Deep Dive Into PIPEDREAM’s OPC UA Module, MOUSEHOLE
Summary: Dragos released further analysis and runtime testing results on MOUSEHOLE, the OPC UA client module within PIPEDREAM, the seventh known ICS-specific malware, developed by the CHERNOVITE threat group and first covered by Dragos in an April 2022 whitepaper and webinar. MOUSEHOLE is a Python program built on the deprecated open-source python-opcua library that can connect, authenticate, and read or write node values on a poorly secured OPC UA server in about six lines of code, allowing an adversary to modify a node's value attribute and potentially cause Loss of Control to connected control systems.
What's compelling: Dragos states that MOUSEHOLE is not a sophisticated tool and that dozens of other open-source industrial protocol libraries, including PyModbus, could be abused the same way, lowering the expertise needed to affect physical operations. The exposure sits with OPC UA servers left on weak settings such as anonymous authentication, which Dragos attributes to vendor implementation rather than the protocol itself.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026