Sharp7Extend Malware — Analysis, Campaigns & Threat Activity

Threat entity extracted from intelligence sources

Frequency
6
occurrences
First Seen
November 7, 2025
Last Seen
November 12, 2025

Sharp7Extend is a malware family observed in recent reporting that targets industrial control systems by abusing compromised NuGet packages (industrial .NET extensions) to silently sabotage PLCs and safety systems.

Overview

Sharp7Extend is a malware family observed in recent reporting that targets industrial control systems by abusing compromised NuGet packages (industrial .NET extensions) to silently sabotage PLCs and safety systems. It employs time-based destructive logic, with activation windows reportedly set for 2027 and 2028, underscoring a dangerous supply-chain/OT risk to industrial environments.

Related Threat Clusters

  • Malicious NuGet Packages Embed Time-Delayed Sabotage Code

    Researchers identified nine malicious NuGet packages containing time-delayed sabotage routines targeting .NET applications and industrial control systems. The packages, downloaded nearly 9,500 times, include…

    4 articles · Updated November 7, 2025
  • Malicious npm Packages Use Adspect Cloaking in Crypto Scam

    A malware campaign has been identified that utilizes malicious npm packages to create fake websites designed to identify and exploit potential victims. The threat actor, known as 'dino_reborn', published these packages…

    13 articles · Updated November 18, 2025
  • Malicious NuGet Packages Set to Activate Time Bombs in 2027 and 2028

    Nine malicious NuGet packages, published by the user 'shanhai666', were identified to contain time-delayed sabotage payloads targeting industrial control systems and applications. These packages, which have been…

    7 articles · Updated November 12, 2025

Recent Intelligence Reports

  • Socket researchers uncover NuGet packages that silently sabotage industrial PLCs, safety ... — Industrialcyber.Co · November 12, 2025
  • Socket flags malicious NuGet packages set to activate in 2027 and 2028 — Cryptorank · November 8, 2025
  • Malicious NuGet Packages Hide Time — Esecurityplanet · November 7, 2025
  • Malicious NuGet packages drop disruptive 'time bombs' — Bleepingcomputer · November 7, 2025
  • Cybercrims plant destructive time bomb malware in industrial .NET extensions — Theregister · November 7, 2025
  • Cybercrims plant destructive time bomb malware in industrial .NET extensions — Theregister · November 7, 2025

CVSS v3.1 Breakdown