Volume 2Oil and Gas edition2022Last verified 10 sources, 8 primaryToolkit; no recorded use
In April 2022 four US agencies published a working toolkit for seizing Schneider and Omron controllers. They named no country, no victim and no source. Nobody has shown it was ever used.
Pipedream is an entry with no incident in it: no victim, site, outage or intrusion on the record. There is a toolkit that finds Schneider and Omron controllers and OPC UA servers, guesses passwords, rewrites programs and crashes devices. Its interest is what the record declines to say. Four US agencies named no country. Mandiant called its own Russia link largely circumstantial. Nobody has said where the tools came from, and the one vendor saying they were caught before use rated that high confidence in April 2022, low ten months later.
No bug is involved. Schneider says the framework abuses legitimate functionality: the controllers obey anyone who can reach them and speak their protocol, and no patch removes that. Only two things do: taking away the path, and refusing commands from all but the named engineering station in a scheduled window. That is BlastWave’s analysis, not a disclosed fact, and holds whether or not these tools were used.
What is not known: Where the tools came from has never been disclosed by the agencies, Mandiant or Dragos, whose CEO would not say how they were found. No government has attributed them to any country. No victim, site or intrusion is on the record; there is no vector, effect or cost to report. Whether they were ever used is a vendor judgement: Dragos said high confidence they had not been employed for disruptive or destructive effects in April 2022, low confidence in February 2023. The advisory is silent.
Recommendation
Take the path away No business-network host or general workstation should reach a controller’s programming ports: Modbus, Codesys, Omron FINS. A kit needing a route to the PLC fails there.
Remove standing programmability Program downloads and register writes only in a scheduled, logged window from one named engineering station, passwords set. OPC UA refuses anonymous, unsigned sessions.
Make read-only consumers read one way Historians, dashboards and OPC UA clients that only need values receive them one way, so the systems that can write to a controller are only those that must.
Sources: AA22-103A, DOE/CISA/NSA/FBI, 13 Apr 2022; Mandiant, INCONTROLLER, 13 Apr 2022; Dragos, PIPEDREAM, Apr 2022, and Year in Review, Feb 2023; Schneider Electric notification, Apr 2022; AP, 13 Apr 2022. Full list with links.
Soft Spots: “Caught before deployment” is Dragos’s assertion alone, basis undisclosed, its confidence low by February 2023. That path and permission removal defeat the kit is BlastWave’s analysis. Schneider and AP are read via republication.
The full record
Every claim numbered to its source. Last updated .
A working toolkit for seizing industrial controllers, published by four US agencies with no country, no victim and no source attached. This is a toolkit disclosure, not a known attack. What is verified, what is only a vendor's assessment, and what is still unknown.
Summary
Pipedream (Incontroller) is a toolkit disclosure, not a known attack. On 13 April 2022, four US agencies published tools to seize Schneider and Omron controllers and OPC UA servers, naming no country, victim or source. No use is recorded. Dragos, which says it was caught before use, rated its confidence high in April 2022 and low by February 2023.1,2,3,7
Timeline of the Pipedream disclosure
Every date is tied to a source. Press reporting appears only as evidence of what was said.
Mandiant, in partnership with Schneider Electric, analyzes the tools. Dragos says it identified them through "normal business, independent research, and collaboration with various partners." Neither says where the tools were found.1,2
Industroyer2 is disclosed, the day before this advisory. It is a separate case.8
The Department of Energy, CISA, the NSA and the FBI publish joint advisory AA22-103A, "APT Cyber Tools Targeting ICS/SCADA Devices." It names no country, no victim and no source. Mandiant publishes its INCONTROLLER analysis the same day, and Dragos its PIPEDREAM whitepaper in April.1,2,3
The Associated Press reports that CISA "declined to identify the threat actor" and that Dragos's Robert M. Lee would not explain how the malware was discovered.5
The advisory is updated with a list of resources. SecurityWeek runs a headline leading with "Russia-Linked" over a body that quotes Mandiant's "largely circumstantial" sentence.3,9
Schneider Electric's security notification says the framework "does not exploit any vulnerability" and that Schneider is not aware of any confirmed or potential targets. It was republished on 25 April 2022.6
Dragos's Year in Review assesses with low confidence that no adversary has employed components of PIPEDREAM for disruptive or destructive effects. In April 2022 that judgment had been high confidence.2,7
Lee tells the Senate Energy and Natural Resources Committee that Dragos was contacted by an undisclosed third party and reported the tools "prior to PIPEDREAM being employed."4
Key facts and their status
Verified sworn, filed or published by the primary party. Reported rests on press, researchers or unnamed sources. Undisclosed no one has stated it.
