MITRE ATT&CKsoftware (malware)

S1045 INCONTROLLER

Published 2022-09-28 Modified 2026-05-12 Official page ↗
Domain
ics
Platforms
Engineering Workstation, Field Controller/RTU/PLC/IED, Safety Instrumented System/Protection Relay, Windows
Aliases
PIPEDREAM
Version
1.1
Created
2022-09-28

Description

INCONTROLLER is custom malware that includes multiple modules tailored towards ICS devices and technologies, including Schneider Electric and Omron PLCs as well as OPC UA, Modbus, and CODESYS protocols. INCONTROLLER has the ability to discover specific devices, download logic on the devices, and exploit platform-specific vulnerabilities. As of September 2022, some security researchers assessed INCONTROLLER was developed by CHERNOVITE.

Related

Uses · MITRE ATT&CK (20)

  • T0843.001 Download All sub-technique
  • T0846.001 Port Scan sub-technique
  • T0846.003 Multicast Discovery sub-technique
  • T1692.001 Command Message sub-technique
  • T1694.002 Hardcoded Credentials sub-technique
  • T0888 Remote System Information Discovery technique
  • T0890 Exploitation for Privilege Escalation technique
  • T0886 Remote Services technique
  • T0809 Data Destruction technique
  • T0836 Modify Parameter technique
  • T0842 Network Sniffing technique
  • T0843 Program Download technique
  • T0845 Program Upload technique
  • T0846 Remote System Discovery technique
  • T0858 Change Operating Mode technique
  • T0859 Valid Accounts technique
  • T0861 Point & Tag Identification technique
  • T0867 Lateral Tool Transfer technique
  • T0869 Standard Application Layer Protocol technique
  • T0884 Connection Proxy technique

References