A threat actor known as the Infrastructure Destruction Squad has commercialized and leaked the source code for TRK25 ADVANCED SCADA, a PyQt5-based tool that targets industrial control systems, remote management ports, and Modbus-enabled machinery.
Asynchronous TCP port sweeps (Ports 502, 5900, 3389, 22)
Banner grabbing and SCADA priority point scoring (Siemens S7, Modbus)
Credential stuffing with default wordlists and unauthenticated Modbus access
JSON metadata generation, HMI screenshot capture, and Base64 exfiltration
IDS advertises TRK25 Advanced SCADA tool on Telegram and PWN Forums for USD 500.
Full source code of the tool is leaked online publicly.
Ransom-ISAC and Forescout Vedere Labs publish analyzed PyQt5 threat intelligence.
KELA publishes comprehensive profile tracking IDS / Dark Engine operations.
If your team may be exposed to a similar threat, FemtoSec can help validate blast radius, prioritize remediation, and connect the issue to a practical security program.
June 23, 2026
A technical breakdown of the KNET DDoS malware, an emerging Rust-based tool that abuses public platforms like Pastebin for stealthy C2 communication and features configurable CPU-based attack power. Learn how to detect and contain this threat.
June 20, 2026
An analysis of the Asacube Android banking botnet, covering its core malicious capabilities including credential theft, SMS interception, and mobile asset compromise.
The alleged sale of the Stealc_v2 information-stealing malware source code on the exploit.in forum introduces major corporate security challenges. Featuring a PHP administration panel, customizable builders, and Telegram bot integrations, this leak enables rapid deployment of stealthy credential-harvesting campaigns.
A threat actor operating under the Infrastructure Destruction Squad moniker has announced the commercial sale and subsequent source code leak of TRK25 ADVANCED SCADA, a malicious Python-based hacking tool designed to compromise critical infrastructure and industrial control networks. Moving away from highly sophisticated zero-day exploits, this utility focuses on automated scanning, protocol enumeration, and credential-stuffing to compromise exposed remote access management portals and operational technology devices. Because this malware has been made widely available, organizations operating critical infrastructure must immediately assess their exposure to avoid unauthorized perimeter access and subsequent command execution on physical assets.
To evaluate whether your enterprise assets or administrative credentials have already been compromised and exposed in underground forums, you can use the FemtoSec Dark Web Scanner for an immediate exposure assessment. Proactive monitoring is essential to intercepting credentials before they are ingested by automated cracking tools like TRK25-ADVANCED.
Once a target is selected, the utility attempts to capture physical evidence of the system status. If a VNC or RDP session is accessible without strong authentication, the malware utilizes an automated screen capture function. This module takes high-resolution screenshots of the active Human-Machine Interface displays or control console screens. These visual captures provide immediate operational intelligence to the threat actor, showing pipeline pressure indicators, electricity distribution schematics, or water treatment configurations without requiring deep manual exploration.
To defend against TRK25-ADVANCED, security teams must understand the exact operational steps the tool performs during a targeting cycle. The attack flow moves rapidly from broad external reconnaissance to targeted data extraction.
If you require immediate assistance in securing your operational technology environment or evaluating your organization's perimeter security posture, please contact the specialists at FemtoSec for a comprehensive threat briefing and consultation by visiting our Contact Page.
The TRK25-ADVANCED tool represents the next stage in the democratization of operational technology targeting software. Developed using Python and featuring a graphical user interface powered by PyQt5, the tool is the direct successor to a legacy utility known as Kurtlar_SCADA. While its predecessor focused heavily on simple VNC scanning, TRK25-ADVANCED introduces a multi-protocol modular architecture that combines asset discovery, risk scoring, credential stuffing, and automated metadata exfiltration into a single executable wrapper.
Security researchers analyzing the leaked source code have identified several critical functions that demonstrate the utility's automated approach. The tool relies on a built-in network prober that targets a range of industrial and remote administration protocols. It specifically checks for active endpoints running Modbus TCP on TCP port 502, Virtual Network Computing on TCP port 5900, Remote Desktop Protocol on TCP port 3389, and Secure Shell on TCP port 22. By scanning entire IP subnets, the malware operator can identify exposed devices across vast geographical IP blocks without executing complex custom payloads on each target.
A central feature of the TRK25-ADVANCED malware is its automated evaluation and point attribution system. Rather than treating all active hosts equally, the software parses connection headers and banner information to classify the victim network. The utility uses a hardcoded prioritization index, assigning high-priority scores to specific industrial hardware. A discovered Siemens S7 controller receives a score of 95 points, general SCADA networks receive 90 points, and generic Modbus-enabled systems are assigned 80 points. This scoring model allows the attacker to quickly filter hundreds of active connections to focus on the most valuable physical infrastructure targets.
The attacker inputs specific IP subnets or relies on hardcoded target blocks pre-configured in the script. The tool begins executing asynchronous TCP port checks against the defined target ranges. It specifically probes ports 502, 5900, 3389, and 22 to locate open gates into both the IT and OT environments.
