Ransomware attacks are now targeting industrial control systems

guest · Feb 4, 2020

Ransomware attacks are now targeting industrial control systems
..."deeply concerning evolution" in malware
February 4, 2020
https://www.zdnet.com/article/ransomware-attacks-are-now-targeting-industrial-control-systems/

Cyber criminals are launching ransomware attacks that are specifically targeting industrial control systems (ICS) in what researchers say is the first instance of file-encrypting malware being built to directly infect computer networks that control operations in manufacturing and utilities environments.

A new threat report from cybersecurity company Dragos details the characteristics of the ransomware known as Ekans. This ransomware – also known as Snake – first emerged in December 2019 and has been designed for use against Windows systems used in industrial environments.
The way in which Ekans is designed to target ICS operations indicates that the attackers very much have a specific target in mind, so are likely to take their time to compromise targets relevant to their plans.

"The ICS-specific nature of the targeted processes indicates an evolving brazenness," Joe Slowik, principal adversary hunter at Dragos, told ZDNet.
Click to expand...

Dragos: EKANS Ransomware and ICS Operations

guest · Feb 4, 2020

New Snake Ransomware Targets ICS Processes
January 28, 2020
https://www.securityweek.com/new-snake-ransomware-targets-ics-processes

Written in the Golang programming language and dubbed Snake, the ransomware has been used in targeted campaigns aimed at enterprises. According to SentinelLabs, which has seen attacks involving Snake for the past month, files encrypted by this ransomware are difficult or impossible to recover without paying the ransom demanded by the attackers.

“The potential damage of a Snake attack is significant,” says Dor Yardeni, head of incident response and threat Hunting at OTORIO. “Deleting or locking targeted ICS processes would prohibit manufacturing teams from accessing vital production-related processes, including analytics, configuration and control. This is the equivalent of both blindfolding a driver and then taking away the steering wheel".
Click to expand...

SentinelLabs: New Snake Ransomware Adds Itself to the Increasing Collection of Golang Crimeware

guest · Feb 19, 2020

US natural gas operator shuts down for 2 days after being infected by ransomware
Infection spread to site's OT network that monitors and controls physical processes
February 19, 2020
https://arstechnica.com/information...huts-down-us-natural-gas-operator-for-2-days/

A US-based natural gas facility shut down operations for two days after sustaining a ransomware infection that prevented personnel from receiving crucial real-time operational data from control and communication equipment, the Department of Homeland Security said on Tuesday.

The attack started with a malicious link in a phishing email that allowed attackers to pivot from the facility’s IT network to the facility’s OT network, which is the operational technology hub of servers that control and monitor physical processes of the facility. With that, both the IT and OT networks were infected with what the advisory described as “commodity ransomware.”
Security lapses
The advisory disclosed several lapses in the facility’s security regimen. The first lapse involved inadequacies in the facility’s emergency response plan, which “did not specifically consider cyberattacks.” Instead, the plan focused on threats to physical safety.
Click to expand...

The advisory comes two weeks after researchers from industrial cybersecurity firm Dragos reported that a ransomware strain known as Ekans intentionally tampered with industrial control systems that gas facilities and other critical infrastructure rely on to keep equipment running reliably and safely.
There’s no evidence the malware that hit the gas-compression facility was Ekans.
Click to expand...

guest · Feb 19, 2020

mood said: ↑

US natural gas operator shuts down for 2 days after being infected by ransomware
Infection spread to site's OT network that monitors and controls physical processes
February 19, 2020
Click to expand...

Could this attack signal the future of ransomware?
February 19, 2020
https://www.fifthdomain.com/home/2020/02/19/could-this-attack-signal-the-future-of-ransomware/

The attack, in which the threat actor is able to enter a network and traverse throughout to identify critical assets, may be a sign of what’s next in ransomware, according to one threat intelligence company.

“This is what we call post-compromise ransomware deployment and [it] is what we are seeing as the next trend in ransomeware [sic] (definitely including critical and industrial sectors),” said Nathan Brubaker, senior manager for FireEye’s Cyber Physical Team, in a statement.
According to Kyle Miller, chief technologist at Booz Allen Hamilton, the navigation of the threat actor to the OT network is something he sees “more frequently.”

