Whitepaper

PIPEDREAM: CHERNOVITE’S EMERGINGMALWARE TARGETING INDUSTRIAL
CONTROL SYSTEMS

Dragos, Inc.

info@dragos.com@DragosInc

WHITEPAPER

TLP: WHITE information may be distributed without restriction

CONTENTS

Executive Summary................................................................................. 3
CHERNOVITE – The Threat Group Behind PIPEDREAM................. 4
Key Findings.............................................................................................. 6
Impacted Technology...............................................................................7
PIPEDREAM Summary Analysis........................................................... 9
Defending Against PIPEDREAM – What You Can Do Now...........14
Frequently Asked Questions............................................................... 18

D R AG O S , I N C .

2

WHITEPAPER

TLP: WHITE information may be distributed without restriction

E X ECU T I V E SUMM A RY

PIPEDREAM is the seventh-known Industrial Control Systems (ICS)-specificmalware and the fifth malware specifically developed to disrupt industrial
processes. PIPEDREAM demonstrates significant adversary research anddevelopment focused on the disruption, degradation, and potentially, thedestruction of industrial environments and physical processes.
The Dragos-designated threat group CHERNOVITE developed
PIPEDREAM, which consists of a collection of components. PIPEDREAM
can impact a wide variety of Programmable Logic Controllers (PLC) andindustrial software, including specific Omron and Schneider Electric PLCs,
and poorly configured Open Platform Communications Unified Architecture(OPC-UA) servers.
One of the Schneider Electric PLCs that PIPEDREAM targets, leverages
CODESYS as its underlying system architecture. PIPEDREAM uses CODESYS
as a key component to abuse due to its lack of security. CODESYS is athird-party software component used by hundreds of industrial equipmentvendors. While PIPEDREAM can currently identify and target PLCs from
Omron and Schneider Electric, its tooling may be used to target and attack
controllers from hundreds of other vendors. In sum, PIPEDREAM can target
a variety of PLCs in multiple verticals due to its versatility.
Dragos assesses with high confidence that PIPEDREAM has not yet
been employed for disruptive or destructive effects. This is a rare caseof analyzing malicious capabilities before employment of effects against
victim infrastructure, giving defenders a unique opportunity to preparein advance. Dragos assesses with high confidence that this capability wasdeveloped by a state-sponsored adversary with the intention to leverage
PIPEDREAM in future operations.

D R AG O S , I N C .

3

WHITEPAPER

TLP: WHITE information may be distributed without restriction

CHERNOV I T E - T H E T H R E AT GROUPB EHIND PIPEDR E A M

Based on current observations, CHERNOVITE
focuses on manipulating industrial control
systems and can achieve Stage 2 of the ICS
Cyber Kill Chain. As an impact-focused team,
CHERNOVITE would need access facilitatedby other teams to ingress into target
environments.
CHERNOVITE’s observable infrastructure
consists of compromised, adversary-controlled command-and-control
infrastructure. Their activity is expected to shift to a malicious
adversary-controlled domain or webserver. CHERNOVITE is likely touse service provider infrastructure; however, there are no indications ofcurrent active infrastructure. CHERNOVITE can use target infrastructure
to facilitate interactive operations and lateral movement, accessenablement in an operational technology (OT) environment, and themanipulation of processes to achieve adversary intent.

D R AG O S , I N C .

4

WHITEPAPER
WHITEPAPER

TLP: WHITE information may be distributed without restriction

WHY ARE WE PUBLISHING THIS?
Threats to industrial infrastructure security are an extremely
sensitive matter. Given the unique realities of industrial
operations, it is often harder for defenders to react than foradversaries to leverage public information. The more time thecommunity has to implement mitigations before new malicious
capabilities become public, the better the chance the adverse
effects from any attempted attacks will be reduced.
Dragos identified and analyzed PIPEDREAM’s capabilities
through our normal business, independent research, andcollaboration with various partners in early 2022. Our primary
focus is informing industrial asset owners and operators withas much information as possible. It is the team’s stance never
to be first to communicate detailed technical insights on ICS
threats and capabilities until the information is already going
to become public; this is done as the information can often be
weaponized and industrial control system (ICS) defenders needas much time as possible. Once information about threats andnew capabilities are made public, Dragos’s approach is to follow
up with detailed analysis and advice to the security community.
This report was proactively written and readied for release as
the information became public through other avenues.

D R AG O S , I N C .

