CISA, DOE, NSA and the FBI jointly warned in April 2022, with a revision in May 2022, that advanced threat actors had built custom tools for industrial control systems. They target Schneider Electric and OMRON PLCs and OPC UA servers and can change device parameters, crash controllers or upload malicious code.
Who and what was targeted
The advisory covers Schneider Electric PLCs, OMRON Sysmac PLCs and OPC UA servers. The actors can also compromise Windows engineering workstations by exploiting a vulnerable ASRock motherboard driver, tracked as CVE-2020-15368. The actors are not named in the page we reviewed.
The advisory describes tools used after the actors have already reached the operational technology network, so the first line of defence is keeping them out of it.
Capabilities
The tools can scan for devices, brute force passwords, run denial of service attacks, sever connections to capture credentials, crash PLCs, upload malicious code, back up or restore device contents, and modify device parameters.
Several of those are physical in effect. A changed parameter or crashed controller can stop a line or alter how equipment behaves. The risk is in the same family as Stuxnet, though the advisory itself does not make that comparison. The difference is that these tools are described as reusable, so the same techniques can be pointed at many sites.
Defences listed
- Enforce multi factor authentication on all remote access to control networks wherever possible.
- Change ICS and SCADA passwords on a schedule and replace defaults with unique, strong ones.
- Deploy continuous OT monitoring that logs and alerts on malicious indicators.
- Isolate ICS and SCADA networks from corporate and internet networks and restrict traffic across perimeters.
- Configure OPC UA security with application authentication and explicit trust lists, and store keys and passwords securely.
- Keep offline backups of firmware and controller configurations, and check integrity with hashes.
- Limit ICS and SCADA connections to approved management and engineering workstations.
- Monitor for unusual driver loads, especially ASRock drivers on systems that do not normally use them.
- Apply least privilege.
- Maintain and regularly exercise an incident response plan.
Turning it into a plan
Start with the backups and the inventory: you cannot restore a PLC to a known good state without a known good copy, and you cannot protect devices you have not listed. Then reduce who can reach controllers, then add monitoring. Test the incident plan with a tabletop that includes a plant shutdown decision.
Software you build
If you ship firmware or engineering tools, the same advice applies to your own supply chain. Inventory components and watch for new flaws. Safeguard supports dependency scanning and SBOMs for that, but it does not defend plant networks.
Quick check
Does the advisory name who made the tools?
The page reviewed refers to unnamed advanced persistent threat actors.
What is the single most repeated control?
Isolation and controlled remote access with multi factor authentication feature prominently, along with monitoring and backups.
Sources
Last reviewed: 19 October 2026.