“We’ve seen a rise in targeted ransomware attacks that select one target and dive deeper into the network, which seems to be what happened here,” Miller said in a statement. “We are also seeing an uptick in threat actors trying to target softer environments like OT systems where things like back up and traditional security and anti-virus technologies aren’t always present.”
The alert from CISA said that the operator failed to put a robust boundary between the IT and OT environments. The organization also didn’t have cybersecurity as part of its emergency response plan.
Click to expand...

guest · Feb 20, 2020

mood said: ↑

US natural gas operator shuts down for 2 days after being infected by ransomware
Infection spread to site's OT network that monitors and controls physical processes
February 19, 2020
Click to expand...

Assessment of Ransomware Event at U.S. Pipeline Operator
February 19, 2020
https://dragos.com/blog/industry-news/assessment-of-ransomware-event-at-u-s-pipeline-operator/

Ransomware attackers initially breached the unnamed U.S. pipeline operator via phishing containing a malicious link, according to limited details provided in the CISA report. This allowed the unidentified attacker to gain access to the victim’s IT network, with subsequent pivoting allowing for spread to ICS network assets.

After publication, Dragos learned from multiple sources that the event described in the CISA report is likely the same as an event reported by the U.S. Coast Guard in December 2019. This link was later reported by several news outlets as well. As reported by the U.S. Coast Guard, Ryuk ransomware was ultimately deployed at the facility creating the disruption in operations.
Although Dragos cannot completely confirm that the two events are the same, multiple observations at least demonstrate strong overlap and similarity: [...]
Click to expand...

Ransomware Effects
Based on a variety of factors, Dragos concludes with high confidence the events in the CISA alert represent well-known ransomware behavior and is not an ICS-specific or ICS targeted event.

Although limited details about the ransomware event exist, current trends in ransomware leverage initial access into victim environments to capture credentials or compromise Windows Active Directory (AD) to gain widespread access to the victim’s entire network.
This strategy has been used to deploy various ransomware strains including Ryuk, MegaCortex, and Sobinokibi.
Click to expand...

guest · Jun 26, 2020

Threat Assessment: EKANS Ransomware
June 26, 2020
https://unit42.paloaltonetworks.com/threat-assessment-ekans-ransomware/

Unit 42 researchers have observed recent EKANS (Snake backward) ransomware activity affecting multiple industries in the U.S and Europe. As a result, we’ve created this threat assessment report for the activities of this ransomware. Identified techniques and campaigns can be visualized using the Unit 42 Playbook Viewer.

EKANS, which was first observed in January 2020, has relatively basic ransomware behavior, as it primarily seeks to encrypt your files and display a ransom note when finished. Although EKANS is basic in terms of file encryption, it’s worth mentioning that it does have some interesting functionalities that make it distinct from other ransomware strains.
EKANS ransomware is written in Golang and includes a static “kill list” that will stop numerous antivirus and Industrial Control Systems (ICS) processes and services

EKANS’ main intrusion vector at the moment seems to be spearphishing attachments. Having file-blocking policies in place, and securing any open Remote Desktop Protocol
Click to expand...

Conclusion
EKANS is a relatively new ransomware that’s active and targeting vulnerable enterprises for financial gain through malicious attachments.

Although we haven’t seen EKANS leveraging compromised RDP, one of ransomware’s top intrusion vectors are unsecured RDP ports. It’s always good practice to close those ports if they are not needed, or secure them. We encourage having the proper protections and best practices in place to prevent EKANS into getting into, or executing within, your network.

ICS asset owners should particularly be aware of this ransomware as it tries to kill ICS-related processes, so reviewing their security posture against this threat is recommended.
Click to expand...

guest · Jul 2, 2020

This is how EKANS ransomware is targeting industrial control systems
New samples of the ransomware reveal the techniques used to attack critical ICS systems
July 2, 2020
https://www.zdnet.com/article/this-is-how-ekans-ransomware-is-targeting-industrial-control-systems/

New samples of the EKANS ransomware have revealed how today's cyberattackers are using a variety of methods to compromise key industrial companies.

In a research report published on Wednesday, FortiGuard Labs researchers Ben Hunter and Fred Gutierrez said that malware designed to attack industrial control systems (ICS) continues to be lucrative for threat actors.
The researchers were able to obtain two modern samples, one from May and another compiled in June, which revealed some interesting features.

To help with analysis, FortiGuard created an EKANS-specific dissembler, discovering that despite a vast number of coding errors in the May version of the ransomware -- over 1200 strings, in fact -- the malware is still able to perform effectively in attacks against ICS systems.
Click to expand...