5

WHITEPAPER

TLP: WHITE information may be distributed without restriction

KEY FINDINGS
Summary of Key Findings:• PIPEDREAM is a clear and present threat to theavailability, control, and safety of industrial
control systems and processes. PIPEDREAMcan be used to endanger operations and lives.
• PIPEDREAM’s industrial-related components
expose a command-line interface formanipulating target controllers and OPC-UA
servers.
• PIPEDREAM can execute 36 MITRE ICSATT&CK techniques.
• CHERVONITE can manipulate the speed andtorque of Omron servo motors used in manyindustrial applications. This manipulation
can cause disruption or destruction ofindustrial processes, leading to potential lossof-life scenarios.
• PIPEDREAM’s Windows-related components
facilitate host reconnaissance, commandand control (C2), lateral tool transfer, and thedeployment of unsigned rootkits.
• CHERNOVITE can leverage PIPEDREAM’s
multiple components to perform rapid
reconnaissance of ICS networks by using avariety of mechanisms, including:o Identifying known MAC addresseso Port numberso HTTP bannerso Omron’s proprietary Factory Interface
Network Service Protocol (FINS)

o Remotely interacting with PLCs using
CODESYS to support numerous attacks
like brute-force passwords, performing
denial-of-service (DoS) attacks against thecontroller, and severing connections.
o Remotely interacting with Omron PLCs
through HTTP and Telnet to load a native
implant to support further commandexecution.
o Remotely interacting with Omron PLCs
through exposed HTTP endpoints tochange the operating mode (program,run, etc.), backing up and restoring
configurations, and wiping the PLC’s
memory, among other capabilities.
o Writing arbitrary node attributes on an
OPC-UA server.
• CHERNOVITE can trigger Denial of Control
and Denial of View for operators using
multiple methods.
• CHERNOVITE disrupts operational
technology by subverting and masquerading
within trusted processes.
• CHERNOVITE can significantly extend
time-to-recovery after an industrial incident
by disabling process controllers, potentiallyrequiring them to be returned to the
manufacturer before reuse.

o Schneider’s custom Discovery broadcast
protocol (NetManage).

• CHERNOVITE can operate across process
and security zones by using PLCs as
network proxies across an OT environment,
potentially bypassing firewalls, DMZs, andperimeter-based threat detection.

• CHERNOVITE can achieve Develop, Deliver,
Install/Modify, and Execute ICS Attack
portions of the ICS Cyber Kill Chain Stage 2 inseveral ways. These are some examples:• CHERNOVITE can undermine authenticationand encryption inside OT environments bycollecting network traffic from PLCs andweakening PLC authentication.

o Modbus

D R AG O S , I N C .

6

TLP: WHITE information may be distributed without restriction

WHITEPAPER

IMPAC T ED T ECHNOLOG Y
PIPEDREAM has been designed to interact with and exploit the following devices. These devices areused in many vertical industries. However, Dragos assesses that the likely targets of the malware
are equipment in liquefied natural gas (LNG) and electric power environments. Table 1 contains asummary of the potentially impacted technology.

Table 1: Summary of the potentially impacted technology (continued next page)
Product

Manufacturer

Description

Omron
NX1P2 PLC

Compact Machine Controller
Built in EtherCAT to simplify the wiringof up to eight servo systems including forsingle-axis position control.

Omron
NX-SL3300

PIPEDREAM
Attack Module

BADOMEN

Safety Controller
SIL-3 rated safety controller.
Integrated safety over EtherCAT.
BADOMEN

Omron
NJ501-1300 PLC

Machine Automation Controller
Native OPC-UA, EtherCAT, Ethernet/IP.
BADOMEN

Omron
NX-ECC,NX-EIC202,
NX-ECC203

EtherCAT Couplers
Provides an interface between acontroller and connected EtherCAT
Terminals.

Omron R88D1SN10F-ECT

1S Servo Drive
1 kW, , 3-400 VAC EtherCAT type servo
drive.

BADOMENBADOMEN

Omron
S8VK

Power Supply
DC 24V 5.0A DIN Rail Power Supply.
BADOMEND R AG O S , I N C .

