Pipedream is a software framework for malicious code targeting programmable logic controllers (PLCs) and industrial control systems (ICS).[1] First publicly disclosed in 2022, it has been described as a "Swiss Army knife" for hacking.[1] It is believed to have been developed by state-level Advanced Persistent Threat actors.[1]
The name "Pipedream" was given by the cybersecurity company Dragos;[2] the cybersecurity company Mandiant uses the name "Incontroller".[3][4] It has been compared with the Industroyer toolkit used in the December 2015 Ukraine power grid cyberattack.[3] Dragos refers to the authors of the software as Chernovite.[5]
The toolkit consists of custom-made tools that, once they have established initial access in an operational technology (OT) network, enables them to scan for, compromise, and control certain ICS/SCADA devices, including the following:[6]
The toolkit has a modular architecture and enables cyber actors to conduct highly automated exploits against targeted devices. The tools have a virtual console with a command interface that mirrors the interface of the targeted ICS/SCADA device. Modules interact with targeted devices, enabling operations by lower-skilled cyber actors to emulate higher-skilled actor capabilities.[6]
APT actors can leverage the modules to scan for targeted devices, conduct reconnaissance on device details, upload malicious configuration/code to the targeted device, back up or restore device contents, and modify device parameters.[6]
In addition, the APT actors can use a tool that installs and exploits a known-vulnerable ASRock-signed motherboard driver, AsrDrv103.sys, exploiting CVE-2020-15368 to execute malicious code in the Windows kernel. Successful deployment of this tool can allow APT actors to move laterally within an IT or OT environment and disrupt critical devices or functions.[6]