EKANS uses RSA encryption to lock up impacted machines and will go on a process killing rampage, terminating any system that could become a barrier to the malware's activities and deleting shadow copies in the process to make it more difficult to recover files.
Alongside the examination of this interesting ICS malware, FortiGuard also published a guide on what the cybersecurity firm believes are the most current techniques and tactics employed by industrial threat actors.
Click to expand...

Fortinet: EKANS Ransomware Targeting OT ICS Systems

guest · Jul 3, 2020

ICS-Targeting Snake Ransomware Isolates Infected Systems Before Encryption
July 3, 2020
https://www.securityweek.com/ics-targeting-snake-ransomware-isolates-infected-systems-encryption

One of the main characteristics of Snake is the killing of processes from a predefined list, including ICS-related processes, to encrypt resources associated with them in an effort to further entice victims into paying the ransom to restore affected systems.

As part of more recent attacks, the ransomware has taken the malicious activity one step further, through attempting to isolate the compromised systems before starting the file encryption process.

“Before initiating the encryption, Snake will utilize the Windows firewall in order to block any incoming and outgoing network connections on the victim’s machine that aren’t configured in the firewall. Windows built-in netsh tool will be used for this purpose,” cybersecurity firm Deep Instinct explains.
Furthermore, the malware would then hunt for processes that might interfere with the encryption process and kill them, including those related to industrial applications, security tools, and backup solutions. It also deletes shadow copies to prevent recovery operations.
Click to expand...

guest · Jul 17, 2020

Seven Ransomware Families Target Industrial Software
July 16, 2020
https://www.securityweek.com/seven-ransomware-families-target-industrial-software

Many ransomware families are designed to kill certain types of running processes. They might target security products to prevent them from blocking the attack and they can also terminate critical system processes so that they can encrypt files associated with these applications in an effort to cause disruption, which can increase the cybercriminals’ chances of getting paid by the victim.

According to FireEye, there are two main “process kill lists” that include industrial software. One of them, which targets over 1,000 processes, is used by six ransomware families, including SNAKE (SNAKEHOSE, EKANS), DoppelPaymer, LockerGoga, Maze, MegaCortex and Nefilim. The second list, which targets 1,425 processes, has only been found to be used by the CLOP ransomware.

“Unlike the first kill list, the CLOP sample includes a list of processes that, if stopped, may directly impact the operator’s ability to both visualize and control production. This is especially true in the case of some included processes that support HMI and PLC supervision,” FireEye said.
Click to expand...

“While it is likely the physical processes this software controls would continue to operate even if the software processes were terminated unexpectedly, stopping the software processes included in the CLOP sample’s kill list could result in the loss of view/control over those physical processes due to the inability of operators to interact with the equipment.
Click to expand...

FireEye: Financially Motivated Actors Are Expanding Access Into OT: Analysis of Kill Lists That Include OT Processes Used With Seven Malware Families

guest · Sep 13, 2020

University Project Tracks Ransomware Attacks on Critical Infrastructure
September 12, 2020
https://www.securityweek.com/university-project-tracks-ransomware-attacks-critical-infrastructure

Work on this project, described as a repository of critical infrastructure ransomware attacks (CIRWA), started in September 2019. As of August 2020, the database includes over 680 records of ransomware attacks documented since November 2013.
The repository, offered for free as a Microsoft Excel file, stores information on incidents described by the media and cybersecurity companies.

The information includes the name of the targeted organization, the year the attack was launched, the date when the attack started, location of the targeted organization, the targeted sector, duration of the attack, the ransomware family that was used, the ransom amount, the payment method, whether the amount was paid, how much was paid, the source of the information, and related incidents. Based on the type of ransomware that was used, there are also links to the MITRE ATT&CK framework.

It’s worth noting that the project tracks incidents affecting critical infrastructure as defined by the U.S. Department of Homeland Security.
Click to expand...

The most commonly observed duration of a ransomware attack is one week or less, and the most commonly demanded ransom amount is $50,000 or less, but there are 13 known incidents where the attackers demanded more than $5 million.

“We started with the goal of just providing a dataset based on open-source information on disclosed CIRW incidents,” Rege told SecurityWeek. “My team and I struggled to find datasets that are free/no strings attached in the [critical infrastructure] space, which could be used by researchers/educators (like myself) and also by students.”
Anyone can request the data for free and Rege says they have approved nearly all the requests they’ve received to date.

