The Trojan Horse Malware & Password “Cracking” Ecosystem Targeting Industrial Operators
Summary: Dragos researchers, during a routine vulnerability assessment, found social media accounts selling password-cracking software for PLCs, HMIs, and project files, and determined the DirectLogic 06 tool did not crack the password but exploited a firmware vulnerability to retrieve it on command. The software was also a malware dropper that infected the host with Sality, a peer-to-peer botnet that uses process injection and file infection for persistence, spreads over USB and network shares, drops a clipboard hijacker that swaps cryptocurrency addresses every half second, and terminates security products.
What you should know: The vulnerability was assigned CVE-2022-2003, and Dragos recreated the serial-only exploit over Ethernet, widening the exposure well beyond the single workstation that ran the download. Sality's blocking of outbound connections to antivirus update sites can violate reliability standard CIP-007-6, turning one engineer's shortcut into a compliance problem.
Read the original at Dragos Blog ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026