PIPEDREAM / INCONTROLLER Lab
In April 2022, CISA Alert AA22-103A disclosed a modular, state-grade attack framework for industrial control systems — PIPEDREAM to Dragos (the CHERNOVITE group), INCONTROLLER to Mandiant. It was found before it was ever used. This lab turns its published components into a defender triage: for each module, decide which asset it reaches — a Schneider PLC, an OMRON Sysmac PLC, an OPC UA server, or the Windows host — which protocol it abuses, and the control that stops it. The scoring enforces the real lesson: a modular, protocol-specific toolkit has to be met with a modular, protocol-specific defence.
The real job. More noise, a tighter clock.
Module 1 / 8
Scans for, enumerates and interacts with Schneider Electric PLCs — including brute-forcing a device password and issuing commands that can crash or stop the controller.
Published capability (CISA AA22-103A · Dragos · Mandiant). Defender view only.
1 · Which asset does this module reach?
2 · Which protocol does it abuse?
3 · The right mitigation / detection
Pick the asset, the protocol and a mitigation to continue.
Targeted device map
This module targets Schneider PLC. Pick where it lands and how.
Triage
PIPEDREAM / INCONTROLLER is a modular ICS attack framework identified before it was ever deployed. For each of 8 modules, name the asset it reaches, the protocol it abuses, and the control that stops it.
So far: 0 / 8 modules triaged.
Live arena
4 activeadversary staging…
What this lab is
- A free, browser-based triage lab built on CISA Alert AA22-103A and the public analyses of PIPEDREAM (Dragos / CHERNOVITE) and INCONTROLLER (Mandiant) — the modular, state-grade ICS attack toolkit found in 2022.
- The toolkit was identified before it was ever deployed. For each of its modules you decide which asset it reaches, which protocol it abuses, and the right mitigation or detection.
- Targets are the real ones named publicly: Schneider Electric PLCs (Modbus / UMAS and CODESYS), OMRON Sysmac NEX PLCs (FINS), OPC UA servers, and the Windows engineering host itself.
- The lesson the scoring enforces: the framework is modular and protocol-specific, so the defence must be too — a Schneider password does nothing for an OMRON path or a compromised host.
- Scored on correct asset-and-mitigation mapping, with difficulty tiers, a speed bonus and an S–D grade. Defender lens only — no exploit detail.
A toolkit built like LEGO — so defend it that way
What made PIPEDREAM/INCONTROLLER significant was not a single clever exploit but its generality: separate, reusable modules for scanning, for Schneider PLCs over Modbus/UMAS and CODESYS, for OMRON Sysmac PLCs over FINS, for OPC UA servers, and for operating the Windows host it launches from. A single framework could disrupt many kinds of plant because it spoke each device's native protocol.
For a defender that modularity is also the map. You protect Modbus/UMAS and CODESYS access to the Schneider controllers; you segment and monitor FINS to the OMRON controllers; you turn on OPC UA's own security — certificates, signing, encryption, no anonymous access — and keep the stack patched; and you harden the Windows engineering host with EDR, egress control and a vulnerable-driver blocklist, keeping it off a direct path to the controllers. No one control covers the whole toolkit, and that is the point this lab makes stick.
Frequently asked questions
What is PIPEDREAM / INCONTROLLER?
PIPEDREAM (the name Dragos gave it, attributed to the CHERNOVITE activity group) and INCONTROLLER (Mandiant's name for the same toolset) are a modular, state-grade attack framework for industrial control systems, disclosed in April 2022 in CISA Alert AA22-103A. It is notable for being discovered before it was used in a live attack. Its modules can scan for, enumerate, command, and disrupt specific controllers, and it includes components that operate on the Windows host rather than on any PLC.
Which devices and protocols does it target?
Publicly, the toolkit targets Schneider Electric PLCs over Modbus and the UMAS management protocol (and via the CODESYS runtime), OMRON Sysmac NEX PLCs over the OMRON FINS protocol and an on-board HTTP service, and OPC UA servers over OPC UA. It also includes host-level components: a remote-operations implant on the Windows engineering workstation, and a technique that loads a known-vulnerable signed driver to escalate privileges on that host.
Why does matching each module to its protocol matter for defenders?
Because the defence follows the protocol and the asset, not the effect. Monitoring and restricting Modbus/UMAS protects the Schneider PLCs but does nothing for an OMRON FINS path; enabling OPC UA signing and certificate authentication protects the data layer but not a controller; and a vulnerable-driver blocklist protects the Windows host but no PLC at all. A modular, protocol-specific toolkit demands a modular, protocol-specific response — which is exactly what this lab drills.
Is this an exploit or a real attack tool?
No. It is an educational, defender-focused triage of published capabilities as described by CISA, Dragos and Mandiant. It contains no exploit code, no payloads and no operational attack instructions. Every module is presented at the level of "what class of asset it reaches, over what protocol, and how a defender detects and mitigates it" so the learning is about segmentation, authentication and monitoring.