Measuring the Potential Impact of PIPEDREAM Malware OPC UA Module, MOUSEHOLE
Summary: Dragos ran runtime testing of MOUSELAB, an automated version of PIPEDREAM's OPC UA module MOUSEHOLE, against a mock water pipeline on its cyber range, closing a solenoid valve, raising flow to 100%, and lifting the high-pressure set point from 15 PSI to 100 PSI to drive pressure to unsafe conditions. Dragos assesses with high confidence that MOUSEHOLE, the seventh known ICS-specific malware from the CHERNOVITE threat group, already contains all the functionality required to disrupt industrial processes, and cites a CISPA Helmholtz Center and Saarland University scan finding 92% of OPC UA deployments had security configuration issues, with 44% accessible without authentication.
Why it matters: The tested attack worked by exploiting a server set to security mode "none" and anonymous login - the same default configuration the CISPA scan found on 44% of internet-facing OPC UA servers, meaning the barrier to a CHERNOVITE-style operation may be reconnaissance, not exploit development.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026