PLC-Blaster
Software · ATTACK:ics:S1006
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:ics:S1006",
"title": "PLC-Blaster",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S1006",
"snapshot": "ics-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--4dcff507-5af8-47ce-964a-8d9569e9ccfe",
"external_id": "S1006",
"domain": "ics",
"created": "2019-03-26T15:02:14.907Z",
"modified": "2026-05-12T15:12:00.733Z",
"version": "1.1",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Spenneberg, Ralf 2016",
"url": "https://www.blackhat.com/docs/asia-16/materials/asia-16-Spenneberg-PLC-Blaster-A-Worm-Living-Solely-In-The-PLC.pdf"
},
{
"source_name": "Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016",
"url": "https://www.blackhat.com/docs/asia-16/materials/asia-16-Spenneberg-PLC-Blaster-A-Worm-Living-Solely-In-The-PLC-wp.pdf"
}
]
}Explicit source assertions (8)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:ics:S1006 → uses → ATTACK:ics:T0821
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--20f66fab-7a08-4707-ac79-92dac5acd11d
Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016ATTACK:ics:S1006 → uses → ATTACK:ics:T0834
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--21041206-da58-45c7-adb0-db07caebdcb6
Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016ATTACK:ics:S1006 → uses → ATTACK:ics:T0843
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--31897c41-1d47-4a34-b531-21c3f74651a8
Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016ATTACK:ics:S1006 → uses → ATTACK:ics:T0814
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--535c5160-17e0-44eb-9f4b-1a8e216b56a2
Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016ATTACK:ics:S1006 → uses → ATTACK:ics:T0835
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6fa3aee4-2a29-4c0f-9e61-1f7df5eccc00
Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016ATTACK:ics:S1006 → uses → ATTACK:ics:T0889
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9515f24c-1c33-4197-b9c9-b9992bc696ca
Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016ATTACK:ics:S1006 → uses → ATTACK:ics:T0858
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a4c81fe6-1ad9-4bba-a415-a3c099eaa2be
Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016ATTACK:ics:S1006 → uses → ATTACK:ics:T0846.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b9b45f7a-742f-4b72-bdee-577ceb539499
Spenneberg, Ralf, Maik Brggemann, and Hendrik Schwartke March 2016