7

TLP: WHITE information may be distributed without restriction

WHITEPAPER

Table 1: Summary of the potentially impacted technology
Product

Manufacturer

Description

Schneider
Modicon M241
(TM241)

IIoT Native Edge Logic Controller
EtherNet/IP; RS 232/RS 485 serial link;
USB mini-B programming port

PIPEDREAM

Attack Module

EVILSCHOLAR

Schneider
Modicon M251
(TM251)

Schneider
Modicon M221
(TM221)

Schneider
Modicon(TM238)Schneider
Modicon M258
(TM258)Programmable Logic Controller
EtherNet/IP; CANopen (master) andSAE J1939; Serial link; USB mini-B
programming port

EVILSCHOLAR

Logic Controller/IO Relay
PLC for hardwired architectures.
EtherNet/IP; RS 232/RS 485 serial link;
USB mini-B programming port

EVILSCHOLAR

Logic ControllerStandalone / “all-in-one” solution in acompact unit. Ethernet Modbus/TCP,
Profibus DP, DeviceNet, etc.

EVILSCHOLAR

Logic Controller
42 or 66 digital I/O; Embedded serial link
and Ethernet port; 4 analog inputs
EVILSCHOLAR

Schneider
LMC058

Motion Controller
Solution for axis control and positioning,
including automation functions
EVILSCHOLAR

Schneider
LMC078D R AG O S , I N C .

Motion Controller
Designed for compact machines that
require a high level of performance inmotion control applications. Velocity andtorque control, etc.

EVILSCHOLAR
EVILSCHOLAR

8

WHITEPAPER

TLP: WHITE information may be distributed without restriction

PIPEDREAM can also be used to execute attacks against the ubiquitous industrial technologies
listed below.

Modbus TCP

CODESYS

Modbus is a serial communication protocol
developed and published by Modicon® in 1979 foruse with its PLCs. In simple terms, it is a method
used for transmitting information over seriallines between electronic devices. Modbus later
adopted the Open Systems Interconnect (OSI)
TCP/IP communications protocols to expand
communications over interconnected networks.
The resulting protocol is now commonly referred
to as Modbus TCP and is one of the most common
ICS protocols.1

With the adaptable CODESYS Control runtime
system, any intelligent device is transformed
into a complete IEC 61131-3 controller. PLC
manufacturers use a toolkit to port the CODESYS
runtime system on their device and turn it into a
CODESYS-compatible IEC 61131-3 PLC.3

OPC-UAThe OPC Unified Architecture (UA), released
in 2008, is a platform-independent serviceoriented architecture that integrates all thefunctionality of the individual Open Platform
Communications (OPC) Classic specifications into
one extensible framework.2

Windows
ASRock Motherboard Utility is an all-in-one
utility designed for system updates andsoftware downloading. It is integrated with avariety of applications and support software.
ASRock Motherboard Utility provides the latest
BIOS updates and system upgrade softwarefor users to download. ASRock Inc. is theworld's third-largest motherboard brand andmanufactures both industrial and consumer
computers and hardware.4

PIPEDR E A M SUMM A RY A N A LYSI SPIPEDREAM is a collection of utilities that includes tools for reconnaissance, manipulation, anddisruption of PLCs, as well as tools for intrusion operations against Windows devices. At thehighest level, the PLC-related components of PIPEDREAM provide the adversary with an interface
for manipulating the targeted devices. Tools in PIPEDREAM can scan for new devices, brute
force passwords and sever connections, and crash the target device. To accomplish these goals,
PIPEDREAM uses several different protocols, including Omron’s proprietary FINS, Modbus, andSchneider Electric’s implementation of CODESYS. Given the variety of protocols that PIPEDREAM
abuses, CHERNOVITE possesses a breadth of ICS knowledge beyond any of Dragos’s previously
discovered threat groups.

1

https://www.modbus.org/specs.php; 2https://opcfoundation.org/about/opc-technologies/opc-ua/; 3https://www.codesys.com; 4https://en.wikipedia.org/wiki/ASRock

D R AG O S , I N C .

9

TLP: WHITE information may be distributed without restriction

WHITEPAPER

CHERNOVITE’s PIPEDREAM is a highly capable offensive ICS attack framework. It can execute 36
known ICS attack techniques (which is 46 percent of known ICS attack tactics) as measured against
the MITRE ATT&CK for the ICS behavior matrix, shown in Figure 1.

