Connect with us

Cyber Security

US Charges Four Russian Cyber Attackers Targeting Critical Infrastructure

Published

3 months ago

on

The US Department of Justice (DoJ) has charged three Russian FSB officers and a programmer working for a Russian military research institute with past attacks against industrial control systems (ICS) operated by critical infrastructure providers. The attacks involve the 2017 Triton malware that was designed to infect safety instrumented system (SIS) controllers made by Schneider Electric’s Triconex division and the 2013 Havex remote access Trojan that included a module to map supervisory control and data acquisition (SCADA) on networks.

These malware threats were used against energy sector organizations including oil and gas firms, nuclear power plants, and power transmission companies. While these threats were attributed by security researchers in the past to Russian state-sponsored groups, this is the first time when individuals directly linked to Russian government agencies or organizations are named in relation to the attacks.

The US charged Evgeny Viktorovich Gladkikh, a 36-year-old programmer working for the Russian Central Scientific Research Institute of Chemistry and Mechanics (TsNIIKhM), for his role in a campaign meant to hack into oil refineries around the world, including the US At least one of those attacks resulted in the successful deployment of the Triton malware, which was developed at TsNIIKhM, one of Russia’s oldest state research centers that work under the country’s Ministry of Defense and specialises in creating new advanced weapons for use in space warfare and cyber operations, the unsealed indictment says.

The 2017 incident led to the discovery of the Triton malware after a glitch in the malware’s code after being deployed on Triconex SIS controllers at the refinery triggered two safety shutdown events. The indictment notes that Gladkikh was directly involved in the attack, planting backdoors on machines inside the organization’s network, familiarizing himself with organisation’s safety logs, the results of past safety exercises and the planned response, the software versions used on logging servers, and exact model and features of the Triconex SIS devices.

He was also directly responsible for deploying the Triton malware on the organization’s SIS devices that were connected to computer machines that he backdoored. These machines were part of the organization’s distributed control system (DCS) and one of them controlled sensitive physical processes that involved sulfur recovery and burner management. Improper operation of these systems could have led to the release of toxic gasses or explosions.

The prosecutors believe the goal of Gladkikh and his co-conspirators was to use the Triton malware to cause physical damage or catastrophic failures at the refinery by altering the safety operating parameters while making it seem to operators that everything was normal. Instead, the malware configuration inadvertently triggered faults in the SIS devices triggering their safety shutdown protocol, which gave the attack away and ultimately led to the discovery of the Triton malware.

However, the group’s attempts to compromise oil refineries didn’t stop. According to the indictment, Gladkikh found a research paper authored in the 1970s on a site run by the US Department of Defense that included an extensive survey of oil refineries in the US and their physical vulnerabilities, including the impact of possible explosions and fires. This paper allowed him and his co-conspirators to identify two refineries that are currently operated by a US-based company and then attempt to gain access to public servers run by that company through SQL injections and vulnerability scans. These attempts were unsuccessful.

Gladkikh was charged with one count of conspiracy to cause damage to an energy facility and one count of attempt to cause damage to an energy facility, both carrying a maximum sentence of 20 years in prison each, and one count of conspiracy to commit computer fraud, which carries a maximum sentence of five years in prison.

In another indictment, the DoJ charged Pavel Aleksandrovich Akulov, Mikhail Mikhailovich Gavrilov, and Marat Valeryevich Tyukov, three officers in Military Unit 71330 or “Center 16” of the FSB, Russia’s internal security service, with computer fraud and abuse, wire fraud, aggravated identity theft and causing damage to the property of an energy facility. These charges are in relation to the use of the Havex malware between 2012 and 2017 against multiple organizations.

The Havex malware is a remote access Trojan that the security industry attributed in the past to a Russian state-sponsored threat group tracked as Dragonfly, Berzerk Bear, or Energetic Bear. Havex is also noteworthy because between 2012 and 2014 attackers used software supply chain compromises, among other attack vectors, to distribute it.

Particularly, the hackers managed to compromise servers belonging to companies that provided ICS and SCADA software and Trojanize their software updates. Examples include the MESA Imaging driver; a component called eCatcherSetup made by eWON, a company that provided a remote maintenance service for ICS systems; and multiple tools made by MB Connect, a company that provided a VPN service and network router for industrial systems.

The Dragonfly group used many other attack vectors as well, including watering hole techniques that involved compromising websites commonly visited by employees from its targeted sector to serve credential theft malware, spear phishing emails sent from fake addresses created from inside compromised energy organizations, exploiting web-based vulnerabilities in publicly exposed servers, and more.

