Loading story…
Security researchers reported that malware targeting operational technology is broader than rare, bespoke ICS implants alone. Mandiant detailed COSMICENERGY, an OT-focused malware framework with similarities to INDUSTROYER, TRITON, and INCONTROLLER, built around insecure industrial protocols such as IEC-104 and packaged with common Python tooling. Separate Mandiant reporting on INCONTROLLER described modular tools including TAGRUN for OPC UA reconnaissance, CODECALL for Modbus and Schneider Electric PLC interaction, and OMSHELL for gaining shell access to Omron PLC environments, enabling actions ranging from tag manipulation and credential attacks to file transfer, traffic capture, and program-memory wiping.
At the same time, Forescout found that generic malware families are increasingly reaching into OT environments through exposed devices and weak credentials rather than highly tailored tradecraft. In a VirusTotal hunt, researchers identified botnet-linked samples tied to Aisuru, Kaiten, and Gafgyt that attempted logins against PLCs and other OT products using default credentials, with some samples trying to wipe directories such as /mnt/modbus_rtu; affected technologies included devices from Modicon, Siemens, Emerson, Avocent, and Sierra Wireless. Dragos also documented trojanized "password recovery" tools for industrial assets, including one for Automation Direct DirectLogic 06 PLCs that exploited CVE-2022-2003 to retrieve passwords while infecting engineering workstations with Sality, underscoring that OT operators face both purpose-built ICS malware and commodity malware abusing industrial access paths.
See affected versions and whether adversaries are exploiting it.
13 events from the most recent confirmed update back to the earliest known activity.
Forescout found 17 botnet samples using default credentials for Emerson, Schneider Electric, Siemens, Avocent, and Sierra Wireless devices, all submitted to VirusTotal from the United States on August 21, 2024.
Forescout reported that Aisuru-related samples were re-submitted to VirusTotal from India on July 18, 2024.
Forescout used a YARA rule with 136 OT-related signatures to run a VirusTotal RetroHunt across files submitted from June 11 to September 11, 2024, matching 989 files.
The firmware vulnerability used by the malicious DirectLogic 06 password-recovery tool was assigned CVE-2022-2003 after Dragos recreated the exploit and disclosed it to Automation Direct.
Mandiant reported that COSMICENERGY may also have supported exercises in 2022 for the St. Petersburg International Economic Forum.
Mandiant assessed that COSMICENERGY may have been used to support exercises hosted by Rostelecom-Solar in collaboration with the Russian Ministry of Energy.
Forescout said every Aisuru sample since June 10, 2020 contained wiping capability indicated by the string "/mnt/modbus_rtu".
Forescout reported that Aisuru-related samples tied to the string "hoho4christmastrees" were first submitted to VirusTotal between May and August 2020, primarily from Japan.
Forescout reported that its analysis found only three FrostyGoop/BUSTLEBERM samples but uncovered multiple botnet clusters, including Aisuru, Kaiten, and Gafgyt-related activity abusing default OT credentials and in some cases wiping directories such as "/mnt/modbus_rtu".
Mandiant disclosed COSMICENERGY as a newly identified OT-focused malware family, assessing that its origin and purpose were inconclusive but that it had capabilities comparable to INDUSTROYER and similarities to other OT malware.
Mandiant published technical details on INCONTROLLER tooling, describing TAGRUN, CODECALL, and OMSHELL as tools for reconnaissance, PLC interaction, credential attacks, disruption, and shell access across multiple industrial control systems.
After Dragos disclosed the DirectLogic 06 vulnerability, Automation Direct released firmware updates to fix CVE-2022-2003.
Dragos reported a campaign in which social media accounts advertised password-recovery or "cracking" tools for industrial assets, and the analyzed DirectLogic 06 tool actually exploited a PLC vulnerability while dropping Sality malware on the engineering workstation.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 100 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
4 references tracked. Mallory keeps watching after this page renders.
