Cyber Security

US Charges Four Russian Cyber Attackers Targeting Critical Infrastructure

Published

2 years ago

March 28, 2022

The US Department of Justice (DoJ) has charged three Russian FSB officers and a programmer working for a Russian military research institute with past attacks against industrial control systems (ICS) operated by critical infrastructure providers. The attacks involve the 2017 Triton malware that was designed to infect safety instrumented system (SIS) controllers made by Schneider Electric’s Triconex division and the 2013 Havex remote access Trojan that included a module to map supervisory control and data acquisition (SCADA) on networks.

These malware threats were used against energy sector organizations including oil and gas firms, nuclear power plants, and power transmission companies. While these threats were attributed by security researchers in the past to Russian state-sponsored groups, this is the first time when individuals directly linked to Russian government agencies or organizations are named in relation to the attacks.

The US charged Evgeny Viktorovich Gladkikh, a 36-year-old programmer working for the Russian Central Scientific Research Institute of Chemistry and Mechanics (TsNIIKhM), for his role in a campaign meant to hack into oil refineries around the world, including the US At least one of those attacks resulted in the successful deployment of the Triton malware, which was developed at TsNIIKhM, one of Russia’s oldest state research centers that work under the country’s Ministry of Defense and specialises in creating new advanced weapons for use in space warfare and cyber operations, the unsealed indictment says.

The 2017 incident led to the discovery of the Triton malware after a glitch in the malware’s code after being deployed on Triconex SIS controllers at the refinery triggered two safety shutdown events. The indictment notes that Gladkikh was directly involved in the attack, planting backdoors on machines inside the organization’s network, familiarizing himself with organisation’s safety logs, the results of past safety exercises and the planned response, the software versions used on logging servers, and exact model and features of the Triconex SIS devices.

He was also directly responsible for deploying the Triton malware on the organization’s SIS devices that were connected to computer machines that he backdoored. These machines were part of the organization’s distributed control system (DCS) and one of them controlled sensitive physical processes that involved sulfur recovery and burner management. Improper operation of these systems could have led to the release of toxic gasses or explosions.

The prosecutors believe the goal of Gladkikh and his co-conspirators was to use the Triton malware to cause physical damage or catastrophic failures at the refinery by altering the safety operating parameters while making it seem to operators that everything was normal. Instead, the malware configuration inadvertently triggered faults in the SIS devices triggering their safety shutdown protocol, which gave the attack away and ultimately led to the discovery of the Triton malware.

However, the group’s attempts to compromise oil refineries didn’t stop. According to the indictment, Gladkikh found a research paper authored in the 1970s on a site run by the US Department of Defense that included an extensive survey of oil refineries in the US and their physical vulnerabilities, including the impact of possible explosions and fires. This paper allowed him and his co-conspirators to identify two refineries that are currently operated by a US-based company and then attempt to gain access to public servers run by that company through SQL injections and vulnerability scans. These attempts were unsuccessful.

Gladkikh was charged with one count of conspiracy to cause damage to an energy facility and one count of attempt to cause damage to an energy facility, both carrying a maximum sentence of 20 years in prison each, and one count of conspiracy to commit computer fraud, which carries a maximum sentence of five years in prison.

In another indictment, the DoJ charged Pavel Aleksandrovich Akulov, Mikhail Mikhailovich Gavrilov, and Marat Valeryevich Tyukov, three officers in Military Unit 71330 or “Center 16” of the FSB, Russia’s internal security service, with computer fraud and abuse, wire fraud, aggravated identity theft and causing damage to the property of an energy facility. These charges are in relation to the use of the Havex malware between 2012 and 2017 against multiple organizations.

The Havex malware is a remote access Trojan that the security industry attributed in the past to a Russian state-sponsored threat group tracked as Dragonfly, Berzerk Bear, or Energetic Bear. Havex is also noteworthy because between 2012 and 2014 attackers used software supply chain compromises, among other attack vectors, to distribute it.

Particularly, the hackers managed to compromise servers belonging to companies that provided ICS and SCADA software and Trojanize their software updates. Examples include the MESA Imaging driver; a component called eCatcherSetup made by eWON, a company that provided a remote maintenance service for ICS systems; and multiple tools made by MB Connect, a company that provided a VPN service and network router for industrial systems.

The Dragonfly group used many other attack vectors as well, including watering hole techniques that involved compromising websites commonly visited by employees from its targeted sector to serve credential theft malware, spear phishing emails sent from fake addresses created from inside compromised energy organizations, exploiting web-based vulnerabilities in publicly exposed servers, and more.

The Havex malware was not directly designed to compromise ICS controllers, but it contains a module that allows attackers to scan the compromised networks for SCADA applications. These are management applications that usually run on Windows workstations and are designed to monitor and control industrial processes. This shows the attackers had a clear interest in gaining control over such workstations.