For every host that returns an open port status, the malware performs banner grabbing. It reads the service banners to identify system software versions, PLC models, and manufacturing details. This data is fed into the internal scoring engine, instantly categorizing systems by physical operational value and highlighting Siemens and other key industrial SCADA devices.
With high-value targets flagged, the malware initiates its automated exploitation class. Rather than leveraging expensive zero-day vulnerability chains, it exploits weak configuration hygiene. The malware brute-forces administrative ports using a hardcoded wordlist containing default system passwords such as admin, root, scada, plc, hmi, control, and operator. For Modbus TCP connections, which lack native authentication capabilities by design, the tool establishes direct control sessions immediately.
Once access is achieved, the exfiltration package class is triggered. The tool aggregates the host IP address, geographic location, active services, priority score, and captured HMI screenshots into a structured JSON file. It then applies Base64 encoding to this JSON payload and transmits it back to the threat actor's command and control infrastructure, which is often coordinated through dedicated communication channels run by the Infrastructure Destruction Squad.
The threat presented by TRK25-ADVANCED is not merely theoretical, it has direct implications for corporate risk and physical safety. By acting as an initial access broker tool, it lowers the barrier to entry for novice attackers, allowing them to locate and compromise unsecured industrial nodes. Once a connection is established and the login credentials are exfiltrated, the access is often sold to more sophisticated ransomware groups or state-sponsored advanced persistent threat units.
The downstream consequences of an intruder gaining control over an HMI or PLC can be catastrophic. Attackers can write unauthorized register values directly to Modbus controllers, altering chemical mixtures, disrupting electrical distribution grids, or forcing emergency shutdowns. Furthermore, once an attacker has established a foothold on an internet-exposed remote management host, they can pivot laterally into the corporate network to deploy destructive wiper payloads or execute large-scale enterprise ransomware campaigns.
To counter these perimeter exposures, organizations must implement comprehensive security assessments. Engaging in regular Penetration Testing helps identify hidden network paths that bridge corporate IT environments with sensitive operational technology fields. Additionally, organizations must establish persistent Attack Surface Management to ensure that remote management portals are never left directly exposed to the public internet.
Detecting scanning and intrusion attempts associated with TRK25-ADVANCED requires a combination of network monitoring and centralized log analysis. Because the tool relies on rapid, automated connections, its behavior is highly visible to properly configured network sensors.
To detect potential TRK25-ADVANCED Modbus scanning activity, security administrators should deploy the following Suricata network detection rule:
alert tcp $EXTERNAL_NET any -> $HOME_NET 502 (msg:"MALICIOUS SCADA - TRK25-ADVANCED Modbus TCP Scan Attempt"; flow:to_server,established; content:"|00 00 00 00 00 06|"; depth:6; reference:url,ransom-isac.com; classtype:bad-unknown; sid:1000001; rev:1;)In addition to network-level rules, security teams utilizing Microsoft Sentinel can implement the following Kusto Query Language query to flag internal hosts performing rapid remote administration sweeps paired with repeated authentication failures:
let OT_Ports = dynamic([502, 5900, 3389, 22]);
let WeakUsers = dynamic(['admin', 'root', 'scada', 'operator', 'plc', 'hmi']);
DeviceNetworkEvents
| where RemotePort in (OT_Ports)
| summarize PortConnCount = dcount(RemoteIP) by InitiatingProcessAccountName, InitiatingProcessFileName, DeviceName, RemotePort, bin(TimeGenerated, 5m)
| where PortConnCount > 10
| join kind=inner (
DeviceLogonEvents
| where LogonType == "Network" and ActionType == "LogonFailed"
| where AccountName in (WeakUsers)
) on DeviceName
| project TimeGenerated, DeviceName, InitiatingProcessFileName, RemotePort, AccountName, PortConnCountMitigating the threat of TRK25-ADVANCED and preventing unauthorized industrial systems access requires a proactive, multi-layered defensive posture. Organizations must focus on reducing their external visibility and securing authentication pathways.
Eliminate Internet-Facing Remote Access: Disable all direct, unencrypted internet access to VNC, RDP, and SSH interfaces. All remote maintenance connections should go through an enterprise-grade secure remote access gateway that mandates multi-factor authentication and posture validation.
Network Segmentation and Purdue Model Alignment: Enforce strict physical and logical network separation between the corporate IT infrastructure and the operational technology network. Ensure that industrial protocols, such as Modbus TCP, are completely restricted to isolated OT zones and cannot traverse boundaries directly.
Remediate Default Credentials: Execute a comprehensive credential audit across all programmable logic controllers, human-machine interfaces, and remote terminal units. Replace all factory-set administrative logins with unique, cryptographically robust passwords.
Conduct Regular Security Audits: Keep abreast of vulnerabilities by conducting structured Vulnerability Assessments to spot exposure points before they can be leveraged by automated utility tools.