forescout.com
Open sourcecloud.google.com
Open sourcecloud.google.com
Open sourcedragos.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Government and industry reporting warns that operational technology and industrial control systems remain dangerously exposed through weak remote access, poor segmentation, and internet-facing devices, giving both state-backed and criminal actors paths into critical infrastructure. A joint **CISA/NSA** advisory said adversaries routinely exploit legacy OT environments, public system information, and insecure remote connections to move from reconnaissance to manipulation of physical processes, while a separate **CISA/FBI** alert tied Chinese state-sponsored intrusions to U.S. natural gas pipeline operators and said the actors stole SCADA and ICS information to build capabilities for future disruption. Recent exposure research also found **6,300** internet-reachable industrial-control and building-automation devices near U.S. data centers, including **BACnet**, **Fox/Niagara**, **Modbus**, and Vertiv/Liebert systems that could affect cooling and power operations. The threat has already translated into real-world disruptive activity and increasingly specialized tooling. Dragos reported **FrostyGoop**, a Golang-based ICS malware that communicates over **Modbus TCP** and was likely used to disrupt heating services in Lviv, Ukraine, after attackers apparently entered through an internet-facing router and traversed poorly segmented networks. Other cited incidents and assessments include Israel’s thwarted attempt against water facilities, persistent Russian probing of U.S. power infrastructure, and leaked-document analysis describing a Russian capability designed to attack rail and petrochemical control systems through telecommunications access. Across the reporting, the common defensive priorities were to eliminate direct public exposure, harden and inventory remote access, enforce MFA, replace default credentials, patch supported systems, restrict engineering tools, and closely monitor OT network and protocol activity.
Aug 15, 2026
Security reporting and expert commentary warn that **operational technology (OT)** environments remain highly exposed due to fragile access controls and that attacker capability is trending toward more dangerous, process-aware operations. Lessons drawn from the 2015 **Ukraine power grid** disruption emphasize that remote connectivity, vendor access, and broad VPN permissions can become the “soft underbelly” of critical infrastructure, with recurring real-world examples of disruption tied to **misused remote access and stolen credentials** (including the **Colonial Pipeline** shutdown following a compromised password). The core takeaway is that OT systems are no longer “too specialized” to be targeted, and that common enterprise intrusion paths—credential compromise and remote access abuse—continue to translate into operational impact when they bridge into industrial environments. Separately, OT-focused threat analysis highlights early signs that attackers are gaining the “process comprehension” historically missing from many intrusions into industrial systems. A forthcoming RSA Conference 2026 presentation is expected to demonstrate **“living-off-the-plant”** techniques—analogous to living-off-the-land in IT—where adversaries leverage native industrial tooling and legitimate functions inside plants to blend in and potentially manipulate physical processes. The reporting argues that “security by obscurity” (attackers’ unfamiliarity with bespoke/legacy OT) has limited the severity of many incidents so far, but that this advantage is eroding as adversaries become more comfortable operating within industrial environments, increasing the risk of more consequential OT attacks.
Jun 29, 2026
CISA published guidance explaining why *secure* variants of common industrial communication protocols remain under-adopted across critical infrastructure OT environments, despite being available for decades. The guidance highlights persistent reliance on legacy protocols designed for uptime rather than security, leaving common gaps—**no authentication, no integrity, and no confidentiality**—that enable attackers with OT network access to impersonate devices, alter messages in transit, or issue unauthorized commands. CISA based its findings on interviews with asset owners/operators across sectors including Water/Wastewater, Transportation, Chemical, Energy, and Food/Agriculture, and pointed to secure alternatives such as **DNP3 Secure Authentication**, **CIP Security**, **Modbus Security**, and **OPC UA**, while noting real-world barriers like cost, complexity, and operational fragility. Separately, reporting described **Operational Relay Box (ORB)** networks—mesh-like relay infrastructure built from compromised IoT devices, SOHO routers, and VPS nodes—used by threat actors to obscure attack origins and blend malicious traffic into residential/business broadband patterns, complicating blocking and attribution. The ORB discussion was tied to a Singapore CSA disclosure that **UNC3886** targeted major telecom operators (M1, SIMBA, Singtel, StarHub), reportedly exploiting **zero-day perimeter firewall vulnerabilities** and deploying rootkits for stealth and persistence. In OT device security, CERT@VDE warned of a cluster of critical vulnerabilities in **WAGO 852 series industrial managed switches** (models `8052-1322` and `0852-1328`, firmware `2.64` and earlier), including **CVE-2026-22906** (hardcoded AES-ECB key enabling credential recovery from configuration files) and additional critical issues (CVSS **9.8**) in the web management stack (modified *lighttpd* and custom CGI) that can be triggered via oversized cookie parsing to crash devices or potentially enable remote code execution—conditions that materially increase the risk of remote takeover within OT networks.
Jun 29, 2026