Searching for the Nuclear Control Room

What an exposed Windows intrusion workbench reveals about SCADA, PLC and critical-infrastructure discovery.

An exposed staging service yielded 45 files spanning payload delivery, credential interception, host and network discovery, SMB access testing, reverse shells and targeted collection. The malware was interesting. The collection logic was more important.

Two recovered batch files were designed to locate operational-technology and critical-infrastructure information inside a Windows environment. They searched user documents, desktops, browser history, favourites, recent items, shortcuts, network shortcuts and mapped locations for terms associated with SCADA, PLCs, RTUs, Modbus, telemetry, substations and grid operations. They also searched for specific Pakistan energy and nuclear-sector names.

That changes the assessment. This was not simply a directory of offensive utilities. It was a workbench capable of turning Windows access into intelligence about industrial operations, and potentially into a route from enterprise IT toward OT-adjacent resources.

Infrastructure addresses, credentials and other operationally sensitive values are intentionally omitted.

Executive assessment

The exposed artefacts support four high-confidence findings:

1. The operator was looking for industrial-control information. The relevant terms appear in executable collection scripts, not in an analyst's notes or an unrelated word list.
2. The search crossed several layers of user activity. It covered stored files, browsing history, recent items, shortcuts, network shortcuts and mapped roots: what a user keeps, what they view and where they connect.
3. The surrounding toolchain could make the discoveries actionable. Credential interception, host enumeration, SMB testing, payload delivery and persistent outbound access appeared alongside the collection scripts.
4. Named energy and nuclear organisations are investigative leads, not confirmed victims. The artefacts establish collection intent and environmental context. They do not establish successful compromise, data theft, direct OT access or actor attribution.

Our assessment is that the workbench is consistent with hands-on activity against (or an emulation of) a Pakistan energy or nuclear Windows environment. A laboratory, authorised assessment or training scenario remains possible.

The two scripts that change the picture

contenthunt.bat: searching user-controlled storage

The first script used Windows text-search functionality against common user locations:

• the ELECTRICAL user's Documents folder;
• the same user's Desktop;
• the Public Desktop; and
• the user's Internet Explorer Favorites.

Its keyword set mixed industrial-control vocabulary with named sector context:

This combination is far more discriminating than a generic search for passwords, financial documents or VPN configurations. It seeks material that could describe industrial processes, field devices, communications protocols, power distribution and operator workflows.

The use of ordinary Windows locations also matters. Engineering diagrams, commissioning notes, maintenance spreadsheets, remote-access instructions and copied configuration fragments often live outside formal document-management systems. A desktop shortcut or an exported report may disclose more about an operational environment than a broad file-share scrape.

hunt88.bat: following the user's trail

The second script expanded the collection surface from files to user behaviour and connectivity. It examined:

• Internet Explorer and intranet history;
• the Chrome History database;
• Desktop shortcuts;
• Windows Recent items;
• Network Shortcuts;
• Internet Explorer Favorites; and
• mapped or otherwise known roots.

Its search terms included paec, nuclear, scada, telemetry, chashma, kanupp and karachi nuclear, alongside other abbreviated terms.

That design can reveal:

• intranet portals used by engineering or operations teams;
• URLs for historian, monitoring or remote-access systems;
• file shares containing drawings, telemetry exports or maintenance records;
• jump hosts and administrative workstations exposed through shortcuts;
• frequently opened procedures and reports; and
• naming conventions that help an operator map an unfamiliar environment.

The two scripts therefore answer complementary questions. contenthunt.bat asks, "What critical-infrastructure material is stored here?" hunt88.bat asks, "What critical-infrastructure resources does this user reach?"

Named organisations and environmental clues

Several names in the artefacts warrant careful treatment.

OGDCL: the strongest named environment clue

Three executable Inveigh launch scripts set the Windows domain values to OGDCL and ogdcl.local; one of them also sets the computer name and logon server to OGDCL. This is the strongest named context because it appears as runtime configuration inside credential-interception scripts rather than only as a search term.

