Skip to main content

Cyberattacks against energy and utilities firms begin inside enterprise IT networks

Audio player loading…

New research from Vectra has revealed that while industrial control systems are being targeted by hackers, most cyberattacks against energy and utilities firms occur inside enterprise IT networks.

The research was published in the firm's 2018 Spotlight on Energy and Utilities highlighting the importance of detecting hidden threat behaviours inside enterprise IT networks before attackers have a chance to spy, spread and steal. These threat behaviours also show that carefully orchestrated attack campaigns generally occur over many months.

Cybercriminals have been launching carefully orchestrated attack campaigns against energy and utilities networks for years. These quiet reconnaissance missions often last several months and involve observing operator behaviours and building a unique plan of attack.

Gaining access to the network

American Municipal Power's CIO, Branndon Kelley offered further insight on how attackers target industrial control systems, saying:

“When attackers move laterally inside a network, it exposes a larger attack surface that increases the risk of data acquisition and exfiltration. It’s imperative to monitor all network traffic to detect these and other attacker behaviors early and consistently.” 

Remote attackers are able to gain a foothold in energy and utilities networks by staging malware and spear-phishing campaigns to steal administrative credentials. Once inside, they utilise administrative connections and protocols to carry out reconnaissance and spread laterally searching for confidential data about industrial control systems.

Managing Research Director of Enterprise Management Associates, David Monaham explained how misuse of administrative credentials is a serious threat that businesses need to be more aware of, saying:

“The covert abuse of administrative credentials provides attackers with unconstrained access to critical infrastructure systems and data. This is one of the most crucial risk areas in the cyberattack lifecycle.” 

After getting his start at ITProPortal while living in South Korea, Anthony now writes about cybersecurity, web hosting, cloud services, VPNs and software for TechRadar Pro. In addition to writing the news, he also edits and uploads reviews and features and tests numerous VPNs from his home in Houston, Texas. Recently, Anthony has taken a closer look at standing desks, office chairs and all sorts of other work from home essentials. When not working, you can find him tinkering with PCs and game consoles, managing cables and upgrading his smart home.