US government warns specialized malware is targeting energy plants

Magnifying glass enlarging the word 'malware' in computer machine code
(Image credit: Shutterstock)

Critical infrastructure organizations in the US are being targeted with custom-built malware, designed specifically for the hardware they use, security and law enforcement agencies in the country are warning.

The new warning was jointly published by the Department of Energy (DOE), the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Federal Bureau of Investigation (FBI).

In it, the agencies are warning of threat actors placing multiple industrial control systems (ICS) and supervisory control and data acquisition (SCADA) devices in their crosshairs - namely Schneider Electric programmable logic controllers (PLCs), OMRON Sysmac NEX PLCs, and Open Platform Communications Unified Architecture (OPC UA) servers.

Share your thoughts on Cybersecurity and get a free copy of the Hacker's Manual 2022end of this survey

Share your thoughts on Cybersecurity and get a free copy of the Hacker's Manual 2022. Help us find how businesses are preparing for the post-Covid world and the implications of these activities on their cybersecurity plans. Enter your email at the end of this survey to get the bookazine, worth $10.99/£10.99.

Chernovite, the state-sponsored attacker

More precisely - Schneider Electric MODICON and MODICON Nano PLCs, including TM251, TM241, M258, M238, LMC058, and LMC078; and OMRON Sysmac NJ and NX PLCs, including NEX NX1P2, NX-SL3300, NX-ECC203, NJ501-1300, S8VK, and R88D-1SN10F-ECT, are being targeted.

Apparently, one of the threat actors is called CHERNOVITE, and this one is trying to deploy malware dubbed PIPEDREAM. Security researchers from cybersecurity firm Dragos have been tracking the ICS-specific malware for some time now, and discovered it initially targets Schneider Electric and Omron controllers. By taking advantage of the endpoints’ native functionality in operations, the malware is somewhat harder to spot.

Dragos CEO, Robert Lee, believes CHERNOVITE is a state-sponsored attacker. 

A separate cybersecurity firm, Mandiant, has been tracking a different malware, called INCONTROLLER. This one, too, targets Schneider Electric tools, and is, too, created and operated by a state-sponsored attacker. 

Although no countries were named, the publication does remind that the Ukrainian officials announced stopping an attack on an energy facility, recently.

Speaking to The Record, chief technology officer of ICS cybersecurity software firm aDolus Technology, said Schneider Electric MODICON PLCs and OPC Unified Architecture (OPC UA) servers are probably targeted because they’re extremely common in the industry.

The potential flaws that could be leveraged, could provide attackers with elevated privileges, lateral movement within an OT environment, and allow for critical devices or functions disruption, he added.

Via: The Record

Sead Fadilpašić

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.