Question
What the record says
Status
Who published the toolkit?
DOE, CISA, NSA and FBI, jointly, in advisory AA22-103A on 13 April 20223
Verified
What devices does it address?
Schneider Electric Modicon PLCs, Omron Sysmac NJ and NX PLCs and servo drives, OPC UA servers, and Windows hosts through an ASRock driver1,3
Verified
Does it exploit a flaw in the controllers?
No. Schneider: it "does not exploit any vulnerability." The one CVE is in a Windows motherboard driver3,6
Verified (via republication)
Did the US government name a country?
No. The advisory names none; CISA "declined to identify the threat actor"3,5
Verified
Who built it?
Not disclosed. Dragos: a state-sponsored developer, high confidence, no state named. Mandiant: Russia link "largely circumstantial"1,2
Researcher assessment
Where were the tools found?
Never disclosed. Lee: an "undisclosed third party" contacted Dragos4
Undisclosed
Was it ever used?
Not shown. Dragos: not yet employed for disruptive or destructive effects, high confidence (April 2022), low (February 2023). Mandiant: targeting "unclear"1,2,7
LNG and electric power, per Dragos's assessment; not a finding of intrusion2
Researcher assessment
Initial access vector?
None on the record. The tools presuppose access already gained3
None on the record
What is Pipedream, or Incontroller?
It is a modular toolkit for finding, logging into, rewriting and crashing industrial controllers, published by four US agencies on 13 April 2022 with no incident attached. The joint advisory says certain advanced persistent threat actors "have exhibited the capability to gain full system access" to multiple industrial devices, and that the tools let them scan for, compromise and control those devices "once they have established initial access."3
Dragos calls the toolkit PIPEDREAM and Mandiant calls it INCONTROLLER. Mandiant names three components; Dragos splits the kit into five with different names. No public crosswalk between the two sets was found as of late September 2026, so this page does not equate any Mandiant name with any Dragos name.1,2
CODECALL (Mandiant): talks Modbus and Codesys to Schneider Electric controllers. Mandiant lists reading and writing device registers, brute forcing passwords, moving files and crashing the device.1
EVILSCHOLAR, BADOMEN, MOUSEHOLE, DUSTTUNNEL, LAZYCARGO (Dragos): the same kit, divided differently.2
A Windows kernel tool: installs a known vulnerable ASRock motherboard driver (AsrDrv103.sys, CVE-2020-15368) to run code in the Windows kernel.1,3
The advisory describes a crafted "packet of death" that leaves a controller down until a power cycle and a configuration recovery.3 Its device lists are introduced as "including (but may not be limited to)" the models named. Mandiant's own list names the M251, M221 Nano and M258; the two lists differ and this page prints both rather than merging them.1,3 Mandiant called the tools "exceptionally rare and dangerous" and compared them with Triton, Industroyer and Stuxnet; Dragos counted it the "seventh-known" ICS-specific malware.1,2
Did the US government say Russia built Pipedream?
No. Four agencies published the advisory and named no country. The only place the words "state-sponsored" appear in it is the title of Mandiant's blog, in the list of resources at the bottom.3 The Associated Press reported that CISA "declined to identify the threat actor."5
Neither vendor that analyzed the tools named a state on evidence. Dragos assessed with high confidence that a state-sponsored adversary developed the kit, and tracks that developer as CHERNOVITE, an activity-group name rather than a national label.2 It says, in its own words:
"Dragos does not make assessments about attribution."
