Loading story…
Malware was found on a computer at Germany’s Gundremmingen nuclear power plant during preparatory testing, and operator RWE said the affected system was not connected to the internet and did not pose an immediate operational threat. Investigators identified Conficker, a worm that once infected millions of systems worldwide, and also found additional malware on 18 removable disk drives used at the facility.
The incident underscored how air-gapped industrial environments can still be compromised through removable media, even when they are isolated from external networks. Security researchers warned that malware often dismissed as commonplace can still create serious risk inside critical infrastructure, while broader assessments of the nuclear sector have found many countries lack basic cybersecurity requirements for nuclear facilities.
See the actors and campaigns active against you right now.
3 events from the most recent confirmed update back to the earliest known activity.
The investigation also identified malware on 18 removable disk drives at the Gundremmingen facility. Reported malware included Conficker, highlighting the risk of infection reaching air-gapped systems through removable media.
RWE, the utility operating the plant, stated that it did not view the malware incident as an immediate threat because the affected computer was not internet-connected. The statement accompanied public reporting on the discovery.
During preparatory testing work in 2016, malware was found on a computer at Germany's Gundremmingen nuclear power plant. The infected system was reportedly not connected to the internet.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Government and industry reporting warns that operational technology and industrial control systems remain dangerously exposed through weak remote access, poor segmentation, and internet-facing devices, giving both state-backed and criminal actors paths into critical infrastructure. A joint **CISA/NSA** advisory said adversaries routinely exploit legacy OT environments, public system information, and insecure remote connections to move from reconnaissance to manipulation of physical processes, while a separate **CISA/FBI** alert tied Chinese state-sponsored intrusions to U.S. natural gas pipeline operators and said the actors stole SCADA and ICS information to build capabilities for future disruption. Recent exposure research also found **6,300** internet-reachable industrial-control and building-automation devices near U.S. data centers, including **BACnet**, **Fox/Niagara**, **Modbus**, and Vertiv/Liebert systems that could affect cooling and power operations. The threat has already translated into real-world disruptive activity and increasingly specialized tooling. Dragos reported **FrostyGoop**, a Golang-based ICS malware that communicates over **Modbus TCP** and was likely used to disrupt heating services in Lviv, Ukraine, after attackers apparently entered through an internet-facing router and traversed poorly segmented networks. Other cited incidents and assessments include Israel’s thwarted attempt against water facilities, persistent Russian probing of U.S. power infrastructure, and leaked-document analysis describing a Russian capability designed to attack rail and petrochemical control systems through telecommunications access. Across the reporting, the common defensive priorities were to eliminate direct public exposure, harden and inventory remote access, enforce MFA, replace default credentials, patch supported systems, restrict engineering tools, and closely monitor OT network and protocol activity.
Aug 15, 2026
Security researchers reported that malware targeting operational technology is broader than rare, bespoke ICS implants alone. Mandiant detailed **COSMICENERGY**, an OT-focused malware framework with similarities to **INDUSTROYER**, **TRITON**, and **INCONTROLLER**, built around insecure industrial protocols such as `IEC-104` and packaged with common Python tooling. Separate Mandiant reporting on **INCONTROLLER** described modular tools including **TAGRUN** for OPC UA reconnaissance, **CODECALL** for Modbus and Schneider Electric PLC interaction, and **OMSHELL** for gaining shell access to Omron PLC environments, enabling actions ranging from tag manipulation and credential attacks to file transfer, traffic capture, and program-memory wiping. At the same time, Forescout found that generic malware families are increasingly reaching into OT environments through exposed devices and weak credentials rather than highly tailored tradecraft. In a VirusTotal hunt, researchers identified botnet-linked samples tied to **Aisuru**, **Kaiten**, and **Gafgyt** that attempted logins against PLCs and other OT products using default credentials, with some samples trying to wipe directories such as `/mnt/modbus_rtu`; affected technologies included devices from Modicon, Siemens, Emerson, Avocent, and Sierra Wireless. Dragos also documented trojanized "password recovery" tools for industrial assets, including one for Automation Direct DirectLogic 06 PLCs that exploited **CVE-2022-2003** to retrieve passwords while infecting engineering workstations with **Sality**, underscoring that OT operators face both purpose-built ICS malware and commodity malware abusing industrial access paths.
Aug 15, 2026
Researchers attributed a January 2026 cyberespionage campaign against Ukrainian government, military, and critical infrastructure organizations to the Russia-linked Gamaredon group, which used booby-trapped spearphishing attachments and malicious RAR archives exploiting WinRAR path traversal flaw **`CVE-2025-8088`** for initial access. The infection chain dropped an HTA payload dubbed **GammaPhish**, which launched via `mshta.exe` and fetched follow-on VBScript components including **GammaLoad**, **GammaWorm**, and **GammaSteel**. Sekoia said the operation marks a shift from Gamaredon’s older Pteranodon tooling to a fragmented, modular ecosystem in which multiple stages can independently act as backdoors and retrieve arbitrary remote code. The malware emphasized stealth, persistence, and resilient command-and-control. **GammaWorm** established persistence through scheduled tasks and RunOnce registry keys, hid modules in **NTFS Alternate Data Streams**, and spread through USB devices and network shares using malicious LNK shortcuts, including into air-gapped environments. Command-and-control discovery relied on dead-drop resolvers hosted on **Telegram**, **Telegra.ph**, **graph.org**, **Teletype**, **Cloudflare Workers**, and operator infrastructure, while **GammaSteel** staged dozens of DPAPI-encrypted modules in the registry and exfiltrated selected files to **AWS S3** or other S3-compatible storage with fallback to attacker-controlled servers. Because fresh payloads can be fetched at multiple stages, researchers warned that confirmed compromises may require full system wiping.
Jun 29, 2026