Alert AA22-103A, a joint cybersecurity advisory, was recently released by the United States Department of Energy (DOE), the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA) and the Federal Bureau of Investigation (FBI) detailing the targeting of various industrial control systems (ICS) and supervisory control and data acquisition (SCADA) devices by advanced persistent threat (APT) groups. The advisory specifically mentioned the targeting of Schneider Electric MODICON and MODICON Nano programmable logic controllers (PLCs), OMRON Sysmac NJ and NX PLCs, and Open Platform Communications Unified Architecture (OPC UA) systems. The APT groups have developed custom-made malware tools that have a modular architecture that enables highly automated exploits, and a command-line interface that mirrors the interface of the targeted device. According to the joint advisory, when the modules are present in the custom tools, APT groups are able to “scan for targeted devices, conduct reconnaissance on device details, upload malicious configuration/code to the targeted device, back up or restore device contents, and modify device parameters.” The joint advisory did not detail the specific malware tools that were observed, but cybersecurity firm Dragos recently published information about the “PIPEDREAM” toolset, which is the seventh ICS-specific malware identified as of April 15, 2022. PIPEDREAM was observed in January of 2022 and developed by the CHERNOVITE Activity Group (AG). Dragos researchers detailed that this toolset “can currently identify and target PLCs from Omron and Schneider Electric, however the tooling may be used to target and attack controllers from hundreds of additional vendors.” It is suspected that PIPEDREAM has not yet been utilized for destructive attacks, but that the group responsible has the intention of leveraging the malware toolset in the future. CTIX analysts will continue to monitor the targeting of ICS and SCADA devices as well as monitor for additional custom-made, malicious toolsets to emerge in the wild.