What happened

DOE, CISA, NSA and the FBI jointly warned that state-linked actors had built a modular attack toolkit — called Pipedream by Dragos, which tracks the developer as Chernovite, and Incontroller by Mandiant — capable of scanning, compromising and controlling Schneider Electric and Omron PLCs and OPC UA servers, plus a Windows kernel exploit via a vulnerable ASRock driver. Reporting indicated the tools were positioned toward US LNG and electric targets but were discovered before being employed in a disruptive attack. No public attribution to a specific state has been made. This is a capability record rather than an executed attack; the marker is a country-level reference.

When cited sources give different casualty, damage or spill figures for this event, they’re reported side by side above rather than merged into one number. See how confidence levels work.