The maintainers of the project have been making improvements based on the feedback they have received from the community, such as mapping attacks to the MITRE ATT&CK framework.
Click to expand...

Critical Infrastructure Ransomware Attacks

In September 2019, we started a repository of Critical Infrastructures Ransomware Attacks (CIRWAs). These are based on publicly disclosed incidents in the media or security reports. This repository (version 10.2) now has 687 records assembled from publicly disclosed incidents between November 2013 and August 2020. This is a FREE resource that you can request.
Click to expand...

guest · Nov 13, 2020

Manufacturing is becoming a major target for ransomware attacks
November 13, 2020
https://www.zdnet.com/article/manufacturing-is-becoming-a-major-target-for-ransomware-attacks/

Ransomware has become a major threat to the manufacturing industry as cyber-criminal groups increasingly take an interest in targeting the industrial control systems (ICS) that manage operations.

According to analysis by cybersecurity researchers at security company Dragos, the number of publicly recorded ransomware attacks against manufacturing has tripled in the last year alone.
While a lot of manufacturing relies on traditional IT, some elements of manufacturing relies on ICS when mass-producing products – and that's an area that several hacking groups are actively looking to target.

As of October 2020, the company said there were at least 108 advisories containing 262 vulnerabilities impacting industrial equipment found in manufacturing environments during the course of this year alone, many of which potentially leave networks vulnerable to ransomware and other cyberattacks.

"Unfortunately, unpatched vulnerabilities that can enable initial access will always be an issue. Testing and applying patches as soon as practicable is very important for preventing exploitation," said Larson.
Click to expand...

Cyber criminals are deploying ransomware because it's often the quickest and easiest way to make money from compromising a large network.

That could potentially lead to hacking groups using ransomware as a smokescreen for cyberattacks designed to steal intellectual property, which could be extremely damaging to victims in the long run.

"Gaining visibility into the OT environment is very crucial – you can't protect what you don't know exists," said Larson.
Click to expand...

Dragos: ICS Threat Activity on the Rise in Manufacturing Sector

Dragos is pleased to announce the release of the Manufacturing Sector Cyber Threat Perspective, a comprehensive analysis of recent observations of ICS-targeting threats to manufacturing organizations along with practical defensive recommendations. This article touches on highlights from the November 2020 report, which is available for download in its entirety here.
Click to expand...

Cyber risk is increasing
Cyber risk to the manufacturing sector is increasing, led by disruptive cyberattacks impacting industrial processes, intrusions enabling information gathering and process information theft, and new activity from Industrial Control Systems (ICS)-targeting adversaries. Dragos currently publicly tracks five ICS-focused activity groups targeting manufacturing: CHRYSENE, PARISITE, MAGNALLIUM, WASSONITE, and XENOTIME in addition to various ransomware activities capable of disrupting operations.
Click to expand...

guest · Dec 18, 2020

Industrial Control Systems Ripe Targets for Ransomware Attacks
December 18, 2020
https://www.securityweek.com/industrial-control-systems-ripe-targets-ransomware

Security researchers at IBM Corp. and Dragos Inc. are warning that the industrial control systems that power manufacturing plants and utilities are prime targets for ransomware attackers.
In a report issued this week, the researchers noted that ransomware attacks against industrial entities jumped more than 500 percent over the last two years.

Interestingly, the increase in the ransomware incidents appears to coincide with the global COVID-19 pandemic.

"Ransomware adversaries leveraged Coronavirus-themed phishing lures for initial access operations, preying on users’ concern for health and safety," the researchers noted.
The analysis also found that ransomware operators are increasingly incorporating data theft and extortion operations into their attack techniques, potentially posing even greater impact from ransomware than disrupted operations through leaked intellectual property and other critical data.
Click to expand...

According to the report (PDF), data stolen and leaked on publicly available websites could provide ICS targeting attackers with victim data that could inform or guide future ICS disruptive attacks.

To combat ransomware in ICS environments, the researchers suggest that asset owners and operators engage in effective defense-in-depth security strategies.

"Ensure an understanding of network interdependencies and conduct crown jewel analysis to identify potential weaknesses that could disrupt business continuity and production.
Click to expand...

