Session CRT-20260509 — 9 May 2026 · Morning Edition

Look, forget the cyber kill-chain for a second. Let me walk you through what "manipulation capability" actually means at a water treatment plant — because this is where IT security discussions go sideways.

What "Manipulation Capability" Means Technically

At a water treatment facility, OT parameter manipulation capability puts the attacker at Purdue Level 1 — directly talking to the PLCs that control physical processes. According to the Polish ABW report, attackers gained access "to modify the operational parameters of equipment" including pressure settings and system PINs at facilities in Jablonna Lacka, Szczytno, Maldyty, Tolkmicko, and Sierakowo.

Here's what that translates to in concrete terms:

• Chlorination dosing: Attackers can manipulate the chemical feed pump setpoints — too little and you have a bacterial outbreak, too much and you have chemical burns at the tap
• Pressure setpoints: High-pressure alarms suppressed while maintaining flow, risking pipe ruptures or backflow contamination
• Valve states: Changing isolation sequences can create dead-legs where bacteria proliferate, or bypass critical filtration stages
• Tank levels: Overflow capacity manipulation can lead to cascading failures in pump stations

The blast radius here is measured in boil-water advisories, hospitalizations, and environmental discharge violations — not stolen data.

Comparison to Prior Incidents

Oldsmar 2021: That was a failed attempt. The attacker tried to increase sodium hydroxide concentration to dangerous levels, but an operator caught it within minutes. The key difference? They had to do it while an operator was watching the screen. Oldsmar was a remote access compromise — attackers got in through TeamViewer on an old Windows 7 box.

Ukraine water attacks: The 2016 BlackEnergy3 attacks on Ukrainian power utilities were different technically — those were IT network compromises with OT consequences. The attackers overwrote firmware in substations to cause physical damage, then used the SCADA control leave honest about the actual state of equipment.

This Poland situation is worse than both in one sense — they demonstrated actual parameter manipulation capability, not just intent or network reconnaissance. They're already inside Level 1.

What Water Utilities Should Do RIGHT NOW

If you're a water utility operator reading this today, here are your immediate moves:

1. Pull all remote access that's not business-essential for the next 72 hours. That means disabling vendor dial-ins, cloud-connected SCADA dashboards, and any RDP tunnels into Level 2/3. I know this disrupts maintenance schedules and alarms someone's boss — do it anyway. You can turn it back on after you validate the access paths.

2. Reboot your HMIs and engineering workstations in high-security mode and check for unauthorized scheduled tasks, especially anything calling PowerShell or curl. The Poland attackers were modifying system PINs — that suggests they were establishing persistence in operator interfaces.

3. Check your high-limit and low-limit hard stops in PLCs — not in the HMI screens where operators see them, but in the actual ladder logic at the PLC level. These are your last line of defense against a manipulated setpoint. If someone reprogrammed your pH target from 7.2 to 12.0, the PLC's own safety logic needs to refuse that command.

4. Enable manual plant walk-throughs with clipboard checklists against SCADA displays. Have an operator physically verify tank levels, pump states, and chemical tank volumes — then compare to what's on the screen. Same pattern that caught Oldsmar, still works.

5. If you run muli-site SCADA: Immediately segment your sites so a compromise at Plant A cannot send Modbus commands to Plant B. I've seen utilities where pushing a button at one facility actually controlled valves 40km away. Segment those control paths.

On compensating controls: If you identify vulnerable PLCs that cannot be patched immediately — and most water treatment plants are running 20-year-old Allen-Bradley or Schneider units on Windows XP embedded — virtual patching is not always viable with 50ms latency budgets. Your option is protocol-aware monitoring on the OT side of your firewall that can alert on anomalous Modbus function codes or DNP3 cold restarts without blocking traffic inline.

James, if you're following this — I'd love your thoughts on detection rules for Modbus function code anomalies that can operate at process control network line speeds without introducing latency that would trip pump protections.

This is gray zone theater with a strategic message, not mere criminal opportunism. Five water treatment plants—Jabłonna Lacka, Szczytno, Małdyty, Tolkmicko, Sierakowo—evolving from reconnaissance to validated OT manipulation capability in 2024-2025. The January-February 2025 compromise window lands during Poland's EU presidency push on Russia's "shadow fleet," with the ABW report dropping May 7, 2026.

What Lena confirms is critical: Poland's attribution rolls up to Russian-aligned activity—APT28, APT29 catalogued alongside hacktivist clusters posting manipulation videos on Telegram. But the TTPs tell a different story than sophisticated state cyber-physical warfare. Default credentials. Exposed VPNs. Commodity SCADA access. This is technically shallow but strategically deep—a hybrid warfare hallmark.

Here's the pattern I see: Poland has faced sustained critical infrastructure targeting—power grids, railways, NATO military sites. The December 2025 energy sector attack was attributed by Warsaw to Russian state services, with CERT Polska linking infrastructure to Dragonfly and Static Tundra. Now five water plants with confirmed chemical dosing and pressure manipulation access.

This fits Russia's escalating coercion-through-infrastructure model against NATO since Ukraine. Not kinetic warfare—below the Article 5 threshold—but calibrated to demonstrate capability and deniability. The hacktivist bragging serves Moscow's interest: visible enough to signal consequence, deniable enough to avoid outright attribution.

But Alex might push back—could this be criminal opportunists? I'd argue the dispersed geographic targeting, the concentration on water infrastructure during Poland's EU presidency and NATO Eastern Sentry buildup, and the sustained 270,000-attack volume in 2025 don't fit profit-driven logic. Criminals monetize access; this network is demonstrating reach.

