Historical intelligence backfill. This assessment covers reporting originally published on 2026-08-06 and was added to the RWP archive on 2026-09-07.
Firmware walk-off through the programming interface — Nozomi's PLC extraction note is a trust-boundary problem
August 2026 Labs post — legitimate PLC programs used as the extraction tool, no chip-off, no JTAG. If engineering access exists, treat firmware confidentiality as already lost.
Bottom line up front
CONFIRMED Nozomi Networks Labs published (announced 6 August 2026) that firmware can be pulled from industrial controllers by abusing the controller's own programming interface and legitimate native-code execution — not by desoldering flash. That collapses the usual "we would need physical access" objection. It is a research demonstration of a class of techniques, not a named-in-the-wild campaign. ScienceDirect's later forensic survey covers hardware-port extraction as a parallel path; it does not replace Nozomi's software-path finding. Process manipulation: UNKNOWN. Intellectual-property and vuln-research impact: CONFIRMED as the point of the paper. Pair with the CODESYS and PLCnext posts in this batch — those are how you get the access this technique then uses.
Historical backfill of 6 August 2026 reporting; added 7 September 2026.
What happened
Labs showed that a program the PLC is willing to run can read firmware off the device. No specialized programmer required once you can load logic.
Why it mattered
Secret keys, hardcoded creds, and unpublished bugs live in firmware images. If the engineering path can walk them off, signing and "encrypted firmware" marketing need a second look.
Who / what was affected
Controllers where native user programs can touch firmware storage. Exact SKUs are in Nozomi's post — do not generalize to every IEC 61131 runtime.
Technical context
Control who can download projects. Treat engineering workstations as crown jewels (see AutomationDirect Productivity Suite in this archive). Monitor unusual program downloads.
Exploitation / threat status at the time
CONFIRMED research technique.
UNKNOWN opportunistic use in ransomware or state ops.
What defenders should have done
- Restrict who can put programs on PLCs.
- Assume stolen firmware if a workstation was phished.
- Vendor questions: can user logic read firmware regions?
RWP assessment
Confidence: High as a Labs methods result. Do not brief it as FrostyGoop-2.
Defensive actions
- Engineering-path logging.
- Network isolation of programming ports.
- Incident playbook: workstation compromise → firmware inventory as stolen.
Sources
- Nozomi Networks — PLC firmware extraction through native code execution
- Nozomi Networks — X announcement of the firmware-extraction blog
- ScienceDirect — Systematic firmware extraction for industrial embedded devices