Excerpt
CISA has issued an ICS advisory for ANDRITZ HIPASE-250 and 250 SCALA. Power-generation and OT teams should validate exposure, isolate engineering paths, and stage vendor remediation now.
Introduction
CISA published ICSA-26-225-05 for ANDRITZ HIPASE-250 and HIPASE-250 SCALA, equipment used in industrial control environments and commonly associated with generation, excitation, protection, and plant-control workflows. The supplied brief does not include CVE identifiers or CVSS scores, so defenders should treat the CISA page and ANDRITZ notice as the source of truth and avoid guessing identifiers. The operational point is still clear: anything that can alter excitation, protection limits, synchronization logic, setpoints, or controller firmware must be treated as crown-jewel OT, even when the vulnerable component sits behind a vendor workstation or service interface.
For asset owners, the priority is not debate about severity labels. The priority is to prove whether HIPASE-250 or 250 SCALA devices are reachable from business networks, vendor remote-access paths, shared jump hosts, or poorly governed engineering laptops. If they are, reduce reachability immediately, preserve logs, and open a controlled change window with the vendor. In generation environments, an unsafe patch can be as disruptive as an intrusion, so remediation must be coordinated with operations, protection engineering, and plant management.
Technical Analysis
Affected products and platforms
The advisory title identifies two product families: ANDRITZ HIPASE-250 and ANDRITZ HIPASE-250 SCALA. Treat all deployed units, redundant pairs, spares, test racks, engineering workstations, configuration tools, project files, and vendor service accounts as in scope until the advisory explicitly rules them out. Version confirmation should come from the device faceplate, engineering software About dialog, controller firmware inventory, and ANDRITZ support. Do not rely on a procurement spreadsheet alone; OT assets frequently drift from purchase records after commissioning, retrofits, and lifecycle extensions.
Vulnerability details and exploitation requirements
The prompt summary does not provide CVE, CVSS, affected version ranges, or proof-of-concept status. That absence matters: do not invent a CVE or map this advisory to an unrelated historical bug. From a defender's perspective, the practical risk model for this class of product is consistent regardless of the exact flaw: an attacker or unauthorized user who gains an engineering path may attempt to read proprietary configuration, modify logic or limits, download firmware, place the controller into a maintenance state, or disrupt availability. Exploitation is usually constrained by network adjacency, valid credentials, exposed service ports, removable media, or vendor remote-support tooling.
Exploitation status
Because no exploitation status was included in the supplied news summary, classify exploitation as unknown until CISA, ANDRITZ, or trusted intel confirms otherwise. Check whether the advisory is later added to the CISA Known Exploited Vulnerabilities catalog, but do not wait for KEV listing before reducing exposure. In OT, absence of public exploitation is not reassurance; many ICS compromises are discovered only after operational impact or during incident response.
Detection and Response
The most reliable telemetry will come from boundary firewalls, OT remote access brokers, Windows engineering stations, authentication logs, backup/config repositories, and controller change records. Tune for rare, high-value events: new engineering tools, unexpected controller connections, configuration downloads outside approved change windows, service-account use from unusual hosts, and protocol traffic crossing zones that should never communicate.
---
title: Engineering Tool Launched From User Writable Path on OT Windows Host
id: 8b4f6a21-6d4f-4ad8-9f1d-9c7f2b7a2f01
status: experimental
description: Detects execution of engineering or control software from user-writable or temporary locations on Windows engineering workstations, a common staging pattern in OT intrusion and unauthorized maintenance activity.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-05
- https://attack.mitre.org/techniques/T1204/
author: Security Arsenal
date: 2026/08/13
tags:
- attack.execution
- attack.t1204
logsource:
category: process_creation
product: windows
detection:
selection_path:
Image|contains:
- '\Users\'
- '\AppData\Local\Temp\'
- '\Downloads\'
- '\ProgramData\'
selection_name:
Image|endswith:
- 'hipase.exe'
- 'hipase250.exe'
- 'scala.exe'
- 'andritz.exe'
- 'configurator.exe'
- 'engineering.exe'
condition: selection_path and selection_name
falsepositives:
- Vendor installer temporarily staging files during an approved change
level: high
---
title: Suspicious Scripting or Discovery Utility Spawned by Engineering Application
id: 5a1f4e11-4b9c-4f31-9b2b-0d4f6f1a7c22
status: experimental
description: Detects an engineering or vendor control application spawning scripting, discovery, compression, or remote-access child processes that are unusual for controller maintenance workflows.
