Analyzing PIPEDREAM: Challenges in Testing an ICS Attack Toolkit
Dragos principal researcher Jimmy Wylie breaks down PIPEDREAM, a modular industrial attack toolkit developed by state-sponsored actors to disrupt industrial processes.
Summary
The Emergence of PIPEDREAM (Cherovite) Malware
PIPEDREAM represents the seventh known ICS-specific malware platform, designed with modular capabilities to target widespread PLCs and industrial protocols.
Dissecting PIPEDREAM's Modular Architecture
Jimmy Wylie analyzes components targeting CODESYS, Modbus, OPC UA, and Omron PLCs, demonstrating its cross-vendor industrial attack capabilities.
Testing and Validating ICS Malware in Physical Testbeds
Wylie discusses the unique engineering challenges and safety risks of executing destructive industrial malware within physical hardware labs.
Detection Engineering and Threat Hunting in OT Networks
The author provides defensive OT monitoring recommendations, protocol anomaly heuristics, and asset inventory strategies to detect PIPEDREAM activity.
Related talks
Main Stage·22 min
Sharon Brizinov
Sharon Brizinov demonstrates 'Evil PLC' attacks, weaponizing compromised industrial PLCs as offensive footholds to compromise engineering workstations.
S4 Events·30 min
Security researchers examine technical aspects of Critical Infrastructure as Code (CIAC) in ICS.
RSAC Cybersecurity·33 min
Security researchers examine technical aspects of CHERNOVITE and PIPEDREAM: Understanding the Latest Evolution of ICS Malware.