CYBRARY Control protocol from an address with no asset-register entry
T0848 · FR1Modeled on Maroochy Shire sewage spills (2000)
Breach response — plant case console
A second master is issuing commands on the control network
Work the queue. For every line, say which IEC 62443 zone the finding belongs to and what the control room does about it. Some of these are the shift's own routine behavior and closing them is the right call. Isolating a controller on a running line is never the answer here — keep the process observable and bring operations in.
0 of 6 filed0 of 3 timeline stages resolved
Network
The traffic behind the queue: what crossed which boundary, the packets that carried it, and the rules the shift changed.00:00 / 08:39
- Flows
- 0
- Packets
- 0
- Volume
- 0 bytes
- Blocked
- 0
- Rule changes
- 0
Nothing on this view yet — the incident is still early.
Alert queue
Historian replica caught up 40 minutes of tags in one burst
Two masters writing to the same controller
T0855 · FR2Modeled on Industroyer / CRASHOVERRIDE (2016, repeated as Industroyer2 in 2022)
Named maintenance account signed in at the jump host during its window
Control-zone flow that crossed no declared conduit
T0848 · FR5Modeled on Industroyer / CRASHOVERRIDE (2016, repeated as Industroyer2 in 2022)
Line setpoint changing to whichever master wrote last — operator control contested
T0831 · FR7Modeled on FrostyGoop heating outage (2024)
Every detection and timeline stage here comes from the published plant threat model — ATT&CK for ICS techniques and documented incidents. Simulation only; no plant, protocol or controller exists.