references:
- https://www.cisa.gov/news-events/ics-advisories/icsa-26-225-05
- https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/08/13
tags:
- attack.execution
- attack.t1059
- attack.discovery
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|contains:
- 'ANDRITZ'
- 'HIPASE'
- 'SCALA'
- 'Engineering'
selection_child:
Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
- '\cmd.exe'
- '\wmic.exe'
- '\rclone.exe'
- '\7z.exe'
- '\winscp.exe'
- '\pscp.exe'
- '\plink.exe'
condition: selection_parent and selection_child
falsepositives:
- Signed vendor service scripts documented in a maintenance procedure
level: medium
// Hunt 1: Windows process execution on likely engineering or OT assets
let OtHosts = dynamic(['EWS','ENG','OT','HMI','HIPASE','SCALA','ANDRITZ']);
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where OtHosts contains DeviceName or InitiatingProcessFileName has_any ('hipase','scala','andritz','engineering','configurator')
| where FileName in~ ('powershell.exe','pwsh.exe','cmd.exe','wmic.exe','rclone.exe','7z.exe','winscp.exe','pscp.exe','plink.exe','nmap.exe')
or ProcessCommandLine has_any ('-enc','-encodedcommand','invoke-webrequest','certutil','bitsadmin','nikto','modbus','dnp3','iec61850','firmware','download config','upload')
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256, ReportId
| order by TimeGenerated desc;
// Hunt 2: network crossings into OT controller space from non-approved sources
let OtSubnets = dynamic(['10.20.','10.30.','172.16.','192.168.']);
let ApprovedJumpHosts = dynamic(['OT-JUMP-01','OT-JUMP-02']);
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteIP startswith_any OtSubnets and DeviceName !in~ ApprovedJumpHosts
| where RemotePort in (22,23,80,443,502,2404,44818,20000,47808,8080,8443) or LocalPort in (22,23,80,443,502,2404,44818,20000,47808,8080,8443)
| project TimeGenerated, DeviceName, LocalIP, LocalPort, RemoteIP, RemotePort, InitiatingProcessFileName, InitiatingProcessAccountName, ActionType
| order by TimeGenerated desc;
// Hunt 3: firewall, VPN, or remote-access logs ingested as CEF/Syslog
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where DeviceVendor has_any ('ANDRITZ','Fortinet','Palo Alto','Cisco','Check Point') or DeviceProduct has_any ('VPN','Firewall','Remote Access')
| where Message has_any ('HIPASE','SCALA','ANDRITZ') or DestinationIP startswith_any OtSubnets
| where SourceUserName !in~ ApprovedJumpHosts and Activity in~ ('allow','accept','connect','login')
| project TimeGenerated, DeviceVendor, DeviceProduct, SourceIP, SourceUserName, DestinationIP, DestinationPort, Protocol, Activity, Message
| order by TimeGenerated desc
-- Artifact: Windows.Hunt.OTEngineeringExposure
-- Purpose: find suspect processes, persistence, and controller-facing connections on engineering workstations.
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(?i)(users|appdata|downloads|temp|programdata)'
AND (Name =~ '(?i)(hipase|scala|andritz|engineering|configurator)' OR CommandLine =~ '(?i)(firmware|config|download|upload|modbus|dnp3|iec61850)')
SELECT Name, CommandLine, Exe, Username
FROM pslist()
WHERE CommandLine =~ '(?i)(encodedcommand|-enc|certutil|bitsadmin|winscp|pscp|plink|rclone|7z)'
AND (Exe =~ '(?i)(andritz|hipase|scala|engineering)' OR Name =~ '(?i)(powershell|pwsh|cmd|wmic)')
SELECT Pid, Name, LocalAddr, LocalPort, RemoteAddr, RemotePort, Status
FROM netstat()
WHERE Status =~ '(?i)estab|listen'
AND (RemotePort in (22,23,80,443,502,2404,44818,20000,47808,8080,8443) OR LocalPort in (22,23,80,443,502,2404,44818,20000,47808,8080,8443))
AND RemoteAddr =~ '^(10\.20\.|10\.30\.|172\.16\.|192\.168\.)'
SELECT Name, DisplayName, PathName, StartName, StartMode, State
FROM wmi(namespace='root/cimv2', query='SELECT Name, DisplayName, PathName, StartName, StartMode, State FROM Win32_Service')
WHERE PathName =~ '(?i)(users|appdata|temp|downloads|programdata)'
OR DisplayName =~ '(?i)(remote|support|vendor|andritz|hipase|scala)'