INITIALACCESSEXECUTIONPERSISTENCEPRIVILEGEESCALATIONEVASIONDISCOVERYLATERAL
MOVEMENT

COLLECTION

COMMAND &CONTROLINHIBITRESPONSE
FUNCTION

IMPAIR
PROCESSCONTROLIMPACT

Data HistorianCompromise

ChangeOperatingMode

ModifyProgram

Exploitation
for Privilege
Escalation

ChangeOperatingMode

Network
Connection
Enumeration

Default
Credentials

Automated
Collection

Commonly
Used Port

Activate
FirmwareUpdate Mode

Brute Force
I/O

Damage toProperty

Drive-byCompromiseCommandLine Interface

ModuleFirmwareHooking

Exploitation
for Evasion

Network
Sniffing

Exploitationof Remote
Services

Data from
Information
Repositories

Connection
Proxy

Alarm
Suppression

ModifyParameter

Denial ofControlEngineering
Workstation
Compromise

Execution
through API

Project File
Information

Indicator
Removal on
Host

RemoteSystemDiscovery

Lateral Tool
Transfer

DetectOperatingModeStandard
Application
Layer Protocol

Block
Command
Message

ModifyFormwareDenial of View

ExploitPublic-Facing
Application

Graphical User
Interface

SystemFirmware

Masquerading

Remote System
Information
Discovery

Program
Download

I/O Image

BlockkReporting
Message

Spoof
Reporting
Message

Loss of
Availability

Exploitationof Remote
Services

Hooking

Valid Accounts

RootkitWireless
Sniffing

RemoteServices

Man in the
MiddleBlock Serial
COM

UnauthorizedCommand
Message

Loss ofControlInternet
Accessible
DeviceModifyController
Tasking

Valid Accounts

Monitor
Process State

Data
Destruction

Loss of
Productivity
and Revenue

RemoteServices

Native API

Point & Tag
Identification

Denial ofService

Loss ofProtection

Replication
via Removable
Media

Scripting

ProgramUploadDeviceRestart/Shutdown

Loss of Safety

Rogue Master

User
Execution

ScreenCaptureManipulate
I/O Image

Loss of View

Wireless
Sniffing

Modify Alarm
Settings

Manipulationof Control

Supply Chain
Compromise

RootkitManipulationof View

Wireless
CompromiseService Stop

Theft of
Operational
Information

Spearphishing
Attachment

Spoof
Reporting
Message

SystemFirmwareFigure 1 - Mapping for CHERNOVITE/PIPEDREAM MITRE ATT&CK for ICS Techniques

PIPEDREAM utilizes PLC implants to execute untrusted code on the PLC devices themselves beyond
the view of the host-based monitoring found on Windows and Linux assets. Implants could live on
PLCs for years before they are discovered, as only a firmware forensic analysis of a PLC would reveal
the existence of the implant.

D R AG O S , I N C .

10

TLP: WHITE information may be distributed without restriction

WHITEPAPER

PIPEDREAM Utilities Explained
There are a few key design decisions about
PIPEDREAM that indicate CHERNOVITE’sdevelopment team characteristics.

adversary is aware of successful attacks and isactively seeking to develop a mature capability
to achieve a similar impact.

Both EVILSCHOLAR and BADOMEN are
extensible and modular. This fact suggests thatdevelopers intend to support the tool long term.
They are aware that the toolsets need to adapt
to new operational requirements. In other words,
they may need to be extended for new target
devices. The design is comparable to common red
team tools such as Metasploit and Powershell
Empire. Furthermore, the tools are easy to use,which means the developers are likely aware
they may need to be used by operators lessknowledgeable than the developers.

The addition of DUSTTUNNEL and LAZYCARGO
to PIPEDREAM indicates that CHERNOVITE
is not only thinking about OT. They are also
thinking about how it can achieve an end-to-end
attack, starting with an IT intrusion, pivoting
into OT, and executing an attack that covers ICS
Kill Chain Stages 1 and 2.

MOUSEHOLE provides an interactive capability
for manipulating OPC-UA server nodes andthe associated devices. MOUSEHOLE is akinto an upgraded CRASHOVERRIDE and is thefirst time Dragos has witnessed a threat grouplearning from another threat group, in this case,
ELECTRUM’s attack. This indicates that theThe breadth of knowledge required to developthese tools indicates that CHERNOVITE is highly
knowledgeable of ICS protocols, devices, andhow to apply this knowledge to achieve aneffect. They likely have a budget for acquiring
devices to test their toolset.
Given these indicators, Dragos
assesses with high confidence
that CHERNOVITE is highly motivated,skilled in software development methods,
well versed in ICS protocols and intrusion
techniques, and well-funded.

The following is a list of the utilities with their capabilities. It is important to note that while theadversary could use these tools together, they are not required to be deployed together. PIPEDREAMshould be viewed as a toolkit rather than a holistic attack suite.

EVILSCHOLAR

A capability
designed to discover,access, manipulate,and disable
Schneider Electric
PLCs.

D R AG O S , I N C .

