Normal view

There are new articles available, click to refresh the page.
Today — 15 September 2026Main stream

America’s machinists are retiring, and two startup founders in their 20s want to salvage what they know

15 September 2026 at 10:59
Neuramill co-founders Nick Khormaei (COO) and Nistha Mitra (CEO) at the Reindustrialize summit in Detroit. (Photo courtesy of Neuramill)

When machinists with decades of experience retire, everything they know about how metal behaves under a cutting tool — or anything else they learned through a career of scrapped parts and expensive mistakes — walks out the door with them.

A startup with roots in Seattle, started by two founders in their 20s, is building technology to capture that knowledge long before that point.

Neuramill, founded last year by CEO Nistha Mitra and COO Nick Khormaei, is developing what the company calls an intelligence layer for high-precision manufacturing.

The software reads a design file and figures out how the part should be made: which tools, which machines, and in what order. A machinist reviews and approves every plan before anything reaches the floor.

“This is a high-skill job, and nobody’s retaining this information,” Mitra said. When the machinists who know how to build complex jet engine parts retire, she said, that knowledge goes with them. “We help retain that for the future generation.”

Khormaei said the two founders spent much of the past year visiting machine shops to watch how the work gets done.

“The craft itself is so impressive,” he said. “They’re able to look at these drawings and models that come in and know exactly how to build it. It’s like they’re doing real-time physics simulation.”

Early customers and partners: The company says it has closed a six-figure contract with a major defense contractor, one of the companies known in the industry as primes. Neuramill declined to name the contractor.

Two of the machine shops using the software are Diamond Machine Works, a Seattle precision machining company founded in 1959, and VTN Manufacturing in San Jose, Calif. Satellite maker Astranis is a design partner.

Mitra said the company is not yet selling broadly, but has been paid by some of the early customers testing the software.

How they got here: Mitra, 26, has a computer science degree from the University of Maryland and spent three years at Oracle, most recently as an AI applied scientist in Seattle, working on multimodal models that reason across several kinds of data at once.

Khormaei, 24, holds bachelor’s and master’s degrees in electrical engineering from the University of Washington. He was a propulsion engineer at Boeing in Everett, where he worked on 777X fuel system electrical certification, and then spent part of last year at SpaceX as an integration and test engineer on Starlink manufacturing in Redmond.

He also grew up around machining. His father, Ron Khormaei, co-founded FINEX Cast Iron Cookware in Portland in 2012 and sold it to Lodge in 2019. Khormaei worked production there as a teenager.

Where the software fits in: Neuramill’s technology works at a stage that has stayed largely manual: after the design file arrives, and before a programmer opens the computer-aided manufacturing (CAM) software that translates decisions into machine instructions.

Rather than position the company against Siemens and Mastercam, Mitra said Neuramill plugs into those systems. The company recently joined Siemens’ Frontier Partner Program, which gives startups access to the company’s software tools.

“At this point we are very collaborative with these companies,” she said, adding that the established vendors are looking for new technology of their own.

Bay Area and Seattle: Both founders worked in the Seattle region before leaving for San Francisco, a move Mitra described to GeekWire in February. They are back every four or five weeks now, working out of Foundations, the Seattle founder hub.

“We love this ecosystem. It gave birth to Neuramill,” Mitra said. They keep coming back in part for the customers: “This is a booming ecosystem in space and in aerospace.”

Funding and team: Neuramill has raised an undisclosed amount from Ascend, Breakwater Ventures, Schema Ventures, Creative Destruction Lab, Acequia Capital and Correlation Ventures.

The team is six people plus a contractor: the two founders, a chief research scientist who worked with Mitra at Oracle, and three engineers, one of them a machinist.

What’s next: The long-term goal, Mitra said, is a “world model” for manufacturing: a system that can reason across geometry, materials and machine behavior at any level of complexity. Even then, she sees a role for the people on the shop floor.

“There is a beauty to the craft of manufacturing that we should really respect,” she said. “There are some places where humans should not be extracted out of an industry, and I think manufacturing is one of them.”

Before yesterdayMain stream

SCADA/ICS/OT Hacking and Security: Hacking with SCADAver

31 August 2026 at 11:54

Welcome back, cyberwarriors!

Lately we’ve been seeing more reports on attacks against industrial facilities. It’s often the case that the hardware behind these facilities has been vulnerable and overlooked for years. Administrators may know how to set these systems up and keep them running, but they don’t know how to secure them. So many SCADA/ICS/OT systems are reachable from the internet, and basically anyone can interact with them.

There are plenty of tools out there built to test specific functions of SCADA systems, but SCADAver seems to pack a lot more features into just one tool. That’s why we’ll cover it today.

SCADAver

SCADAver is a new tool written in Rust. It came out recently. The tool can discover, fingerprint, enumerate and test systems across common industrial protocols. In one binary you get a CLI interface, a terminal UI and a browser UI.

This project is still experimental. It’s built from public protocol documentation, vulnerability advisories and security research. It works pretty well for assessing device security internally, but you can also use it against devices reachable from the internet, since plenty of them are insecure. And it’s not just active interaction either, SCADAver supports PCAP file analysis too. The tool can also set up a rogue device you can test safely.