Its CHERNOVITE page adds that "Dragos does not corroborate nor conduct political attribution."10 Mandiant said the tools were "very likely" state sponsored and raised Russia, in a sentence that has to be read whole:1
"While our evidence connecting INCONTROLLER to Russia is largely circumstantial, we note it given Russia's history of destructive cyber attacks, its current invasion of Ukraine, and related threats against Europe and North America."
That is a vendor's hedge, printed by the vendor that made it. It is not a government attribution. A trade headline the next day led with "Russia-Linked" while its body carried Mandiant's qualifier.9
Was Pipedream ever used against a victim?
No use has been shown, and the claim that it was caught before use is one vendor's assessment, not a finding anyone else has made. The joint advisory says nothing either way.3 Mandiant wrote that "the targeting of any operational environments using this toolset is unclear."1 Schneider Electric said:
"While we are not aware, at the date of this publication, of any confirmed or potential targets leveraging Incontroller, the framework poses a critical risk to organizations using the targeted devices."
Dragos is the party that says the tools were found before use, and it has kept saying so. Its April 2022 whitepaper assessed with high confidence that Pipedream "has not yet been employed for disruptive or destructive effects."2 Its CHERNOVITE page says the toolkit "has not yet been deployed in the wild."10 Lee told the Associated Press it was caught before an attack was attempted, and would not explain how it was found:5
"None of us want them to understand where they screwed up."
That is a legitimate reason, and it also means the claim cannot be checked. Ten months later, Dragos's Year in Review recorded a lower confidence on the same question:7
"Dragos assesses with low confidence that no adversary has employed or leveraged components of PIPEDREAM against industrial networks for disruptive or destructive effects."
The same page describes accessing and analyzing the capability "before its employment," and in March 2023 Lee told the Senate Dragos reported it "prior to PIPEDREAM being employed."4,7 The change from high to low confidence is two documents, not a retraction; Dragos has not explained it. Dragos assessed LNG and electric power as likely targets, which is a judgment about intent, not a record of intrusion.2
On Hackopedia's consequence ladder, Pipedream sits on the bottom rung: capability with no deployment. Industroyer2, disclosed the day before, sits higher, on OT-adjacent access and capability development: deployed and scheduled, with no corroborated physical effect.8
Where did the Pipedream tools come from?
No party has said. Not the four agencies, not Mandiant and not Dragos. Mandiant wrote that in early 2022 it analyzed the tools in partnership with Schneider Electric; it does not say where they came from.1 Dragos describes identifying them in early 2022 through "normal business, independent research, and collaboration with various partners."2
The furthest any party has gone is Lee's Senate testimony of 23 March 2023, which said Dragos was "contacted by an undisclosed third party that had identified a new collection of malware" and worked "with its undisclosed partner."4 Where that third party found the malware is still unsaid. Lee had already told the Associated Press he would not explain how the malware was discovered.5 The silence is deliberate and stated, and this page prints it rather than filling it.
Does Pipedream exploit a vulnerability in Schneider or Omron PLCs?
No. It abuses functions the controllers are supposed to have. Schneider Electric's notification says the framework "does not exploit any vulnerability" and:6
"abuses legitimate functionality to achieve its goals."
The single CVE in the kit, CVE-2020-15368, is in an ASRock motherboard driver on Windows hosts, not in any PLC.1,3 Everything else works through the controllers' own protocols, so there is no controller patch that removes the capability.
This also narrows a claim discussed in the FrostyGoop entry: CODECALL was already reading and writing Modbus registers in 2022, so any "first" claimed for later Modbus-capable malware holds only in narrower wording.1
What is still not known about Pipedream
Where and how the tools were obtained, and where the undisclosed third party that contacted Dragos found them.4
How Dragos discovered the toolkit, and the basis for its assessment that the tools were found before use. Lee declined to explain.5
Who built the tools. No government has attributed them to any country; the vendor assessments name no state on evidence.1,2,3
Whether the tools were ever used. Dragos's confidence that they had not been employed for disruptive or destructive effects was low as of February 2023, and it has not explained the change.7
Any victim, site or intrusion. None is on the record, so there is no access vector, effect or cost to report.
