US government warns specialized malware is targeting energy plants

Date:
Thu, 14 Apr 2022 20:45:09 +0000

Description:
Critical infrastructure operators are under threat from custom-built malware and APTs from state-sponsored actors.

FULL STORY ======================================================================

Critical infrastructure organizations in the US are being targeted with custom-built malware , designed specifically for the hardware they use, security and law enforcement agencies in the country are warning.

The new warning was jointly published by the Department of Energy (DOE), the Cybersecurity and Infrastructure Security Agency (CISA), the National
Security Agency (NSA), and the Federal Bureau of Investigation (FBI).

In it, the agencies are warning of threat actors placing multiple industrial control systems (ICS) and supervisory control and data acquisition (SCADA) devices in their crosshairs - namely Schneider Electric programmable logic controllers (PLCs), OMRON Sysmac NEX PLCs, and Open Platform Communications Unified Architecture (OPC UA) servers .

Share your thoughts on Cybersecurity and get a free copy of the Hacker's Manual 2022 . Help us find how businesses are preparing for the post-Covid world and the implications of these activities on their cybersecurity plans. Enter your email at the end of this survey to get the bookazine, worth $10.99/10.99. Chernovite, the state-sponsored attacker

More precisely - Schneider Electric MODICON and MODICON Nano PLCs, including TM251, TM241, M258, M238, LMC058, and LMC078; and OMRON Sysmac NJ and NX
PLCs, including NEX NX1P2, NX-SL3300, NX-ECC203, NJ501-1300, S8VK, and R88D-1SN10F-ECT, are being targeted.

Apparently, one of the threat actors is called CHERNOVITE, and this one is trying to deploy malware dubbed PIPEDREAM. Security researchers from cybersecurity firm Dragos have been tracking the ICS-specific malware for
some time now, and discovered it initially targets Schneider Electric and Omron controllers. By taking advantage of the endpoints native functionality in operations, the malware is somewhat harder to spot.

Dragos CEO, Robert Lee, believes CHERNOVITE is a state-sponsored attacker.

A separate cybersecurity firm, Mandiant, has been tracking a different malware, called INCONTROLLER. This one, too, targets Schneider Electric
tools, and is, too, created and operated by a state-sponsored attacker. Read more

How critical infrastructure can be protected from threats

The cyber threat against critical infrastructure

CISA urges critical infrastructure companies to strenghten cybersecurity

Although no countries were named, the publication does remind that the Ukrainian officials announced stopping an attack on an energy facility, recently.

Speaking to The Record , chief technology officer of ICS cybersecurity software firm aDolus Technology, said Schneider Electric MODICON PLCs and OPC Unified Architecture (OPC UA) servers are probably targeted because theyre extremely common in the industry.

The potential flaws that could be leveraged, could provide attackers with elevated privileges, lateral movement within an OT environment, and allow for critical devices or functions disruption, he added. If you're looking for a dedicated server hosting service, try these providers

Via: The Record



======================================================================
Link to news story: https://www.techradar.com/news/us-government-warns-specialized-malware-is-targ eting-energy-plants/


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)