Dragos: Ransomware in ICS Environments
(PDF): https://f.hubspotusercontent10.net/hubfs/5943619/Whitepaper-Downloads/Ransomware_in_ICS_Environments_Whitepaper_10_12_20.pdf

guest · Aug 15, 2021

The Next Disruptive ICS Attacker: A Ransomware Gang?
August 11, 2021
https://www.tripwire.com/state-of-s...xt-disruptive-ics-attacker-a-ransomware-gang/

OT networks often rely on Windows systems for various ICS applications including HMIs, historians, and data gateways. Beyond that, they also commonly rely on Windows systems to run associated IT-networks.
The downtime from such an event could also span many months depending on the system. Specialized industrial equipment often cannot be replaced with existing components and take months to produce.
How THE MALWARE is Deployed
Ransomware may find its way onto an ICS network through a variety of sources. As with any other organization, it may start with phishing attacks targeting employees.
Exploits targeting VPN portals or other externally exposed IT infrastructure may also provide a beachhead for a ransomware deployment.
Click to expand...

Perhaps in response to organizations getting better at recovery, several prominent ransomware gangs have adjusted their strategy to include data theft as a second opportunity for extortion. Stolen data may be sold to the highest bidder or used in a private shakedown. This attack strategy has been tested on traditional IT networks and is now increasingly making its way into the ICS space.

For an industrial or manufacturing plant, stolen data may include confidential manufacturing specifications, bid details, or personnel records.
Click to expand...

guest · Oct 25, 2021

Ransomware hit industrial sector the hardest in the third quarter
October 25, 2021
https://www.itpro.co.uk/security/ra...trial-sector-the-hardest-in-the-third-quarter

Ransomware gangs hit the industrial sector the hardest during the third quarter of this year, according to a report by security company Digital Shadows.

The report named the industrial goods and services sector as the biggest target during the third quarter of this year, maintaining a position that it has held throughout 2021. The technology sector came second, followed by construction and materials, legal services, and financial services.
Click to expand...

The number of attacks on the industrial sector fell by 42% quarter-on-quarter, however, which the report attributes to diversification. Ransomware groups are now targeting more sectors, it said, adding that many of these attacks seem to be targeting the technology sector, which saw a 29.8% bump in attack volume.
Click to expand...

guest · Jan 16, 2023

Cybersecurity Experts Cast Doubt on Hackers' ICS Ransomware Claims
By Eduard Kovacs @EduardKovacs - January 16, 2023

A hacktivist group has made bold claims regarding an attack on an industrial control system (ICS) device, but industry professionals have questioned their claims.
Click to expand...

The hacktivist group known as GhostSec, whose recent operations have focused on ‘punishing’ Russia for its invasion of Ukraine, claims to have conducted the first ever ransomware attack against a remote terminal unit (RTU), a type of ICS device used for communications between field devices and supervisory control and data acquisition (SCADA) systems.

“We just encrypted the first RTU in history! A small device designed only for an ICS environment,” the hackers said. “The age of ransomware coded to attack ICS devices just became a thing, and we were the first.”
Several experts, including ones from ICS security companies, analyzed the hacktivists’ claims based on the screenshots they made available. The screenshots show that the attackers managed to encrypt some of the files hosted on the device, just like in a ransomware attack.
Click to expand...

Ransomware that can encrypt files on a Linux device is not new and there is no indication that encrypting files on the Teleofis device is more difficult. In addition, hacking these types of communication gateways that provide remote connectivity to serial devices is also not new, pointed out industrial cybersecurity firm SynSaber.

“Given that these devices are running generic Linux kernels that happen to be providing connectivity to serial devices (which, of course, could be industrial), there’s nothing in the evidence supplied by GhostSec that industrial was specifically attacked or that this attack represents a new paradigm shift in industrial hacking,” explained Ron Fabela, the CTO of SynSaber.
Industrial cybersecurity company Otorio has also analyzed the hackers’ claims and noted,

“In order to create a ransomware type of attack on a common RTU, it would require GhostSec to have deeper OT knowledge and resources, such as experimenting with real OT engineering tools and devices. The Teleofis device is OpenWrt based, which is basically Linux, and does not introduce any new, real OT capability.”
Click to expand...

On the other hand, this research and the recent incidents do not necessarily mean that ransomware attacks directly targeting ICS devices will become common and widespread in the near future.

“The requirements and implications of ‘true’ industrial ransomware at the RTU or PLC level make this a very unlikely domain for criminals to operate in,” Slowik said.
Click to expand...

Log in or Sign up

Ransomware attacks are now targeting industrial control systems

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Ransomware attacks are now targeting industrial control systems

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches