IoT Malware Campaign Infects Global Manufacturing Sites

guest · Feb 6, 2020

IoT Malware Campaign Infects Global Manufacturing Sites
February 5, 2020
https://www.darkreading.com/iot/iot...cts-global-manufacturing-sites/d/d-id/1336982

A new malware campaign built to exploit flaws in connected devices is targeting manufacturers around the world and affecting products from smart printers to heavy operational equipment.

Researchers at TrapX Labs first saw this attack targeting Latin American manufacturers in October 2019. Since then, it has continued to expand, with a peak in December and ongoing growth this year in regions including North America, Africa, and the Middle East, says TrapX CEO Ori Bach.

"Given the nature of the attack, it makes sense to make it global," Bach explains. "The attacker wants to cover as much real estate as possible."
This attack campaign uses a self-spreading downloader that runs malicious scripts as part of the Lemon_Duck PowerShell malware family.
Click to expand...

Manufacturing Malware
Lemon_Duck was developed as a cryptominer, says Bach. In this scenario, the malware has been customized to perform capabilities beyond mining for cryptocurrency on a target machine.

This particular variant scans a network for potential targets, including devices with SMB (445) or MSSQL (1433) services open. When it finds one, the malware runs multiple threads with several functionalities.
Another one of its functionalities is to run invoke-mimkatz via import-module to obtain NTLM hashes and gain access, another means of downloading and spreading the malware via SMB.
Click to expand...

This attack presents a challenge to manufacturers because devices are often not fully patched and can be difficult to wipe clean, says Bach. What's more, they can be reinfected by other machines on the network after the malware is removed because the nature of Lemon_Duck is to spread quickly. Patching is more difficult in an operational technology network than a traditional IT environment.
Click to expand...

TrapX Labs: TrapX Security Identifies New Malware Campaign Targeting IoT Devices Embedded With Windows 7 at Manufacturing Sites

Log in or Sign up

IoT Malware Campaign Infects Global Manufacturing Sites

guest Guest

Log in or Sign up

IoT Malware Campaign Infects Global Manufacturing Sites

guest Guest

Useful Searches