BADOMEN

A remote shell
capability designed
to interact with
Omron software and
PLCs.

MOUSEHOLE

A tool for interactingwith OPC-UA servers. It
is designed to read andwrite node attributedata, enumerate theServer Namespace andassociated NodeIds,
and brute force
credentials.

DUSTTUNNEL

A custom remote
operational implantcapability to perform
host reconnaissanceand command-andcontrol.

Figure 2 - PIPEDREAM Utility Capabilities

LAZYCARGO

A capability thatdrops and exploits avulnerable ASRockdriver to load an
unsigned driver.

11

TLP: WHITE information may be distributed without restriction

WHITEPAPER

01

Dragos Platform Detections are designed to alert on PIPEDREAM behavior
at these points in the ICS Cyber Kill Chain

DEVELOP

Initial Communication Attempt

02

Unauthorized Login

Initial Device Connectivity

TEST

03

DELIVER

File Transfer of PIPEDREAM

Telnet Login Bypass

HTTP Login Bypass

File Upload

File Transfer of LAZYCARGO

04

INSTALL/
MODIFY

05

EXECUTEInterrogate Windows System

Get PLC Status

Read PLC Operation

HTTP Encrypted Post

Activate Telnet

Password Brute Force Attempt

Scan for Devices

Figure 3: ICS Cyber Kill Chain

Suspected Deployment Scenarios
The following provides an example scenario of the deployment of PIPEDREAM components, alongwith the possible impact based on Dragos’ analysis of PIPEDREAM malware to date.

PHASE 1: IT NETWORK INTRUSIONCHERNOVITE could deploy DUSTTUNNEL within
an enterprise network through phishing orcompromised remote access. Using DUSTTUNNEL's
command-and-control functions, CHERNOVITE
could drop additional tools such as Mimikatz togather credentials to access a legitimate account andgain a persistent foothold in the enterprise network.
From there, DUSTTUNNEL can allow the adversary
to enumerate the network to locate IT-OT DMZ andthen move laterally using captured credentials. At
this stage, CHERNOVITE may deploy LAZYCARGO

D R AG O S , I N C .

to install a rootkit to protect the established footholdwithin the corporate network.

PHASE 2: OT ENUMERATION
DUSTTUNNEL can allow CHERNOVITE to traverse
to operational technology (OT) networks or jumpboxes in the IT-OT demilitarized zone (DMZ).
LAZYCARGO could also be deployed at this stage on
operator stations/Human-Machine Interface (HMI)
to install unsigned device drivers to manipulate
traffic being sent between HMIs and field devices.

12

TLP: WHITE information may be distributed without restriction

WHITEPAPER

PHASE 3: CONTROLLER COMPROMISE
Once in the OT network, CHERNOVITE canleverage MOUSEHOLE to identify and brute force
authentication to an OPC-UA server. CHERNOVITE
can then enumerate devices on the OT network andsee configurations, with the potential to manipulatetags and control points. Depending on the identified
plant infrastructure, CHERNOVITE could deploy
EVILSCHOLAR and/or BADOMEN to interact with
Schneider Electric PLCs and Omron PLCs.

PHASE 4: FURTHER COMPROMISEOF CONTROL NETWORKS

used to pivot into protected network segments
by abusing Schneider Electric controller routing
behavior. This functionality would allow further
enumeration of controllers to be targeted in
Modbus enumeration and exploitation.

PHASE 5: CROWN-JEWEL OBJECTIVESCapabilities to reprogram and potentially disable
safety controllers and other machine automation
controllers could then be leveraged to disable
emergency shutdown systems, and subsequently
manipulate the operational environment tounsafe conditions.

EVILSCHOLAR proxy functionality could then be

C2 IMPLANT

MOUSEHOLE

ENUMERATE PLCs AND
OT NETWORKSENTERPRISE
ASSET

OPC-UASERVERITEnterprise

DUSTTUNNELLEVEL 3.5
DMZ

LEVEL 3Operational
Systems
LEVEL 2

SCADA
& HMI

Supervisory
Control

OT

LEVEL 1
Basic
Control

EVILSCHOLAR

SCHNEIDER PLC EXPLOITATIONSCHNEIDERPLCs

LAZYCARGOUNSIGNED DRIVER LOADING

PIVOT
USING
PLC
SHELL

PIPEDREAMLEVEL 4BADOMENOMRON PLC/SIS EXPLOITATION

OMRON
PLCs

OMRON
SAFETYPLCs

LEVEL 0PhysicalProcess

SENSORSACTUATORSSENSORSACTUATORS

Figure 4: CHERNOVITE scenario example
D R AG O S , I N C .

