US government warns specialized malware is targeting energy plants
Multiple threat actors, multiple custom-built malware
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Critical infrastructure organizations in the US are being targeted with custom-builtmalware, designed specifically for the hardware they use, security and law enforcement agencies in the country are warning.
The new warning was jointly published by the Department of Energy (DOE), the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Federal Bureau of Investigation (FBI).
In it, the agencies are warning of threat actors placing multiple industrial control systems (ICS) and supervisory control and data acquisition (SCADA) devices in their crosshairs - namely Schneider Electric programmable logic controllers (PLCs), OMRON Sysmac NEX PLCs, and Open Platform Communications Unified Architecture (OPC UA)servers.
Share your thoughts on Cybersecurity and get a free copy of the Hacker’s Manual 2022. Help us find how businesses are preparing for the post-Covid world and the implications of these activities on their cybersecurity plans. Enter your email at theend of this surveyto get the bookazine, worth $10.99/£10.99.
Chernovite, the state-sponsored attacker
More precisely - Schneider Electric MODICON and MODICON Nano PLCs, including TM251, TM241, M258, M238, LMC058, and LMC078; and OMRON Sysmac NJ and NX PLCs, including NEX NX1P2, NX-SL3300, NX-ECC203, NJ501-1300, S8VK, and R88D-1SN10F-ECT, are being targeted.
Apparently, one of the threat actors is called CHERNOVITE, and this one is trying to deploy malware dubbed PIPEDREAM. Security researchers from cybersecurity firm Dragos have been tracking the ICS-specific malware for some time now, and discovered it initially targets Schneider Electric and Omron controllers. By taking advantage of theendpoints’ native functionality in operations, the malware is somewhat harder to spot.
Dragos CEO, Robert Lee, believes CHERNOVITE is a state-sponsored attacker.
A separate cybersecurity firm, Mandiant, has been tracking a different malware, called INCONTROLLER. This one, too, targets Schneider Electric tools, and is, too, created and operated by a state-sponsored attacker.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
How critical infrastructure can be protected from threats>The cyber threat against critical infrastructure>CISA urges critical infrastructure companies to strenghten cybersecurity
Although no countries were named, the publication does remind that the Ukrainian officials announced stopping an attack on an energy facility, recently.
Speaking toThe Record, chief technology officer of ICS cybersecurity software firm aDolus Technology, said Schneider Electric MODICON PLCs and OPC Unified Architecture (OPC UA)serversare probably targeted because they’re extremely common in the industry.
The potential flaws that could be leveraged, could provide attackers with elevated privileges, lateral movement within an OT environment, and allow for critical devices or functions disruption, he added.
Via:The Record
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
This new phishing strategy utilizes GitHub comments to distribute malware
Should your VPN always be on?
Phishing attacks surge in 2024 as cybercriminals adopt AI tools and multi-channel tactics