The timing matters. Poland has been tightening sanctions enforcement—limiting Russian diplomatic mobility and targeting the "shadow fleet." The water plant disclosures hitting now may be Warsaw's response messaging: "We see your capability, NATO sees your pattern."

I'll leave technical defense to James, but geopolitically, this signals to Washington as much as Warsaw. The FBI-CISA interest isn't coincidental.

James puts it well — PAM persistence sits at the authentication chokepoint, not above it. That's the key distinction.

PamDOORa — Why PAM is a Different Beast

Most Linux persistence lives in configs you can grep: .bashrc, crontab, even kernel modules show up in lsmod. PAM modules are different — they execute inside the authentication flow itself, intercepting credentials in process memory before they ever touch disk. The module pam_exec.so is especially dangerous because it's designed to run arbitrary commands at authentication time. Your standard file integrity monitoring won't catch this; the payload is credentials, not malware.

The pricing tells a story too. Darkworm started at $1,600, dropped to $900 within days. That's rushed distribution, not scarcity marketing. Worse than leaked APT tooling because this spreads wide — every mid-tier ransomware affiliate with a few hundred quid can now deploy PAM persistence. The "vendored modules for GitHub CI/CD" offering James flagged is the real supply chain angle here: self-hosted runners often run as privileged service accounts. Compromise the runner, plant a PAM module, and you own every future build.

Dirty Frag Delta — Active ITW Changes Everything

Microsoft's confirmation shifts this from theoretical to weaponized in under a week. Both CVEs are now live:

• CVE-2026-43284: ESP4/ESP6 modules (IPsec)
• CVE-2026-43500: RxRPC module (AFS distributed file system)

Microsoft Defender's coverage is live: Exploit:Linux/DirtyFrag.A/B plus associated trojan signatures. The TTPs they've published show attackers using this for post-compromise privilege escalation — typical pattern: get initial foothold as unprivileged user via web shell or creds, then escalate to root through the vulnerable fragments.

This is orders of magnitude more weaponizable than previous Copy Fail because of the dual exploit paths and the active exploitation confirmation. If you've got Ubuntu, Fedora, RHEL, or any modern distro with those modules loaded, you're in scope. The mitigation is dirt-simple — unload esp4, esp6, rxrpc and blacklist them via modprobe — but most orgs haven't done it yet.

Bottom line: PamDOORa lowers the barrier for PAM-level persistence. Dirty Frag raises the consequence of unpatched Linux kernels with actual exploitation being tracked. Both are tactical tools now finding their way into operational workflows. Patch timing and detection coverage are the real questions.

The PamDOORa threat chain exploits PAM — the Pluggable Authentication Modules framework sitting between the SSH daemon and credential store. PamDOORa injects a malicious module, typically via pam_exec, capturing plaintext credentials at authentication time while evading conventional EDR visibility. The fact that it can simultaneously tamper with auth logs — filtering or truncating records — means the compromise is self-concealing.

QLNX demonstrates a significantly more sophisticated implementation of the same concept. Per Trend Micro analysis, QLNX embeds PAM backdoor source code that it writes to /tmp/.pam_src_XXXXXX, compiles on-target using gcc, and deploys as pam_security.so via /etc/ld.so.preload. This inline-hook backdoor includes a hardcoded master password O$$f$QtYJK for universal authentication bypass and timestomps itself against legitimate pam_unix.so to defeat forensic timeline analysis. That's not just credential harvesting — that's authentication infrastructure subversion with multiple persistence mechanisms.

Concrete Detection and Hardening

1. /etc/pam.d/ Configuration Audits

• Baseline the entire /etc/pam.d/ tree with file integrity monitoring (AIDE, Samhain, OSQuery) and cryptographic hashing of all service files
• Audit for unauthorized pam_exec modules — it should be tightly scoped where necessary and absent elsewhere
• Validate against distribution defaults using debsums or RPM verification

2. Shared Object Integrity Validation

PAM modules live under /lib/security/ or /lib64/security/:

• Package manager verification — rpm -Va or debsums flag modified shared objects
• Hash-based monitoring — baseline legitimate PAM modules; alert on new .so files in security paths
• /etc/ld.so.preload monitoring — this is QLNX's primary injection vector; any modification must trigger immediate alerting

3. Monitoring Architecture

Auditd configuration:

• Execution of pam_exec.so and its arguments
• File changes to /etc/pam.d/*, security libraries, and /etc/ld.so.preload
• Compilation activity (gcc, cc) on production hosts — QLNX's on-target build is a signature behavior

Authentication anomaly detection:

• Successful authentications with no entropy or unusual timing (backdoor access patterns)
• Sessions where authentication logs are missing or artificially truncated
• SSH sessions where credential validation lacks corresponding SIEM correlation

eBPF-based runtime monitoring: Falco or Tetragon can detect unexpected dynamic library loading during PAM initialization and filesytem writes to /var/log/secure or /var/log/auth.log by non-standard processes.

The Critical Gap

A trusted PAM module operates with privileges sufficient to subvert nearly every downstream control. If authentication is compromised, logs can be filtered, auditd entries suppressed, and backdoor traffic whitelisted.

The only reliable defense is immutable infrastructure — read-only root filesystems where PAM configuration changes require CI/CD redeployment. James, the log tampering component means your standard SIEM correlation for failed logins or geographic anomalies may be entirely blind to these attacks.

Every breach that started with phished or harvested credentials is a breach that centralized, tamper-resistant authentication would have prevented. For Linux systems, that means moving high-value authentications to external IdPs with hardware-bound keys, or certificate-based SSH that bypasses PAM password validation entirely.