OT Software Filename Masquerade

Malware distributed with filenames that mimic legitimate industrial-control-system (ICS) engineering software, programmable-logic-controller (PLC) programming tools, or operational-technology (OT) utilities. Targets engineers and technicians who routinely download and run specialized software from vendor portals, torrents, or peer-sharing networks.

Observed Patterns

• cx-programmer 9.1 free download full.exe — masquerades as OMRON CX-Programmer, a PLC programming suite for Sysmac and CP-series controllers.
• RSLogix 5000 crack.exe — Rockwell Automation / Allen-Bradley ladder-logic IDE.
• TIA Portal V17.exe — Siemens Totally Integrated Automation portal.
• WinCC flexible.exe — Siemens HMI configuration software.
• Schneider Electric SoMachine.exe — Modicon / EcoStruxure machine builder.
• FactoryTalk View Studio.exe — Rockwell HMI / SCADA development tool.

Why It Works

• OT/ICS software is expensive, version-locked, and often distributed via non-standard channels (torrents, forum attachments, cracked repacks).
• Technicians frequently run installers with elevated privileges on engineering workstations that have direct access to PLCs, HMIs, and SCADA networks.
• The filename matches expected search terms, lowering suspicion compared to generic business-document lures.

Detection / Fingerprint

• Filenames containing PLC/SCADA vendor names (OMRON, Siemens, Rockwell, Schneider, Mitsubishi, Delta, Beckhoff) combined with "free", "crack", "full", "download", or version numbers.
• Unsigned or self-signed PEs with large .rsrc icon suites mimicking the vendor's branding.
• Downloads from non-vendor domains (paste sites, IPFS, file-sharing forums) rather than authenticated vendor portals.

Cross-References

• social-engineering-filename-lure — generic business-document filename lures (invoice, PO, shipping).
• double-extension-masquerade — hides .exe behind a document extension.
• unclassified-go-pe64 — Go PE64+ cluster observed using this lure.

Pages Where Observed

• /intel/analyses/31f5df22bbc18d0068ae3ca520e06a7826695718f5a3796dd1df450dfdf5f2e2.html — cx-programmer 9.1 free download full.exe