The Havex malware was not directly designed to compromise ICS controllers, but it contains a module that allows attackers to scan the compromised networks for SCADA applications. These are management applications that usually run on Windows workstations and are designed to monitor and control industrial processes. This shows the attackers had a clear interest in gaining control over such workstations.

Over its years of operation, the Dragonfly group managed to infect over 17,000 unique systems with Havex, including ICS/SCADA controllers used by power and energy companies, the prosecutors say. The group’s spear-phishing attacks targeted more than 3,300 users at over 500 organizations in the US and abroad, including the US Nuclear Regulatory Commission.

Following the unsealing of the indictments, CISA and the Department of Energy published a detailed advisory with additional technical details about the Triton and Dragonfly attacks. The advisory also includes security best practices and recommendations for critical infrastructure operators.

Related Topics:
Continue Reading

Cyber Security

Group-IB Unveils Unified Risk Platform

Published

22 hours ago

on

June 30, 2022

By

Group-IB has today unveiled the Unified Risk Platform, an ecosystem of solutions that understands each organization’s threat profile and tailors defenses against them in real-time. Every product and service in Group-IB’s now consolidated security suite is enriched with information from a Single Data Lake, which contains 60 types of sources of adversary intelligence. The Unified Risk Platform automatically configures your Group-IB defenses with the precise insights needed to provide the best possible defense against targeted attacks on the infrastructure and endpoints, breaches, fraud, brand, and IP abuse.

“At the heart of the Unified Risk Platform is a Single Data Lake that has the most complete and detailed insight into threat actors. Group-IB has collected the industry’s broadest range of adversary intelligence, with 60 types of sources across 15 categories,” the company said in a statement.

The data is gathered by and exclusive to Group-IB, providing customers with unprecedented visibility of threat actors’ operations. The raw data is enriched with context, converted into actionable intelligence, and added to Group-IB’s Single Data Lake. The patented technology is continuously refined by state-of-the-art research, science, and modeling conducted by Group-IB’s dedicated analyst teams spanning 11 cybersecurity disciplines.

The modular architecture of the Unified Risk Platform allows additional capabilities to be easily activated, providing increased protection from cybercrime without friction. A range of out-of-the-box integrations and flexible APIs enable the Unified Risk Platform to easily enhance any existing security ecosystem. When organisations need specialist support, Group-IB’s comprehensive suite of services is available for any purpose, from one-off red teaming exercises or incident response to in-life managed detection and response.

In addition to the services, every Group-IB product is powered by the platform to provide complete coverage of the Cyber Response Chain:

  • Group-IB Threat Intelligence provides deep insight into adversary behaviors. Threat Intelligence was independently evaluated as creating a 10% increase in team efficiency over alternative vendors and in a case study generated a 339% return on investment.
  • Group-IB Managed XDR enables organizations to respond 20% faster to threats according to an analyst study.
  • Group-IB Digital Risk Protection allows organizations to reduce the risk of brand abuse, piracy, data leaks, and more with best-in-breed protection. Group-IB has been benchmarked as detecting pirated content in 30 min on average and taking down 80% of the content within 7 days.
  • Fraud Protection was calculated by consultants to reduce the rate of false-positive fraud cases by 20% and enable 10% to 20% more fraud attempts to be detected and prevented. Furthermore, Group-IB identified 30% more one-time password fraud.
  • Attack Surface Management continuously discovers external assets to identify shadow IT, forgotten infrastructure, misconfigurations, and other hidden risks. As part of the Unified Risk Platform, the solution provides a threat actor’s view of the attack surface so that weak spots can be quickly and proactively strengthened.
  • Business Email Protection defends corporate email from sophisticated attacks. The solution monitors for indicators of compromise identifies malicious behavioral markers and extracts artifacts to identify risky emails before they reach their destination.
Continue Reading

Cyber Security

Genetec Announces Availability of its Synergis Cloud Link PoE-Enabled IoT Gateway

Published

4 days ago

on

June 27, 2022

By

Genetec has announced the immediate availability of a new generation of its Synergis Cloud Link PoE-enabled IoT gateway for access control. Manufactured in North America to mitigate supply chain delays, Synergis Cloud Link addresses the increasing demand for non-proprietary access control solutions and provides a safe and secure gateway to a cloud or hybrid deployment.