Over its years of operation, the Dragonfly group managed to infect over 17,000 unique systems with Havex, including ICS/SCADA controllers used by power and energy companies, the prosecutors say. The group’s spear-phishing attacks targeted more than 3,300 users at over 500 organizations in the US and abroad, including the US Nuclear Regulatory Commission.

Following the unsealing of the indictments, CISA and the Department of Energy published a detailed advisory with additional technical details about the Triton and Dragonfly attacks. The advisory also includes security best practices and recommendations for critical infrastructure operators.

Up Next

Evolving With the Threat Landscape is Key

Don't Miss

Microsoft Confirms it was Breached by Lapsus$ Hackers

Cyber Security

SANS Institute to Boost Cyber Resilience in Bahrain and Qatar

Published

4 days ago

September 4, 2024

Priyan Sampath

SANS Institute is set to bring world-class cybersecurity education to professionals across the Middle East with SANS Manama (7-12 September) at InterContinental Bahrain, followed by SANS Doha (14-19 September) at InterContinental Doha. The courses are designed to educate professionals on current and emerging cyber threats, ensuring that participants are confident in the latest industry trends, tools, and techniques.

SANS Manama September 2024 (7-12 September) offers the following courses:

FOR508: Advanced Incident Response, Threat Hunting, and Digital Forensics
LDR414: SANS Training Program for CISSP Certification

FOR508 is an in-depth course that equips incident responders and threat-hunting teams with advanced skills to detect, identify, counter, and recover from a wide range of threats within enterprise networks, including those posed by nation-state adversaries, organized crime syndicates, and ransomware operators. LDR414 is an accelerated review course specifically designed to prepare students for the CISSP exam. It focuses exclusively on the eight domains of knowledge defined by (ISC)², which are critical to passing the exam.

A highlight of SANS Manama will be the Community Night session on 9 September, titled “Justice Denied: How Bad Digital Forensics Threatens and Undermines Justice.” This session will delve into three real-world cases—one criminal and two civil—to demonstrate how digital forensic evidence, when presented by unqualified or biased practitioners, nearly destroyed lives in court. The session will also illustrate how a proper scientific approach to digital forensics can help achieve justice.

SANS Doha September 2024 (14-19 September) will feature:

SEC504: Hacker Tools, Techniques, and Incident Handling
SEC560: Enterprise Penetration Testing

SEC504 will teach students how to effectively respond to breaches across Windows, Linux, and cloud platforms, providing insight into the tools and techniques attackers use, the artefacts they leave behind, and how to build better defences based on this knowledge.
SEC560 is designed to strengthen the skillset of penetration testers while also training system administrators, defenders, and other security professionals to understand the mindset and methodologies of modern attackers.

Ned Baltagi, Managing Director for the Middle East, Africa, and Turkey at SANS Institute, emphasized the importance of these events, by saying, “As cybersecurity threats continue to evolve, professionals in the Middle East must stay ahead of the curve. These training sessions are not just about learning new skills—they are about building a stronger, more resilient cybersecurity community. We are committed to empowering individuals with the knowledge and tools they need to protect their organizations and, by extension, the region as a whole.”

Cyber Security

MENA Region Sees Surge in Managed Security Services Adoption, Says SearchInform

Published

5 days ago

September 3, 2024

Edward Frank

SearchInform, the leading information security and risk management solutions vendor, has conducted an extensive survey among organizations in the Middle East and North Africa (MENA) region to assess their approach to information security. The results show a significant shift towards outsourcing security functions, with nearly 70% of organizations either already using Managed Security Services (MSS) or planning to do so shortly.

This survey involved business executives, information technology and security (IT, IS) professionals, and Chief Information Security Officers (CISOs) from both public and private sectors. The research aimed to evaluate the current state of corporate protection and identify priorities in ensuring information security amid the region’s unique challenges. Notably, 80% of respondents reported an increase in their information security budgets over the past year, reflecting a growing recognition of the need for robust security measures. Only 22% of respondents reported budgets haven’t changed, no one reported a decrease in budgets.

SearchInform’s findings indicate that while many organizations have implemented basic cybersecurity measures such as Antivirus, Next-Generation Firewalls (NGFW), Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS) and Endpoint Protection Systems (EPS); there is still a significant gap in the deployment of more advanced systems like Data Loss Prevention (DLP) and Security Information and Event Management (SIEM). These tools are critical for real-time monitoring and internal threat protection, yet only 29% of companies have implemented DLP, and a mere 5% have adopted SIEM systems.

Lev Matveev, Chairman of the Board of Directors at SearchInform, commented on the survey results, stating, “The increasing reliance on MSS highlights the ongoing shift in how organizations are approaching their cybersecurity needs. Outsourcing provides access to specialized expertise and technology, which is particularly vital in regions facing a shortage of skilled information security professionals.”

