Dragos: Pipedream: Chernovite’s Emerging Malware Targeting Industrial Control Systems

Threats to industrial infrastructure security are an extremely sensitive matter. Given the unique realities of industrial operations it is often harder for defenders to react than for adversaries to leverage public information. The more time the community has to implement mitigations before new malicious capabilities become public, the better the effects of any attempted attacks can be reduced.

Dragos identified and analyzed PIPEDREAM’s capabilities through our normal business, independent research, and collaboration with various partners in early 2022. Our primary focus is informing industrial asset owners and operators with as much information as possible. It is the team’s stance never to be first to communicate detailed technical insights on ICS threats and capabilities until the information is already going

to become public; this is done as the information can often be weaponized and industrial control system (ICS) defenders need as much time as possible. Once information about threats and new capabilities are made public, Dragos’s approach is to follow up with detailed analysis and advice to the security community.

This report was proactively written and readied for release as the information became public through other avenues.