That still does not prove that Oil & Gas Development Company Limited was compromised. The values could have been copied from an engagement, constructed for a lab, or used in a simulation. They do, however, justify prioritising OGDCL-related telemetry and exposure checks if the organisation or a trusted partner can investigate lawfully.

Nuclear-sector collection terms

The search logic explicitly included PAEC, Chashma, KANUPP / Kanupp and Karachi nuclear.

These correspond to Pakistan Atomic Energy Commission and nuclear-power context associated with Chashma and Karachi. Their presence is evidence of collection targeting, not evidence that any nuclear operator was accessed.

Electricity-sector collection terms

The script also searched for NTDC and WAPDA.

Combined with substation, grid and feeder, these terms show interest in power transmission and distribution context. Again, the artefacts do not show that National Transmission & Despatch Company or Pakistan Water and Power Development Authority systems were compromised.

ELECTRICAL is a profile label, not a company

The collection paths reference a Windows user profile named ELECTRICAL. This may be a role account, a lab persona or a real workstation user. It should be treated as an environmental clue, not as an organisation or attribution marker.

Reconstructing the operator workflow

The directory is best understood as a sequence of capabilities rather than a set of isolated files.

1. Deliver tooling

The artefacts included download logic with multiple Windows-native transfer options. Redundant delivery methods reduce dependency on a single binary or security control and allow the operator to stage scripts and payloads quickly.

2. Obtain or provoke Windows authentication

Inveigh-related material was configured to use local name-resolution and authentication behaviour. In a susceptible network, this can capture or relay Windows authentication attempts produced when users or systems resolve names and access resources.

3. Map the Windows environment

Reconnaissance scripts enumerated hosts, routes, sessions, shares and other internal context. The goal is not merely to identify machines; it is to discover trust relationships, administrative paths and where valuable data is likely to reside.

4. Search for CI and OT intelligence

The two collection scripts then searched both content and user traces for SCADA, PLC, RTU, Modbus, telemetry, substation, grid, feeder and named-sector terms. This is the point at which general Windows access becomes sector-specific intelligence gathering.

5. Test access and preserve reachability

SMB tests and reverse-shell material provided ways to validate credentials, reach administrative shares and maintain an outbound channel. Their presence does not prove execution, but it shows how discoveries and captured credentials could be operationalised.

Why the IT-to-OT boundary is the real issue

There is no evidence in the recovered material of commands being sent directly to a PLC, an engineering project being modified or a safety system being manipulated. That distinction matters.

But direct controller access is not required for an intrusion to become operationally significant. Windows systems around OT commonly hold or expose:

• engineering workstation shortcuts and remote desktop targets;
• human-machine interface and historian URLs;
• PLC project backups and configuration exports;
• network diagrams, IP plans and asset inventories;
• substation, feeder and telemetry reports;
• vendor documentation and maintenance procedures;
• VPN instructions, shared credentials and support contacts; and
• mapped drives bridging enterprise, engineering and contractor workflows.

Collecting this material can reduce the cost of a later intrusion. It tells an operator which systems matter, how engineers reach them, what protocols and vendors may be present, and which users or shares are worth targeting. It can also support extortion, espionage or disruption without any immediate PLC interaction.

The exposed workbench therefore represents pre-positioning and discovery risk. The most defensible conclusion is not that an OT environment was compromised, but that the operator had assembled a workflow for finding the information needed to approach one.

What is observed, assessed and unknown

Observed

• A 45-file staging collection.
• Two batch files performing CI- and OT-focused searches.
• Direct search terms covering SCADA, PLC, RTU, Modbus, telemetry, substations, grid operations and named Pakistan energy/nuclear context.
• Collection across files, browser history, recent items, favourites, shortcuts, network shortcuts and mapped roots.
• Inveigh launch material configured with OGDCL domain values.
• Reconnaissance, delivery, SMB-testing and reverse-access capabilities.