13

TLP: WHITE information may be distributed without restriction

WHITEPAPER

DEFENDING AGAINST PIPEDREAM –WHAT YOU CAN DO NOWThe Dragos Platform contains several detections for PIPEDREAM activity. Dragos customers employing
the most recent Knowledge Packs can find these detections in the Dragos platform under the Content
tab. Managed service customers can go through OT Watch. Dragos has already searched throughNeighborhood Keeper participants for activity. Asset owners who are not Dragos platform customers
should focus on identifying the Tactics, Techniques, and Procedures (TTP) detailed in this report andfollow the recommended actions to mitigate impacts to your environment in Table 2. Much of theguidance to the community in the form of standards, frameworks, and regulations heavily focuses on
preventing cyber attacks. This means the community often puts very limited focus on detection andresponse. Given the type of threat, it is imperative to be able to detect and respond instead of simply
attempting to prevent access.

Schneider Electric Technology Mitigations
Table 2: Schneider Electric Technology Mitigations
ActionTargetChange default credentials

Where feasible, in conjunction with operations and site personnel for
Schneider Electric TM2xx series PLCs:
Beginning with firmware 5.0, the devices use default credentials'
Administrator’/’Administrator', and these should be changed to a complex
password using the EcoStruxure software.

Restrict access to UDP/1740-1743,
TCP/1105, and TCP/11740.

For all Schneider Electric TM2xx series PLCs

Restrict access to TCP/11740.

For non-Schneider PLCs known to communicate with this port from theengineering workstation

Disable the Schneider NetManage
discovery service.

In conjunction with operations and site personnel, disable Schneider
NetManage discovery service, as it is used by CHERNOVITE to discover PLCs(see VA-2019-02).

Monitor affected PLCs for new
outbound connections.

Look for communications to other PLCs on the network, on: UDP/1740-1743,
TCP/1105, and TCP/11740.

Validate the engineering
workstation software EcoStruxure Machine Expert.

Remove unnecessary software. If possible, apply application allow listing
software on the workstation. Restrict the workstation from making outboundnetwork connections, especially to Internet services.

D R AG O S , I N C .

14

TLP: WHITE information may be distributed without restriction

WHITEPAPER

Omron Technology Mitigations
Table 3: Omron Technology Mitigations
ActionTargetRestrict access to TCP/80,
TCP/9600, and UDP/9600

For all Omron PLCs. Only allow EWS systems to communicate on these ports.

Validate the engineering
workstation software - Omron
Sysmac/CX-One/NX IO
Configurator

Remove unnecessary software. If possible, apply application allow listing
software on the workstation. Restrict the workstation from making outboundnetwork connections, especially to Internet services.

OPC-UA Mitigations
Table 4: OPC-UA Mitigations
ActionTargetEnable OPC-UA security

Ensure OPC-UA security is correctly configured with application
authentication enabled and explicit trust lists.
Ensure the certificate private keys and user passwords are stored securely.
Ensure mDNS (which actively broadcasts the location of OPC-UA servers) is
disabled on all machines.
ICS operators can manage the security configuration for their OPC-UA devices
using their engineering workstation software (in most cases).
Using "sign-only" security mode with OPC-UA is optimal for ICS environmentsthat leverage network monitoring solutions (like the Dragos Platform). Signonly security mode sends messages unencrypted but with an authentication
code that allows receivers to be sure the message came from a trusted sender.
This protects against tools like MOUSEHOLE that send unauthorized messages
to OPC-UA clients and servers while allowing the packets to be inspected by
network security devices.
Specific recommendations for OPC-UA security best practices can be found on
the OPC-UA foundation’s website:
https://opcfoundation.org/UA/Security/BestPractices.pdf

D R AG O S , I N C .

