Critical infrastructure organizations in the US are being targeted with custom-built malware, designed specifically for the hardware they use, security and law enforcement agencies in the country are warning.
The new warning was jointly published by the Department of Energy (DOE), the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Federal Bureau of Investigation (FBI).
In it, the agencies are warning of threat actors placing multiple industrial control systems (ICS) and supervisory control and data acquisition (SCADA) devices in their crosshairs - namely Schneider Electric programmable logic controllers (PLCs), OMRON Sysmac NEX PLCs, and Open Platform Communications Unified Architecture (OPC UA) servers (opens in new tab).
Share your thoughts on Cybersecurity and get a free copy of the Hacker's Manual 2022 (opens in new tab). Help us find how businesses are preparing for the post-Covid world and the implications of these activities on their cybersecurity plans. Enter your email at the end of this survey (opens in new tab) to get the bookazine, worth $10.99/£10.99.
Chernovite, the state-sponsored attacker
More precisely - Schneider Electric MODICON and MODICON Nano PLCs, including TM251, TM241, M258, M238, LMC058, and LMC078; and OMRON Sysmac NJ and NX PLCs, including NEX NX1P2, NX-SL3300, NX-ECC203, NJ501-1300, S8VK, and R88D-1SN10F-ECT, are being targeted.
Apparently, one of the threat actors is called CHERNOVITE, and this one is trying to deploy malware dubbed PIPEDREAM. Security researchers from cybersecurity firm Dragos have been tracking the ICS-specific malware for some time now, and discovered it initially targets Schneider Electric and Omron controllers. By taking advantage of the endpoints (opens in new tab)’ native functionality in operations, the malware is somewhat harder to spot.
Dragos CEO, Robert Lee, believes CHERNOVITE is a state-sponsored attacker.
A separate cybersecurity firm, Mandiant, has been tracking a different malware, called INCONTROLLER. This one, too, targets Schneider Electric tools, and is, too, created and operated by a state-sponsored attacker.
> How critical infrastructure can be protected from threats (opens in new tab)
> The cyber threat against critical infrastructure (opens in new tab)
> CISA urges critical infrastructure companies to strenghten cybersecurity (opens in new tab)
Although no countries were named, the publication does remind that the Ukrainian officials announced stopping an attack on an energy facility, recently.
Speaking to The Record, chief technology officer of ICS cybersecurity software firm aDolus Technology, said Schneider Electric MODICON PLCs and OPC Unified Architecture (OPC UA) servers (opens in new tab) are probably targeted because they’re extremely common in the industry.
The potential flaws that could be leveraged, could provide attackers with elevated privileges, lateral movement within an OT environment, and allow for critical devices or functions disruption, he added.
Via: The Record (opens in new tab)