CHERNOVITE developer of PIPEDREAM: first ever cross-industry disruptive/destructive ICS/OT capability

CHERNOVITE is the developer of PIPEDREAM, a modular ICS attack framework and the seventh known ICS-specific malware, following STUXNET, HAVEX, BLACKENERGY2, CRASHOVERRIDE, TRISIS, and Industroyer2. CHERNOVITE’s PIPEDREAM is the first ever cross-industry disruptive/destructive ICS/ OT capability. It represents a substantial escalation in adversarial capabilities.

CHERNOVITE possesses a breadth of ICS-specific knowledge beyond what has been demonstrated by previously discovered threat groups. The ICS expertise demonstrated in the PIPEDREAM malware includes capabilities to disrupt, degrade, and potentially destroy physical processes in industrial environments. PIPEDREAM is the first scalable, cross-industry ICS attack framework known to date.

While PIPEDREAM itself is a new ICS capability, its emergence is also indicative of the trend toward more technically capable and adaptable adversaries targeting ICS/OT. In addition to implementing common ICS/ OT-specific protocols in PIPEDREAM, CHERNOVITE improved the techniques from prior ICS malware. CRASHOVERRIDE, and the associated threat group, ELECTRUM, exploited the OPC Data Access (OPC DA) protocol to manipulate breakers and electrical switchgear. CHERNOVITE, on the other hand, uses the newer but comparable OPC UA protocol. Dragos assesses with high confidence that a state actor developed PIPEDREAM intending to leverage it in future operations for disruptive or destructive purposes.

Dragos assesses with moderate confidence that CHERNOVITE represents an “effects/impact team” instead of an “access team” — meaning, that PIPEDREAM was designed to be leveraged for impact after the initial access into the target environment has been obtained by another threat group.

Most likely, CHERNOVITE developed PIPEDREAM’s capabilities for a malicious operator with the intent and motivation to access, manipulate, and disrupt OT environments and processes. PIPEDREAM’s capabilities can provide an adversary with a range of options for learning about a target’s OT network architecture and identifying its assets and processes. This information can set the stage for disruptive and destructive effects, but it also increases an adversary’s knowledge to develop even more capabilities to disrupt or destroy on a much broader scale.

In its present form, the PIPEDREAM attack framework could be leveraged to target equipment in multiple sectors and industries. Given PIPEDREAM’s modular nature, CHERNOVITE could easily adapt it to compromise and disrupt a broader set of targets.