Researchers at Positive Technologies identified a new ICS-focused malware dubbed S7Flip on the MalwareBazaar platform. The malware targets industrial control systems by manipulating PLC data via S7Comm and Modbus TCP protocols. It scans local networks for specific ports, including 102 for Siemens controllers, 502 for Modbus TCP, and 44818 for Allen-Bradley devices, though the latter connection attempt is non-functional.
S7Flip employs two destructive mechanisms: it either modifies random integer values in data blocks or toggles bits within specific memory ranges. Changes are logged in a CSV file. The malware persists in Windows via autostart under the name aphp.exe. Analysts identified two versions of the malware, differing in how the libmodbus library is linked—dynamically or statically.
The same source also uploaded a wiper malware disguised as a Microsoft Edge installer. This tool deletes files on the desktop and creates a ransom note demanding $100 in Bitcoin. The payment address provided belongs to the Bitcoin.org donation wallet. A later version, Edgev5.exe, introduced AES-256-GCM encryption and expanded the target directories to include Downloads and Documents.
Experts noted technical similarities between the S7Flip samples and the wiper tools, including the use of the GCC 16.2.0 toolchain and identical compilation timestamps dated September 13, 2026. All files were uploaded to the repository by a user under the alias jeans. While these indicators suggest a potential common origin, researchers state that a definitive link between the ICS malware and the wiper remains unconfirmed.
