# APT custom tools target Schneider Electric, OMRON, OPC UA devices

Published: 2025-07-21 · Severity: routine · Sectors: energy, infrastructure, government-national
Canonical: https://vorant.io/reports/8dba2c86-c043-566c-bc5e-1d57ee380929/apt-custom-tools-target-schneider-electric-omron-opc-ua-devices

> APT actors developed modular tools to scan, compromise, and control ICS/SCADA devices after establishing OT network access.

The Department of Energy, CISA, NSA, and FBI jointly warn that advanced persistent threat actors have created custom-made tools targeting industrial control systems. The toolset includes modules for Schneider Electric MODICON and Nano PLCs, OMRON Sysmac NJ and NX PLCs, and OPC Unified Architecture servers. Once initial access to an OT network is established, these tools enable attackers to conduct automated reconnaissance, brute-force credentials, upload malicious configurations, and execute commands with a virtual console interface designed to lower the skill barrier for operator-level actors.

The Schneider Electric module can scan networks via UDP multicast on port 27127, brute-force passwords over UDP 1740 using CODESYS protocols, conduct denial-of-service attacks, sever authentication connections, and send custom Modbus commands. The OMRON module scans via FINS protocol, retrieves device details, and uploads a persistent agent enabling file manipulation and code execution. The OPC UA module connects using default or compromised credentials to read and write tag values.

Additionally, the APT actors exploit ASRock motherboard driver CVE-2020-15368 via the AsrDrv103.sys file to execute kernel-level code on Windows engineering workstations, enabling lateral movement within IT/OT environments and disruption of critical devices. No current active exploitation in the wild is explicitly stated, but the advisory urges critical infrastructure and energy sector organizations to implement detection and hardening measures immediately.

## Mentioned in this report

- Vulnerabilities: CVE-2020-15368

## Detection guidance (public sample)

### ASRock AsrDrv103 Vulnerable Driver Loaded

ATT&CK: T0871

Detects loading of the ASRock AsrDrv103.sys driver (CVE-2020-15368), abused to run kernel-level code on engineering workstations. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: ASRock AsrDrv103 Vulnerable Driver Loaded
description: Detects loading of the ASRock motherboard driver AsrDrv103.sys, which
  is vulnerable to CVE-2020-15368 and abused by APT ICS tooling to execute kernel-level
  code on Windows engineering workstations. Matches on the driver file name, not on
  hashes.
tags:
- attack.privilege-escalation
- attack.t1068
- attack.t0871
logsource:
  category: driver_load
  product: windows
detection:
  selection:
    ImageLoaded|endswith: \AsrDrv103.sys
  condition: selection
falsepositives:
- Legacy ASRock motherboard utilities (such as RGB or tuning software) installed on
  workstations that still ship this driver version
level: high
id: db23a033-591b-5c73-aed7-82e2b9d2e35a
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-103a
```

### Service Created Pointing to ASRock AsrDrv Driver

ATT&CK: T0871

Detects sc.exe creating a kernel driver service that references an ASRock AsrDrv driver, the BYOVD staging step for CVE-2020-15368 exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Service Created Pointing to ASRock AsrDrv Driver
description: Detects sc.exe registering a service whose binary path references an
  AsrDrv driver file, a staging step for loading the vulnerable ASRock driver (CVE-2020-15368)
  before kernel code execution.
tags:
- attack.privilege-escalation
- attack.t1068
- attack.t0871
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \sc.exe
    CommandLine|contains|all:
    - create
    - AsrDrv
  condition: selection
falsepositives:
- Legitimate ASRock utility installers registering their hardware driver service
level: high
id: 416b6971-93c5-53fe-9be2-1398fa3c0534
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-103a
```

### Outbound UDP to CODESYS Discovery and Brute-Force Ports 27127 and 1740

ATT&CK: T0846

Detects Windows hosts initiating UDP traffic to ports 27127 or 1740, used by APT ICS tooling for Schneider PLC discovery and CODESYS password brute-forcing. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Outbound UDP to CODESYS Discovery and Brute-Force Ports 27127 and 1740
description: Detects a Windows host initiating UDP connections to port 27127 (Schneider
  multicast network scan) or 1740 (CODESYS password brute-force). Repeated hits from
  one workstation indicate PLC reconnaissance or credential attack. Tune by allow-listing
  known engineering stations; a count or time threshold should be applied in the SIEM.
tags:
- attack.discovery
- attack.t0846
- attack.credential-access
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    Protocol: udp
    DestinationPort:
    - 27127
    - 1740
  condition: selection
falsepositives:
- Authorized engineering workstations running Schneider or CODESYS programming software
  that scan for PLCs
- Asset-discovery or OT vulnerability scanners
level: medium
id: 519c2600-d617-5816-911b-688b80e9a883
status: experimental
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-103a
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa22-103a

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/8dba2c86-c043-566c-bc5e-1d57ee380929/apt-custom-tools-target-schneider-electric-omron-opc-ua-devices.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup