MalwareUsed by 1 actorExploits 1 CVE

PIPEDREAM

Also known asINCONTROLLER

PIPEDREAM, also referred to as INCONTROLLER, is a modular industrial control systems (ICS) malware framework discovered in 2022 and described as the seventh known ICS-specific malware and the fifth specifically developed to disrupt industrial processes. The content attributes its development to the CHERNOVITE activity group and characterizes it as a state-sponsored capability intended for disruptive or destructive operations against operational technology environments.

The toolkit is designed for reconnaissance, manipulation, and disruption of PLCs, along with intrusion operations against Windows systems. Reported capabilities include scanning for, compromising, and controlling ICS devices on OT networks; targeting Schneider Electric and Omron PLCs; interacting with OPC UA servers; and leveraging the widely used CODESYS software stack, which expands potential applicability beyond the initially observed vendors. The content states that PIPEDREAM uses industrial protocols including OPC UA and Modbus, and that one component uses Modbus TCP for enumeration. Dragos reported that the toolkit can hijack target devices, deny or disrupt operator access, permanently brick devices, use compromised devices as footholds into other parts of an ICS network, and in some scenarios manipulate industrial processes in ways that could cause disruption, degradation, or possible destruction.

The malware is associated in the content with likely targeting of electric utilities and oil and gas environments, especially liquefied natural gas facilities, though it is also described as adaptable to other sectors including manufacturing and water treatment. Multiple sources in the content state that researchers had high confidence the malware had not yet been deployed for disruptive or destructive physical effects at the time of reporting, making it a rare pre-deployment discovery.

The content also references detailed component names from Dragos reporting: EVILSCHOLAR, BADOMEN, MOUSEHOLE, DUSTTUNNEL, and LAZYCARGO. These are described respectively as capabilities for Schneider Electric/CODESYS PLC interaction, Omron PLC/software interaction, OPC UA server interaction, Windows host reconnaissance and command-and-control, and loading an unsigned driver via a vulnerable ASRock driver. Additional behaviors mentioned include brute forcing passwords, denial-of-service against controllers, severing connections, changing operating modes, backing up/restoring configurations, wiping PLC memory, writing arbitrary OPC UA node attributes, and using PLCs as network proxies across OT environments.

Aliases in the content are PIPEDREAM and INCONTROLLER.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2020-15368Arbitrary kernel access in ASRock RGB Driver AsrDrv103.sys

"LAZYCARGO ... drops and exploits a vulnerable ASRock driver to load an unsigned driver." ... "1https://github.com/stong/CVE-2020-15368"

via cyberscoopcdn.cyberscoop.com

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Chernovite

Differentiation is at the edges, Dragos’s threat intelligence (FrostyGoop, PIPEDREAM, CHERNOVITE write-ups)...

via medium urjasecurjasec.medium.com

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1078Valid AccountsEvidence1

“EVILSCHOLAR Unauthorized Login … MITRE ATT&CK for ICS Technique: T1078 Valid Accounts” and narrative: “...gather credentials to access a legitimate account...”

Execution

2 techniques

T1047Windows Management InstrumentationEvidence1

“PIPEDREAM Interrogate Windows System … MITRE ATT&CK for ICS Technique: T1047 Windows Management Instrumentation”

T1059Command and Scripting InterpreterEvidence1

“PIPEDREAM Execution … MITRE ATT&CK for ICS Technique: T1059 Command and Scripting Interpreter”

Persistence

1 technique

T1078Valid AccountsEvidence1

“EVILSCHOLAR Unauthorized Login … MITRE ATT&CK for ICS Technique: T1078 Valid Accounts” and narrative: “...gather credentials to access a legitimate account...”

Privilege Escalation

2 techniques

T1068Exploitation for Privilege EscalationEvidence2

...it does so by exploiting underlying software in those PLCs known as Codesys, which is used far more broadly across hundreds of other types of PLCs.

T1078Valid AccountsEvidence1

“EVILSCHOLAR Unauthorized Login … MITRE ATT&CK for ICS Technique: T1078 Valid Accounts” and narrative: “...gather credentials to access a legitimate account...”

Stealth

1 technique

T1078Valid AccountsEvidence1

“EVILSCHOLAR Unauthorized Login … MITRE ATT&CK for ICS Technique: T1078 Valid Accounts” and narrative: “...gather credentials to access a legitimate account...”

Credential Access

2 techniques

T1110Brute ForceEvidence1

“EVILSCHOLAR Password Brute Force Attempt … MITRE ATT&CK for ICS Technique: T1110 Brute Force” and “MOUSEHOLE … brute forcing credentials.”

T1552.001Credentials In FilesEvidence1

“BADOMEN Telnet Login Bypass … T1552.001 Unsecured Credentials: Credentials in Files” and “BADOMEN HTTP Login Bypass … T1552.001”

Discovery

1 technique

T1046Network Service DiscoveryEvidence2

the advisory warns that threat actors have developed a custom toolkit that enables them to scan for, compromise and control ICS devices once they’re connected to the operational technology (OT) network.

Lateral Movement

1 technique

T1021Remote ServicesEvidence1

“BADOMEN Activate Telnet … MITRE ATT&CK for ICS Technique: T1021 Remote Services”

Command and Control

1 technique

T1573Encrypted ChannelEvidence1

“BADOMEN HTTP Encrypted Post … MITRE ATT&CK for ICS Technique: T1573 Encrypted Channel”

Impact

1 technique

T1485Data DestructionEvidence1

Another water utility serving 2 million people in North Texas said Tuesday that it is also dealing with a cybersecurity incident that caused operational issues...

ACTIVITY FEED

Recent activity

14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

14 SOURCESView more in app

medium urjasecNews

Jun 20, 2026

OT Network Monitoring: The Baseline, the Alert, and the Human | by urjasec | Jun, 2026 | Medium

Named ICS malware/tooling referenced in OT threat intelligence coverage.

industrialcyberNews

Jul 23, 2025

Zetter details how Stuxnet marked a turning point in cyberwarfare by enabling physical sabotage through code - Industrial Cyber

Modular ICS attack platform (reported discovered in 2022) assessed as capable of disrupting or destroying OT operations, including disabling/bricking control systems and potentially undermining safety systems; described as adaptable to multiple industrial environments with initial focus on electric and oil & gas/LNG.

dragos blogNews

Dec 11, 2023

ELECTRUM Targeted Ukrainian Electric Entity Using Custom Tools and CaddyWiper Malware, October 2022 | Dragos

ICS-specific malware framework/tooling referenced as implementing industrial protocols (OPC-UA and Modbus), highlighting OT-native protocol abuse in ICS attacks.

the record mediaNews

Nov 29, 2023

CISA warns of attacks on Unitronics tool used by water utilities, wastewater systems | The Record from Recorded Future News

ICS-focused malware referenced as illustrating that threat actors can target operational technology and potentially cause physical-world disruption or damage.

+9 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.