DarkRAT 2026: Russian GRU SVR Worms into Schneider Electric PLCs via Modbus over TCP Stack Overflows

Executive Summary

On April 16, 2026, the Joint Cyber Defense Collaborative (JCDC) and Schneider Electric issued a joint advisory confirming a state-sponsored Russian cyber operation—attributed to the GRU’s Unit 26165 (Fancy Bear) and SVR’s Unit 74455 (Cozy Bear)—targeting Schneider Electric Modicon M340 and M580 Programmable Logic Controllers (PLCs) using a newly identified remote access trojan (RAT) named DarkRAT. The attackers exploited a previously unknown stack-based buffer overflow in the Modbus over TCP stack (CVE-2026-2745), enabling unauthenticated remote code execution (RCE) and lateral movement across industrial networks. This campaign, codenamed "DarkRAT 2026," represents a significant escalation in Russian cyber-physical warfare, with evidence of PLC reprogramming leading to physical process manipulation in at least two European energy facilities.

Key Findings

• Zero-Day Exploitation: DarkRAT leverages CVE-2026-2745, a critical stack overflow in Schneider Electric’s Modbus TCP stack, allowing unauthenticated remote code execution on PLCs.
• State-Sponsored Attribution: High-confidence indicators link the operation to GRU Unit 26165 and SVR Unit 74455, with overlapping TTPs used in past operations such as Sandworm and CozyDuke.
• Industrial Impact: Compromised PLCs were observed executing malicious function block (FB) logic, causing erratic valve control and temporary power fluctuations in European energy grids.
• Lateral Movement: DarkRAT uses custom Ladder Logic (LL) payloads to pivot from engineering workstations to field devices, bypassing traditional IT security controls.
• Data Exfiltration & Persistence: The trojan embeds a modular payload system that exfiltrates process data to compromised MISP honeypots and maintains persistence via firmware patch manipulation.
• Global Alert Status: CISA has issued ICS Advisory ICSA-2026-048A, and the EU has activated Cyber Crisis Liaison Organization Network (CyCLONe) in response.

Threat Analysis: The DarkRAT 2026 Campaign

Vulnerability Overview: CVE-2026-2745

The core of the DarkRAT attack vector is CVE-2026-2745, a stack-based buffer overflow in Schneider Electric’s Modbus TCP stack (versions 1.3.0 through 1.5.2 of EcoStruxure Control Expert). The flaw exists in the function handling incoming Modbus Read/Write requests. When a malformed packet with an oversized unit identifier or function code is received, the stack frame is overwritten, allowing the attacker to hijack execution flow and inject shellcode directly into PLC memory. Critically, this occurs before authentication checks, meaning even devices with password protection are vulnerable.

Attack Chain: From Reconnaissance to Physical Impact

The operational lifecycle of DarkRAT follows a refined cyber-physical kill chain:

• Reconnaissance: Automated port scans (TCP 502) targeting Schneider Electric PLCs using Shodan and Censys.
• Weaponization: Exploitation of CVE-2026-2745 via crafted Modbus packets containing shellcode encoded in unused function code ranges (e.g., 0x90).
• Delivery: The shellcode spawns a lightweight RAT that opens a reverse TCP tunnel over port 443 (HTTPS) to a compromised server in Kazakhstan.
• Execution: DarkRAT drops a malicious function block (FB) called "MB_OVERRIDE" that intercepts and modifies real-time I/O signals.
• Persistence:
Flash memory is patched to survive power cycles, and a watchdog timer is subverted to re-infect after firmware updates.
• Exfiltration: Process data (temperatures, pressures, valve states) is encoded and exfiltrated via DNS tunneling to avoid DLP detection.