Whether the published device lists are complete. The advisory says the affected models include "(but may not be limited to)" those named.3
How Mandiant's three component names map to Dragos's five. No public crosswalk was found as of late September 2026.
Claims about Pipedream the record does not support
Widely repeated claim
What the record says
"Pipedream is Russia-linked."
The only Russia link is Mandiant's, stated with its own qualifier. Dragos makes no assessments about attribution. The article's body quotes Mandiant's reasoning; the headline drops the hedge.1,2,9
"Pipedream was caught before it was ever deployed."
That is Dragos's assessment, with its basis undisclosed. Its confidence that the tools had not been employed for disruptive or destructive effects was high in April 2022 and low in February 2023. Mandiant called the targeting "unclear"; the advisory says nothing either way.1,2,3,7
BlastWave analysis: no bug required
Analysis, not a disclosed fact
What makes Pipedream worth a page is what the record declines to say: no country, no victim, no source, and no sentence saying the tools were never used. Every one of those gaps has since been filled by someone other than the agencies. The more useful reading is the one Schneider's notice supplies: the framework abuses legitimate functionality. The controllers do what they were built to do, for anyone who can reach them and speak their protocol, and a patch cannot remove that.6
Only two things can: taking away the path, and refusing commands from anything that is not the named engineering station in a scheduled window. That reading is BlastWave's analysis, not a disclosed fact, and it holds whether or not these particular tools were ever pointed at a plant.
Podcast: “The Universal Remote” (9:00). Joe Baxter and Cam Cullen on why a toolkit that needs no bug is an argument about paths and permissions, whether or not it was ever used.
Video: Pipedream Short (60 to 90 seconds).
Frequently asked questions
What is Pipedream (Incontroller)?
Pipedream, which Mandiant calls Incontroller, is a toolkit for taking control of industrial controllers, disclosed on 13 April 2022 in a joint advisory from the Department of Energy, CISA, the NSA and the FBI. It targets Schneider Electric and Omron controllers and OPC UA servers. It is a toolkit disclosure, not a known attack: no victim, site or intrusion is on the public record.
Was Pipedream used in a cyberattack?
No use has been shown. The joint advisory of April 2022 says nothing either way, Mandiant called the targeting of any operational environment unclear, and Schneider Electric said it was not aware of any confirmed or potential targets. Dragos says the tools were found before use, but its confidence that they had not been employed for disruptive or destructive effects was high in April 2022 and low by February 2023.
Did the US government say Russia was behind Pipedream?
No. The joint advisory published by the Department of Energy, CISA, the NSA and the FBI on 13 April 2022 named no country, and the Associated Press reported that CISA declined to identify the threat actor. Mandiant raised Russia but said its own evidence was largely circumstantial. Dragos says it does not make assessments about attribution.
Where was Pipedream found?
No party has said. In Senate testimony in March 2023, Dragos chief executive Robert M. Lee said Dragos was contacted by an undisclosed third party that had identified a new collection of malware. Where that party found it has never been disclosed. Lee told the Associated Press in April 2022 that he would not explain how the malware was discovered.
Does Pipedream exploit a vulnerability in Schneider or Omron PLCs?
No. Schneider Electric said in April 2022 that the framework does not exploit any vulnerability and instead abuses legitimate functionality. The only CVE associated with the kit, CVE-2020-15368, is in an ASRock motherboard driver on Windows hosts, not in any controller. That is why patching the controllers does not remove the capability.
Which devices can Pipedream target?
The April 2022 joint advisory lists Schneider Electric controllers including the TM251, TM241, M258, M238, LMC058 and LMC078, Omron devices including the NX1P2, NJ501-1300 and R88D-1SN10F-ECT, and OPC UA servers, and says the list may not be complete. Mandiant also named the Modicon M221 Nano. A separate tool attacks Windows hosts through a vulnerable ASRock driver.
Who is CHERNOVITE?