15

TLP: WHITE information may be distributed without restriction

WHITEPAPER

MITRE ATT&CK for ICS Techniques
In addition, focus detection and monitoring efforts on the TTPs outlined in this document, including thefollowing:

Table 5: MITRE ATT&CK for ICS Technologies
Activity

MITRE ATT&CK for ICS TechniqueFile Transfer of PIPEDREAMT1544 Remote File Copy; T1105 Ingress Tool Transfer

PIPEDREAM Execution

T1059 Command and Scripting Interpreter

PIPEDREAM Interrogate Windows
System

T1047 Windows Management Instrumentation

BADOMEN Telnet Login Bypass

T1552.001 Unsecured Credentials: Credentials in Files

BADOMEN HTTP Login Bypass

T1552.001 Unsecured Credentials: Credentials in Files

BADOMEN Get PLC Status

T0868 Detect Operating Mode

BADOMEN PLC Read Operation

T0888 Remote System Information Discovery

BADOMEN HTTP Encrypted Post

T1573 Encrypted Channel

BADOMEN Activate Telnet

T1021 Remote Services

BADOMEN File Upload

T1544 Remote File Copy

EVILSCHOLAR Password Brute
Force Attempt

T1110 Brute ForceEVILSCHOLAR Denial of Service
Attempt

T0814 Denial of Service

EVILSCHOLAR Initial
Communication Attempt

T0869 Standard Application Layer Protocol

EVILSCHOLAR Unauthorized Login

T1078 Valid Accounts

File Transfer of LAZYCARGO

T1544 Remote File Copy

MOUSEHOLE Scan for Devices

T1046 Network Service Scanning

MOUSEHOLE Initial Device
Connectivity

T0869 Standard Application Layer Protocol

D R AG O S , I N C .

16

WHITEPAPER

TLP: WHITE information may be distributed without restriction

OT Best Practices
MONITOR EAST-WEST ICS NETWORKS WITH ICS PROTOCOL AWARETECHNOLOGIES
Perform network traffic monitoring with a focus on East-West communications instead of simply NorthSouth (ingress/egress) communications. PIPEDREAM’s ability to move from Engineering Workstation to PLC
and then PLC to PLC means that simply monitoring North-South communications or putting emphasis on
segregation will be insufficient. Specifically look for modifications to PLCs occurring outside of maintenanceperiods such as the changing of logic using native ICS protocols.

PLC NETWORK TELEMETRY ANALYSIS
Monitor for unusual interactions with PLCs from non-standard workstations or accounts.

ISOLATE MISSION CRITICAL SKID SYSTEMS
Consider implementing hardwired I/O between critical skid systems and distributed control systems I/O inplace of direct communications if feasible.

NETWORK ISOLATION OF SAFETY SYSTEMS
Ensure network isolation for safety system components, monitor safety system networks for new connections
or devices, and verify all configuration changes are compliant with change management procedures.

Long-Term Readiness
ICS-FOCUSED INCIDENT RESPONSE PLAN
Create and update an ICS-focused Incident Response (IR) plan with accompanying Standard Operating
Procedures (SOP) and Emergency Operating Procedures (EOP) for operating with a hampered or degraded
control system. Conduct a table top exercise focused on CHERNOVITE’s ICS Cyber Kill Chain with an emphasis
on PIPEDREAM; use this opportunity to identify process and collection gaps that could hinder the detection
and response efforts.

SPARE PARTS INVENTORY
Create and update a spare parts inventory for critical control system components, including hardware,
software, firmware, configuration backups, and licensing information. Develop plans and procedures forsourcing and procurement of critical control system components. Consider the implementation of cold
backups for rapid replacement of ICS level one devices.
D R AG O S , I N C .

17

WHITEPAPER

TLP: WHITE information may be distributed without restriction

FREQUENTLY ASKED QUESTIONS
How significant is PIPEDREAM to ICS/OT
environments?
PIPEDREAM is the seventh-known ICSspecific malware, following STUXNET,HAVEX, BLACKENERGY2, CRASHOVERRIDE/INDUSTROYER, TRISIS/TRITON, and
INDUSTROYER2. It is the first-ever known
ICS-tailored malware assessed to be developedby a state actor to be identified before use for
its intended purpose. New tactics, techniques,and procedures (TTP) based on detections andawareness will increase the overall security
posture of OT environments, regardless ofwhether CHERNOVITE will deploy PIPEDREAM.
What questions should executives ask?
Executives should ask their security teams:• Do we have Omron, Schneider Electric, or
OPC-UA in our environment(s)? If so, where
and what type(s)?
• If we needed to collect data from theenvironment, or validate that the system has
not been modified, could we?
• If the processes that use these devices
or protocols are disrupted, is there acybersecurity component in place todetermine root cause analysis and if an attack
has occurred?
• Do we have an incident response plan thatfactors in the loss of any of these devices?
What monitoring do we have in place toensure it is not impacted?

