US Fed warns of state hackers targeting industrial control systems

• Known as Pipedream, the malware toolkit is said to be the most versatile tool ever made to target industrial control systems like power grids and oil refineries
• The DOE, CISA, NSA, and the FBI are all urging critical infrastructure organizations, especially energy sector organizations, to implement the detection and mitigation recommendations provided to detect potential malicious APT activity and harden their ICS/SCADA devices

Industrial control systems (ICS) are essential for the steady functioning of critical infrastructures such as the energy and water grid or the manufacturing sector. Therefore, when an attack is launched on ICS, the consequences are often far-reaching, just like then a ransomware attack targeted Colonial Pipeline Inc. in the US mid-last year.

That attack brought the entire facility to a complete halt for a few days which then inevitably caused an acute fuel shortage, while prices soared through the roof. It is unfortunate though that threat actors are increasingly shifting their focus from information technology (IT) to what ICS is often referred to as operational technology (OT). 

This puts the critical industrial infrastructure owned by the state and private entities at high risk of destructive cyberattacks that can cause severe economic damage. Predictably, governments across the world can only urge private entities to toughen their critical infrastructure defenses—while taking steps to improve national cyberspace security.

Hence why in the US, the Department of Energy (DOE) alongside the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Federal Bureau of Investigation (FBI) released a joint Cybersecurity Advisory (CSA) yesterday to warn critical infrastructure owners of a tool developed by hackers to target ICS like power grids and oil refineries.

“DOE, CISA, NSA, and the FBI warn that certain advanced persistent threat (APT) actors have exhibited the capability to gain full system access to multiple ICS/supervisory control and data acquisition (SCADA) devices,” the statement reads. 

The tools, according to the officials, enable the threat actors to scan for, compromise, and control affected devices once they have established initial access to the OT network. “Additionally, the actors can compromise Windows-based engineering workstations, which may be present in information technology (IT) or OT environments, using an exploit that compromises an ASRock motherboard driver with known vulnerabilities,” they said.

By compromising and maintaining full system access to ICS/SCADA devices, DOE, CISA, NSA, and the FBI said APT actors could elevate privileges, move laterally within an OT environment, and disrupt critical devices or functions. Therefore, the CSA urges critical infrastructure organizations, especially energy sector organizations, to implement the detection and mitigation recommendations provided to detect potential malicious APT activity and harden their ICS/SCADA devices. 

Among the actions suggested include enforcing multi-factor authentication for all remote access to ICS networks and devices whenever possible; change all passwords to ICS/SCADA devices and systems on a consistent schedule, especially all default passwords, to device-unique strong passwords to mitigate password brute force attacks and to give defender monitoring systems opportunities to detect common attacks; and also leverage a properly installed continuous OT monitoring solution to log and alert on malicious indicators and behaviors. 

A rather shocking revelation from Kaspersky last year shows that around one in three ICS were targeted by malicious activity in the first half of 2021 (1H21), with spyware a growing threat. Of the 33.8% of ICS machines targeted in 1H21, internet-based threats dominated (18.2%), followed by those delivered via removable media (5.2%) and malicious email attachments (3%).

Although the total number attacked increased just 0.4% from the final six months of 2020, Kaspersky said the overall trend in recent years has been of surging threats to industrial systems, as IT and OT technologies increasingly converge.