CHERNOVITE is the name Dragos uses for the activity group it says developed Pipedream. Dragos assessed with high confidence in April 2022 that a state-sponsored adversary built the toolkit, but it states that it does not make assessments about attribution, so CHERNOVITE is not a national label. No government has named a country behind the tools.
There is no victim statement, filing or incident report, because there is no known incident. The primary record is the joint US advisory, the responders' own publications (Mandiant, Dragos, Schneider Electric) and sworn testimony. Schneider's notice and the AP story are cited as republished. Press is cited only as evidence of what was said.
ResearcherMandiant (Brubaker, Lunden, Proska, Umair, Kapellmann Zafra, Hildebrandt, Caldwell), "INCONTROLLER: New State-Sponsored Cyber Attack Tools Target Multiple Industrial Control Systems," 13 April 2022. cloud.google.com
ResearcherDragos, "PIPEDREAM: CHERNOVITE's Emerging Malware Targeting Industrial Control Systems," whitepaper, April 2022. PDF
FederalUS Department of Energy, CISA, NSA and FBI, Joint Cybersecurity Advisory AA22-103A, "APT Cyber Tools Targeting ICS/SCADA Devices," 13 April 2022; resources added 14 April 2022; mitigations added 25 May 2022. cisa.gov · Joint advisory (PDF)
Sworn testimonyRobert M. Lee, Chief Executive Officer, Dragos, written testimony, Senate Committee on Energy and Natural Resources, 23 March 2023. energy.senate.gov
PressAssociated Press, "US agencies: Industrial control system malware discovered," 13 to 14 April 2022, as republished by TechXplore. Cited as evidence of what was said. techxplore.com
CompanySchneider Electric, security notification on the APT cyber tools (Incontroller/Pipedream), April 2022, as republished by M2 Communications on MarketScreener, 25 April 2022, "Schneider Electric says no evidence that Incontroller/Pipedream malware exploits vulnerabilities."
ResearcherDragos, "ICS/OT Cybersecurity Year in Review 2022," February 2023, p. 12. hub.dragos.com
ResearcherESET, "Industroyer2: Industroyer reloaded," 12 April 2022 (published with CERT-UA). Cited for the disclosure date of Industroyer2. welivesecurity.com
PressEduard Kovacs, SecurityWeek, 14 April 2022. Cited as evidence of what was said: the headline leads with "Russia-Linked"; the body quotes Mandiant. securityweek.com
ResearcherDragos, CHERNOVITE threat group page, dragos.com (undated).
Cite this page
BlastWave. “Pipedream (Incontroller) ICS Malware Toolkit Disclosure (2022): What Is Verified.” Hackopedia, Volume 2, FILE 042. Last verified 28 September 2026. https://hackopedia.blastwave.com/oil-and-gas/pipedream-2022/
Revision history
Date
Change
6 Oct 2026
Numbered FILE 042 in Hackopedia Volume 2, in the Oil and Gas edition.
28 Sep 2026
Hand-check: Schneider Electric's statement that it was "not aware ... of any confirmed or potential targets" confirmed verbatim in the published republication of its notice. Final consistency check against the Industroyer2, FrostyGoop and Triton entries.
26 Sep 2026
Full validation against the joint advisory, Mandiant's analysis, both Dragos reports, the Dragos group page, Lee's Senate testimony and the AP story. Corrected: a Year in Review quotation ("before its employment"); the account of where the tools came from now includes Lee's Senate statement that an undisclosed third party contacted Dragos; and the comparison with Industroyer2 now places the two cases on their correct rungs of the consequence ladder.
24 Sep 2026
Entry built from primary sources. There is no Volume 1 entry for Pipedream.
How Hackopedia verifies an entry
Every figure, date and quotation traces to a court record, sworn testimony, a government or regulator document, the operator's own dated statements, a named researcher's published work, or a dated publication named as such. Where the record says less than the headlines, we print what the record says and mark the rest as reported or undisclosed. Pages are re-verified when new filings, rulings or official statements appear, and every change is logged. Why Hackopedia exists · How to read an entry