# Verify and temporarily harden Windows engineering workstations pending vendor guidance.
# Run from an elevated PowerShell session during an approved OT maintenance window.
$ErrorActionPreference = 'Continue'
$Report = 'C:\Windows\Temp\HIPASE_ICS_Hardening_' + (Get-Date -Format 'yyyyMMdd_HHmmss') + '.txt'
'=== Host identity ===' | Out-File $Report
Get-CimInstance Win32_ComputerSystem | Select-Object Name,Domain,Manufacturer,Model | Out-File $Report -Append
Get-CimInstance Win32_OperatingSystem | Select-Object Caption,Version,BuildNumber,LastBootUpTime | Out-File $Report -Append
'=== Installed ANDRITZ/HIPASE/SCALA related software ===' | Out-File $Report -Append
Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*,HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* |
Where-Object { $_.DisplayName -match 'ANDRITZ|HIPASE|SCALA' } |
Select-Object DisplayName,DisplayVersion,Publisher,InstallDate | Out-File $Report -Append
'=== Unexpected listening services and established remote sessions ===' | Out-File $Report -Append
Get-NetTCPConnection | Where-Object { $_.State -in 'Listen','Established' } |
Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,OwningProcess | Out-File $Report -Append
'=== Services running from user-writable paths ===' | Out-File $Report -Append
Get-CimInstance Win32_Service | Where-Object { $_.PathName -match 'Users|AppData|Temp|Downloads|ProgramData' } |
Select-Object Name,DisplayName,State,StartMode,StartName,PathName | Out-File $Report -Append
'=== Local administrators and recently created accounts ===' | Out-File $Report -Append
Get-LocalGroupMember -Group 'Administrators' | Select-Object Name,ObjectClass,PrincipalSource | Out-File $Report -Append
Get-LocalUser | Where-Object { $_.Enabled -eq $true } | Select-Object Name,Enabled,Created,LastLogon,PasswordExpires | Out-File $Report -Append
'=== Defender, firewall, and SMB posture ===' | Out-File $Report -Append
Get-MpComputerStatus | Select-Object AMServiceEnabled,AntivirusEnabled,RealTimeProtectionEnabled,IoavProtectionEnabled,BehaviorMonitorEnabled | Out-File $Report -Append
Get-NetFirewallProfile | Select-Object Name,Enabled,DefaultInboundAction,DefaultOutboundAction | Out-File $Report -Append
Get-SmbServerConfiguration | Select-Object EnableSMB1Protocol,EnableSMB2Protocol,RequireSecuritySignature,EncryptData | Out-File $Report -Append
# Conservative compensating controls: block inbound to common engineering service ports from non-management sources.
# Comment out before use if plant policy requires another mechanism; document every change in the OT CMDB.
$MgmtHosts = @('OT-JUMP-01','OT-JUMP-02')
foreach ($Rule in 'HIPASE Block Inbound TCP 23','HIPASE Block Inbound TCP 502','HIPASE Block Inbound TCP 2404','HIPASE Block Inbound TCP 44818') {
if (-not (Get-NetFirewallRule -DisplayName $Rule -ErrorAction SilentlyContinue)) {
New-NetFirewallRule -DisplayName $Rule -Direction Inbound -Action Block -Protocol TCP -Profile Any | Out-File $Report -Append
}
}
'REPORT COMPLETE: ' + $Report
Remediation
- Read ICSA-26-225-05 at the CISA URL and the corresponding ANDRITZ customer notice before touching production. Record exact affected models, firmware, engineering tool versions, fixed versions, prerequisites, and rollback requirements. The prompt does not supply patch numbers, so no version number should be assumed here.
- Build a defensible asset inventory within 24 hours: every HIPASE-250 and 250 SCALA controller, redundant mate, engineering workstation, HMI, historian connector, project backup, license server, and vendor laptop. Capture device identifiers, firmware, configuration hash where supported, network location, last backup, and responsible owner.
- Reduce exposure immediately if a fixed release is not yet approved for your plant. Enforce deny-by-default between business and OT zones, permit only named jump hosts to controller subnets, disable vendor remote access outside scheduled windows, require MFA and brokered session recording, block removable media, and suspend shared local administrator rights.
- Preserve evidence before maintenance: firewall logs, VPN/remote-access logs, Windows event logs, controller alarms, sequence-of-events data, configuration exports, and authentication records. Snapshot engineering workstations only when forensically appropriate and coordinated with legal/IR.
- Patch in a controlled OT change window: validate the fixed package hash, back up configuration and logic, confirm protection settings are restored, test fail-safe behavior, monitor process variables after restart, and keep a vendor-approved rollback ready. Do not install unvetted firmware during high-risk grid or plant conditions.
- After remediation, prove closure: rescan reachable services, compare pre/post configuration, remove temporary firewall rules unless converted to permanent least-privilege policy, rotate credentials used during emergency access, and update the risk register, drawings, and incident response playbooks.
- If compromise is suspected, isolate operations safely rather than pulling power from an unstable unit. Engage OT-aware IR, notify the vendor, follow sector reporting obligations, and coordinate with CISA and your ISAC as required.
Executive Takeaways
- Treat HIPASE-250 and 250 SCALA as safety- and reliability-relevant assets; availability mistakes can carry physical consequences.
- Unknown exploitation status is not low risk; reduce reachability and verify versions now.
- Patch only through vendor-approved OT change control, with tested rollback and configuration restoration.
- Monitor the narrow set of high-value behaviors: engineering tool staging, unusual child processes, zone crossings, and service-account misuse.
Related Resources
Security Arsenal Red Team Services AlertMonitor Platform Book a SOC Assessment pen-testing Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.