Trusted Design

Sandworm to Blacken: The SCADA Connection

概要

On October 14th, a report was publicly released regarding the Sandworm team. After beginning an investigation into the affiliated malware samples and domains, we quickly came to realization that this group is very likely targeting SCADA-centric victims who are using GE Intelligent Platform’s CIMPLICITY HMI solution suite. We have observed this team utilizing .cim and .bcl files as attack vectors, both of which file types are used by the CIMPLICITY software. As further proof of the malware targeting CIMPILICITY, it drops files into the CIMPLICITY installation directory using the %CIMPATH% environment variable on the victim machines.

Created: 2026-02-23

Indicators

• FileHash-MD5 - 330e8d23ab82e8a0ca6d166755408eb1 -
• URL - http://94.185.85.122/newsfeed.xml -
• FileHash-MD5 - c931be9cd2c0bd896ebe98c9304fea9e -
• FileHash-MD5 - 8313034e9ab391df83f6a4f242ec5f8d -
• FileHash-MD5 - bdc7fafc26bee0e5e75b521a89b2746d -
• FileHash-MD5 - 2f6582797bbc34e4df47ac25e363571d -
• email - oleh.tiahnybok@vosvoboda.info -
• FileHash-MD5 - 8a7c30a7a105bd62ee71214d268865e3 -
• FileHash-MD5 - 59e41a4cdf2a7d37ac343d0293c616b7 -
• CVE - CVE-2014-4113 -

類似Pulses

• Sandworm Team Leverage CVE-2014-4114 Zero-Day (score: 0.66)
• Connecting the Dots: Syrian Malware Team Uses BlackWorm for Attacks (2014) (score: 0.60)
• Aggressive Malware Pushers: Prolific Cyber Surfers Beware (score: 0.58)
• Gamarue/Andromeda Comeback (score: 0.57)
• New ICS Attack Framework “TRITON” targeting Critical Infrastructure - Mjolnir Security (score: 0.56)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る