2

Could this malware lead to loss of life?
When discussing safety impacts, there must
be a thorough understanding of the specificenvironments and how they are configured andimplemented. It is possible to leverage PIPEDREAMin a wide range of industrial controllers andenvironments, meaning that it could also beleveraged in attacks on safety instrumented
systems (SIS). Should CHERNOVITE reprogram thesafety controller without appropriate outputs, thesafety integrity of the plant would be compromisedand could rely on mechanical fail-safes. However,
PIPEDREAM was found before the adversary could
employ it for their desired effects, so there are no
known targeted environments currently, and theadversary's goal may or may not be safety focused.
What are the Indicators of Compromise (IOC)?
Dragos recommends that defenders focus on the
TTPs of PIPEDREAM components versus simple
IOCs. Please refer to the mitigations in this paper.
If I do not have Schneider Electric or Omron in
my network, should I care about PIPEDREAM?
Yes, the capabilities are further reaching than
Schneider Electric or Omron vendors. CODESYS
protocol is used in hundreds of controllers far
beyond Schneider Electric and Omron.
Additionally, MOUSEHOLE targets andcompromises OPC-UA servers.
OPC is an interoperability standard for the secureexchange of industrial automation data. It is
designed to be platform-agnostic so devices fromdifferent vendors can exchange information.

https://www.motioncontroltips.com/what-is-opc-ua-and-how-does-it-compare-with-industrial-ethernet/

D R AG O S , I N C .

18

WHITEPAPER

Multiple Industrial Ethernet (IE) protocols in
manufacturing processes and plants — suchas EtherNet/IP, PROFINET, or EtherCAT — areused across different networks to meet specifictopology requirements and communication
speeds or latency guarantees. Although thesecommunication protocols are open, they are often
incompatible, resulting in fragmented networks
that cannot “speak” to each other.
OPC-UA was developed to solve this problem byallowing industrial devices operating with different
protocols and on different platforms (Windows,
Mac, or Linux, for example) to communicate
with each other. OPC-UA goes beyond Industrial
Ethernet in reach, including devices from thelowest level of the automation pyramid — such as
field devices that deal with real-world data, suchas sensors, actuators, and motors — to the highest
levels, such as Supervisory Control and Data
Acquisition (SCADA), Manufacturing Execution
Systems (MES), and Enterprise Resource Planning(ERP) systems, as well as to the cloud.1

1

TLP: WHITE information may be distributed without restriction

What’s the attribution?
Dragos does not make assessments about
attribution. It is Dragos’s position that what isvaluable to a significant majority of defenders
is understanding the “what and how, not who.”
Additionally, given the unique geopoliticalnature of malicious capabilities and operations
targeting critical national infrastructure, it could
be disruptive to security efforts to focus on
attribution.
What could have the original equipment
manufacturers done differently?
The original equipment manufacturers (OEM)—
Schneider Electric and Omron— were targets but
did not do anything wrong. Each time malware
families target ICS, conversations emerge about theOEM. However, product security is not the samething as ICS security. CHERNOVITE takes advantageof the native functionality available in the industrial
environment and does not rely on vulnerabilities
in the ICS equipment to achieve its operations.
Any focus on the OEMs is misplaced; based on the
Dragos analysis, it is likely that the adversary willdevelop modules against numerous equipmentvendors.

Source: https://www.motioncontroltips.com/what-is-opc-ua-and-how-does-it-compare-with-industrial-ethernet/

D R AG O S , I N C .

19

WHITEPAPER

TLP: WHITE information may be distributed without restriction

A B OU T D R AGO S , I N C .
Dragos has a global mission: to safeguard civilization from those trying to disrupt the industrial
infrastructure we depend on every day. The practitioners who founded Dragos were drawn tothis mission through decades of government and private sector experience.
Dragos codifies the knowledge of our cybersecurity experts into an integrated software
platform that provides customers critical visibility into ICS and OT networks so that threats andvulnerabilities are identified and can be addressed before they become significant events. Our
solutions protect organizations across a range of industries, including power and water utilities,
energy, and manufacturing, and are optimized for emerging applications like the Industrial
Internet of Things (IIoT).
Dragos is privately held and headquartered in the Washington, DC area with regional presencearound the world, including Canada, Australia, New Zealand, Europe, and the Middle East.

TO LE ARN MOREABOUT DR AGOS AND
OUR TECHNOLOG Y,SERVICES , AND THRE AT
INTELLIGENCE FOR
THE INDUSTRIAL
COMMUNIT Y,
PLE A SE VI SIT
www.dragos.com.

T H A N K YO U

D R AG O S , I N C .

Copyright © 2022 Dragos, Inc. All Rights Reserved. Last updated April, 2022

20