensive Industrial Control Systems (ICS) malware framework, with <b>PIPEDREAM</b> being one of the key malware they use.</span></p><p><span style="font-size: 13px;">PIPEDREAM provides operators with the ability to scan for new devices, brute force passwords, sever connections, and crash the target device. It uses several different protocols, including FINS, Modbus, and Schneider Electric’s implementation of CoDeSys. While previous threat groups exploited the OPC-DA protocol to manipulate industrial control systems, CHERNOVITE uses the newer but comparable OPC-UA protocol. The PLC-related components of PIPEDREAM provide an interface for manipulating targeted devices and also contains tools for intrusion operations against Windows devices. <b>PIPEDREAM</b> relies on various ubiquitous technologies to facilitate intrusion and exploitation.</span></p><p><span style="font-size: 13px;">It is important to note that as of the time the information was published, PIPEDREAM had not yet been deployed in the wild. This rare case of accessing and analyzing malicious capabilities developed by adversaries before their deployment gives defenders a unique opportunity to prepare in advance. The malware is targeted to equipment in liquefied natural gas (LNG) and electric power environments, but it is reasonable to assume that CHERNOVITE could adapt the capabilities of PIPEDREAM to compromise and disrupt a broader set of targets.</span></p>
Campaign Guidance
Remediation, mitigation, notes, history and related intelligence
Adopt stringent security protocols, including robust passwords, multi-factor authentication, and timely software updates.
Educate personnel about cyber threats and protective measures.
Develop a contingency plan for responding to and recovering from a cyber-attack.
Recommendations
Monitor industrial environments for all threat behaviors in the MITRE ATT&CK for ICS matrix as adversaries are increasing their scope and scale of capabilities.
Ensure ICS visibility and threat detection include all ICS North-South and East-West communications — network edge and perimeter monitoring are insufficient for PIPEDREAM.
Maintain knowledge and control of all assets within Operational Technology (OT) environments, including details such as ensuring only known-good firmware and controller configuration files are in use.
Utilize a fully researched and rehearsed industrial incident response plan that includes attempts by adversaries to deny, disrupt, and destroy processes ensuring an extended time-to-recovery.