Assessed

• The operator intended to identify critical-infrastructure and OT-adjacent information after reaching a Windows environment.
• The toolchain could support movement from enterprise access toward engineering resources if network architecture and credentials permitted it.
• The named context is consistent with a Pakistan energy or nuclear environment, whether real, simulated or authorised.

Not established

• Initial-access mechanism.
• Successful execution of every exposed file.
• Compromise of any named organisation.
• Theft of documents or credentials.
• Access to an engineering workstation, historian, HMI, PLC or safety system.
• PLC command execution or physical-process impact.
• A definitive malware family or actor attribution.

Detection and hunting guidance

Hunt for the search behaviour

Look for command interpreters or batch files invoking findstr or equivalent tools across multiple user locations while combining industrial-control and power-sector vocabulary. Particularly distinctive combinations include:

• SCADA with PLC, RTU or Modbus;
• telemetry with substation, grid or feeder; and
• OT terms paired with nuclear or named energy-sector references.

Searching browser databases, Recent items and shortcut folders in the same session should raise the priority of the event.

Correlate collection with credential activity

Alert on Inveigh or comparable poisoning/capture frameworks, unusual LLMNR/NBNS/mDNS activity and bursts of SMB authentication to multiple internal systems. A single signal may be noisy; the combination of credential capture, share discovery and OT-focused collection is not.

Monitor user-trace repositories

Useful telemetry includes access to:

• Chrome History databases by non-browser processes;
• Internet Explorer or legacy intranet history stores;
• Windows Recent and Favorites directories;
• Network Shortcuts and desktop .lnk files; and
• mapped-drive inventories or broad recursive searches across known roots.

Protect the bridge systems

Prioritise monitoring and hardening for systems that connect business and engineering workflows: jump hosts, file-transfer stations, historian front ends, remote-access gateways, engineering document repositories and contractor support systems. These systems often reveal the route to OT before an adversary ever scans an industrial protocol.

Validate the named context without assuming compromise

For organisations connected to the recovered names, useful defensive checks include:

• searches for the exact collection filenames and command patterns;
• review of endpoint process creation involving findstr, browser databases and shortcut directories;
• authentication anomalies involving LLMNR/NBNS or unexpected SMB targets;
• access to engineering shares by unusual users or workstations; and
• outbound connections from administrative or engineering systems following recon activity.

ATT&CK-informed interpretation

The exposed artefacts are consistent with several MITRE ATT&CK behaviours, including:

ATT&CK mappings describe behaviour, not attribution. The industrial terms add sector relevance, but they do not by themselves identify a known threat group.

Analytical caveats

This assessment is based on an exposed file collection and the content of recovered scripts. A staging directory can combine material from different dates, operators, engagements or experiments. Timestamps can be copied or altered. Tools may never have executed. Configuration values may represent a target, a previous environment or a lab.

For those reasons, the scripts support a strong conclusion about capability and collection intent, but only a cautious conclusion about victimology and operational success.

Conclusion

The important story is not that another offensive toolkit was left online. It is that the toolkit contained a deliberate method for finding the control-room context hidden inside ordinary Windows activity.

One script searched what the user stored. Another searched what the user opened and where they connected. Around them sat the means to acquire authentication, map internal systems, test SMB access and maintain a remote channel. Taken together, the artefacts show how an intrusion can move from generic enterprise access toward a much more consequential objective: understanding the systems, people and paths surrounding industrial operations.

No named company can yet be called compromised. But defenders in energy, nuclear and industrial environments should treat this combination of credential interception, Windows discovery and OT-focused collection as a high-signal pattern worth hunting now.

References

• MITRE ATT&CK: Windows Command Shell
• MITRE ATT&CK: Ingress Tool Transfer
• MITRE ATT&CK: LLMNR/NBT-NS Poisoning and SMB Relay
• MITRE ATT&CK: Network Share Discovery
• MITRE ATT&CK: Browser Information Discovery
• Pakistan Atomic Energy Commission: Nuclear Power
• Oil & Gas Development Company Limited
• Pakistan Water and Power Development Authority