“When modernizing an existing security system, Synergis Cloud Link’s open architecture allows organizations to leverage their current access control infrastructure and easily upgrade to a secure IP-based solution. Synergis Cloud Link provides a more efficient approach to multi-site deployments and replaces the need for servers, reducing the cost of ownership.  The Synergis Cloud Link IoT gateway has embedded functionalities that keep an organization’s access control running even when the connection to the server is down,” the company said in a statement.

“The new generation of Synergis Cloud Link provides more features, enhanced cybersecurity, and helps future-proof security installations. Synergis Cloud Link features enhanced cybersecurity such as encrypted user data, Secure Boot, and an EAL6+ industry gold standard Secure Element that stores cryptographic elements,” the company added.

“The need for non-proprietary access control solutions has never been greater,” said Thibault Louvet, Access Control Product Group Director, Genetec Inc. “Our new generation Synergis Cloud Link enables us to provide organizations with a powerful, secure, and intelligent gateway to the latest technology while allowing them to easily connect to hybrid or cloud access control environments and keep their existing security investment including hardware, wiring, and infrastructure.”

The device is compatible with non-proprietary access control modules from the industry’s most established manufacturers including HID Global, Axis Communications, ASSA ABLOY, Mercury Security, Allegion, SimonsVoss, STid, and others. A single Synergis Cloud Link device can support up to 256 readers and electronic locks, 600,000 cardholders, 150,000 offline events, as well as monitor hundreds of zones and alarms.

Synergis Cloud Link features a new firmware design, improving reliability and lifecycle management, and updates management. It also opens the door to containerized approach for operating software on the device, expanding its future capabilities.

Continue Reading

Cyber Security

Surge in Ransomware Attacks Has Made Effective Cyber Security and Defence a Top Priority

Published

4 days ago

on

June 27, 2022

By

Emad Fahmy, the Systems Engineering Manager for Middle East at NETSCOUT, speaks about the evolving threat landscape in the region

How has the security threat landscape evolved in recent months?
According to a 2021 survey by PwC, cybersecurity is a growing concern for organizations, with approximately 43% of Middle East CEOs planning to increase investments in cybersecurity and data privacy by 10% or more over the next three years. Moreover, 41% of these leaders think that their organization should be doing more to measure cybersecurity. The ever-evolving threat environment has made it increasingly necessary to be vigilant.

Cybercrimes continue to grow in terms of both complexity and frequency. Among the businesses that identify breaches or attacks, 21% lose money, data, or other assets, and 35% report being negatively impacted in other ways and suffering from wider business disruption. As such, it’s vital for enterprises to ensure the security of data, applications, networks, and critical business processes to stay competitive and thwart attackers. Depending on traditional security solutions and methodologies isn’t enough to combat the sophisticated attacks that target businesses today.

Is ransomware still an issue?
It is, unfortunately. The unprecedented surge in ransomware attacks has made effective cyber security and defence a top priority in today’s world. Every day, new ransomware attacks are reported by businesses and government authorities alike, not to mention the attacks that go unreported, and it seems like no one is immune.

Threat intelligence is vital to combat ransomware attacks. Threat intelligence is the study of the bad actors who perpetrate these attacks, along with the tactics and tools they use. This involves unveiling the bad actor’s attack methodologies and why they are targeting those victims. This knowledge is then turned into actionable insight that enterprises can access and comprehend. Empowered with this knowledge, enterprises can learn about their network’s vulnerabilities to actively defend against ransomware.

Companies have been trying to protect the endpoint for years. How can companies make sure endpoints are protected and monitored for attacks and mitigation?
As service providers increasingly focus on cloud services, edge computing, end-users, and endpoint devices, the traditional approach of utilizing distributed detection solutions in concert with centralized mitigation centres within the network is no longer enough. However, mitigation measures that are distributed out to the network edge necessitate both infrastructure and intelligent defence capabilities that are capable of working hand in hand across locations and platforms.

A more modern threat mitigation strategy involves distributing both detection and mitigation functions throughout the network to intercept threats nearer to the source. In this way, network operators can stop attacks upstream, instead of having to incur the cost of peering and transit link traffic that is only going to be discarded once it reaches a centralized scrubbing centre. By conducting the scrubbing as close as possible to the threat source, service providers can reduce any potential impact on traffic, helping to ensure high-quality service.

Continue Reading
Advertisement


Follow Us

Trending

Copyright © 2021 Security Review Magazine. Rysha Media LLC. All Rights Reserved.