Setting Up

We’ll go with the quickest route and just download the compiled version. The developer has it available for Windows, macOS and Linux.

ubuntu > curl https://github.com/Whispergate/SCADAVER/releases/download/v1.5.1/scadaver-linux-x86_64

ubuntu > mv scadaver-linux-x86_64 scadaver
ubuntu > mv scadaver /usr/bin

Working with SCADAver

We’ll mainly be using the CLI version throughout the demonstration, though the terminal UI and browser UI will get shown too. The CLI version will probably be the most convenient for a lot of you.

First let’s list the help menu and see what the tool has:

ubuntu > scadaver -h 

As you can see, we’ve got commands here. Each command has its own help menu where you’ll find more information on exploits and other flags. You’ll see it later.

Siemens S7 – Basics 

Let’s do a basic scan of a Siemens system and see what the tool comes back with.

# a basic scan 
ubuntu > scadaver -i IP scan

# a stealthy scan
ubuntu > scadaver -z -i IP scan

It found port 102 open, and it was Siemens indeed.

We can also do a protocol specific scan or point it at a custom port if necessary:

ubuntu > scadaver -z -i IP --protocol siemens scan

# or with a custom port 
ubuntu > scadaver -z -p 105 -i IP --protocol siemens scan 

Port scanning is also possible. That’ll come in handy when you’re working internally and sweeping networks to find SCADA systems.

ubuntu > scadaver run portscan -i IP

Having covered the basics, we can move on to more interesting stuff and pull some information off this system.

Siemens S7 – Extracting Values

SCADAver can fetch every switch that’s currently on or off on the system. Having a map with human readable labels really helps here, that way you’ll know what each switch is actually responsible for (pump running, valve closed and so on).

ubuntu > scadaver -i IP get io

Say you know a pump is running, now you can find out exactly how it’s supposed to run. We do that with get db, which extracts memory chunks from the device.

ubuntu > scadaver -i IP get db 1 0 64

Here we ask it to open Data Block 1, start at byte 0, and read 64 bytes. Just like with get io, we need a symbol table or the program itself to understand what these values mean. With a symbol table, we’d know that if DB1 holds 1500, the program wants 1500 rpm, for example.

Modbus – Changing Values

We’re not limited to reading only, we can set our own values for registers and coils too. Here are some examples:

ubuntu > scadaver -i IP -p 502 set register 1 1234
ubuntu > scadaver -i IP -p 502 set registers 0 100,200,300,400
ubuntu > scadaver -i IP -p 502 set coil 5 on
ubuntu > scadaver -i IP -p 502 get register 1
ubuntu > scadaver -i IP -p 502 get coil 5 1

Between 2007 and 2010 Stuxnet leaned heavily on a highly sophisticated False Data Injection (FDI) attack to conceal its sabotage. The malware recorded 21 seconds of normal operational sensor readings from the centrifuges and looped that healthy operational data back to the Human Machine Interface (HMI) and the main controller.

We can pull this off too:

ubuntu > scadaver -i IP run fdi --address 100 --value 500 --count 20

With this command we keep writing the same number into one Modbus register, over and over. Many HMIs and programs read that register and trust it blindly. So the screen or the logic keeps seeing 500 even if the real process is doing something else entirely. 500 here could mean 500 rpm, 500 liters, or 50.0°C. Only the map tells you what it’s actually responsible for.

As you know, there can be several PLCs in one cabinet, and you need a way to know which one you’re working with. Schneider’s identify yourself packet (UDP 27127) makes many M340, M580, Quantum and Premium units blink an LED on the panel. It’s a harmless identity check.

ubuntu > scadaver -i IP run flash-led

These SCADA systems often have an HTTP web interface that you can access and interact with. Sometimes, it’s authentication gated and prompts you to enter valid credentials. Here’s another run command that’ll test default credentials against HTTP Basic Auth.

ubuntu > scadaver -i IP run default-creds

More exploits and actions that run has can be seen in the help menu:

ubuntu > scadaver run -h 

Another interesting thing you might find is the database knowledge behind researching and exploiting SCADA systems. We listed all of them for Siemens:

ubuntu > scadaver db refs siemens

Browser UI & Terminal UI

In case you don’t like working with the CLI, you can try the other options.

For the Terminal UI run this:

ubuntu > scadaver

And the Browser UI can be set up with this command: 

ubuntu > scadaver web

It will be hosted on http://127.0.0.1:8888

Summary

The developer calls it a unified ICS red team multi tool, and it truly is. It’s handy to have all these exploits and recon features packed into one tool that supports so many protocols and products. Obviously it’s still in active development, since it just came out. But even so, you can already put it to use instead of switching between different tools.

We haven’t covered all its features and functions, that would make this far too long. Feel free to experiment with it yourself, since it can even set up a rogue server for you to test against.

If you want to learn how to hack and secure SCADA systems, we invite you to our training led by OccupyTheWeb. It’s available for both beginners and advanced students.

The post SCADA/ICS/OT Hacking and Security: Hacking with SCADAver first appeared on Hackers Arise.

❌
❌