The research also revealed that internal threats are coming to the fore. More than half of respondents admitted experiencing one or more information security incidents, caused by insider actions. “To effectively combat internal threats, increasing the cybersecurity literacy of employees will reduce the risk of undesirable incidents. The second measure is the implementation of protective solutions that help prevent both accidental and deliberate incidents, such as data leaks, corporate fraud cases, theft, kickbacks and bribery, illicit access to confidential data, etc. In this regard, the integration of DLP and DCAP systems is necessary. DCAP-class systems that perform corporate file system analysis, classify data stored in the organization, handle the task of distributing access rights, and prevent the risk of data leakage and misuse at the initial stage. These are important components of the protective system, and the concept of DCAP systems is highly recommended by Gartner experts,” Matveev commented.

As the demand for MSS continues to grow, SearchInform’s local subsidiary in the UAE has seen strong interest from both businesses and governmental organizations, underscoring the importance of managed services in addressing the region’s complex security challenges. The global MSS market size is expected to grow from USD 30.6 billion in 2023 to USD 52.9 billion by 2028, with a Compound Annual Growth Rate (CAGR) of 11.5%.

Cyber Security

Positive Technologies: 16% of Darkweb Listings Involve Middle Eastern Organisations

Published

6 days ago

September 2, 2024

Prarthana Mary

In 2024, cyber criminals have shifted focus from personal data to stealing company credentials and trade secrets. One in six listings (16%) on the dark web featuring stolen government data involves organizations in the Middle East. This insight comes from Positive Technologies’ first study on data breaches in Russia, the Middle East, and globally. Their experts reviewed over 1,000 dark web listings and 700 public incident reports from the first half of 2024 worldwide.

Credential leaks from organisations hit a record high of 21% in the first half of 2024, up 9 percentage points from last year. The theft of commercial secrets and restricted information rose to 24% in the first half of 2024, an increase of 10 percentage points compared to the same period in 2023. Meanwhile, personal data theft incidents returned to pre-peak levels: dropping to 2022 levels in Q1 2024 to 37%, and then falling to 25% in Q2 2024.

In the first half of 2024, the industrial sector (39%), government agencies (36%), and transportation companies (29%) continued to lead in the share of leaks of commercial secrets and other restricted information. Notable victims include Hyundai Motor Europe and Volkswagen, with the latter losing documents on electric vehicle technology. IT companies are also at risk, with breaches involving internal processes and products accounting for 29% of incidents. In 2024, hackers allegedly accessed the source code of some Apple and AMD software.

Stolen credentials are often used for further attacks on these companies’ clients, primarily government organizations. Credential compromise is typically a step before more severe actions, such as theft of funds or system disruption. Ransomware was used in nearly a third of successful breaches involving data leaks. Dark web listings for government data heavily feature Middle Eastern countries (16%), with Asia (33%) in the lead, followed by Latin America and the Caribbean (18%). These regions are targeted by APT groups, mainly focusing on the public sector. Positive Technologies’ research on APT groups in the Middle East and Southeast Asia provides more details.

“Credentials are frequently sold on dark web forums, a key revenue source for cybercriminals. In March, access to a prominent UAE Bank’s website was listed for $10,000. The rise in these leaks is evident on the dark market—forums now offer access to dozens or hundreds of companies per post. In April, a listing was posted offering access to the infrastructure of 16 companies from various industries across Latin America, the Middle East, Europe, and Asia, with prices ranging from $250 to $5,000. According to the listing’s authors, these firms’ revenues range from $4 million to $2.8 billion. For instance, a UAE-based consumer electronics company with $6.5 million in revenue had its data valued at $400. In June, another listing offered credentials for over 400 companies, including access via Jira, GitHub, and GitLab,” notes Anna Golushko, Senior Analyst at Positive Technologies.

The number of dark web ads offering free information is nearly double those selling it (64% vs. 33%). This is because not all attackers aim to sell data; many demand ransom not to disclose it, though not all victims pay. In the first half of 2024, government organizations were often targeted specifically to steal personal data. More than half of ads on the dark web are priced under $1,000. Every tenth ad belongs to the most expensive category at $10,000 or more.

The most expensive offers (over $50,000) involve major financial institutions, retail giants, and IT companies. In Q2 2024, EDR developer Cylance suffered a cyberattack, resulting in 34 million emails and an unspecified volume of customer and employee data being sold for $750,000. Positive Technologies analysts highlight that every second successful attack on organizations in H1 2024 resulted in the leakage of confidential data. The largest number of incidents occurred in government agencies (13%), IT companies (12%), and industrial companies (11%).

Preventing data leaks requires a comprehensive approach, including tools to protect user devices, corporate networks, and the data itself. As corporate data infrastructures evolve into complex systems that are constantly changing rapidly, a unified solution is essential to safeguard information, regardless of its complexity or location.