Connect with us

Cyber Security

US Charges Four Russian Cyber Attackers Targeting Critical Infrastructure

Published

3 years ago

on

The US Department of Justice (DoJ) has charged three Russian FSB officers and a programmer working for a Russian military research institute with past attacks against industrial control systems (ICS) operated by critical infrastructure providers. The attacks involve the 2017 Triton malware that was designed to infect safety instrumented system (SIS) controllers made by Schneider Electric’s Triconex division and the 2013 Havex remote access Trojan that included a module to map supervisory control and data acquisition (SCADA) on networks.

These malware threats were used against energy sector organizations including oil and gas firms, nuclear power plants, and power transmission companies. While these threats were attributed by security researchers in the past to Russian state-sponsored groups, this is the first time when individuals directly linked to Russian government agencies or organizations are named in relation to the attacks.

The US charged Evgeny Viktorovich Gladkikh, a 36-year-old programmer working for the Russian Central Scientific Research Institute of Chemistry and Mechanics (TsNIIKhM), for his role in a campaign meant to hack into oil refineries around the world, including the US At least one of those attacks resulted in the successful deployment of the Triton malware, which was developed at TsNIIKhM, one of Russia’s oldest state research centers that work under the country’s Ministry of Defense and specialises in creating new advanced weapons for use in space warfare and cyber operations, the unsealed indictment says.

The 2017 incident led to the discovery of the Triton malware after a glitch in the malware’s code after being deployed on Triconex SIS controllers at the refinery triggered two safety shutdown events. The indictment notes that Gladkikh was directly involved in the attack, planting backdoors on machines inside the organization’s network, familiarizing himself with organisation’s safety logs, the results of past safety exercises and the planned response, the software versions used on logging servers, and exact model and features of the Triconex SIS devices.

He was also directly responsible for deploying the Triton malware on the organization’s SIS devices that were connected to computer machines that he backdoored. These machines were part of the organization’s distributed control system (DCS) and one of them controlled sensitive physical processes that involved sulfur recovery and burner management. Improper operation of these systems could have led to the release of toxic gasses or explosions.

The prosecutors believe the goal of Gladkikh and his co-conspirators was to use the Triton malware to cause physical damage or catastrophic failures at the refinery by altering the safety operating parameters while making it seem to operators that everything was normal. Instead, the malware configuration inadvertently triggered faults in the SIS devices triggering their safety shutdown protocol, which gave the attack away and ultimately led to the discovery of the Triton malware.

However, the group’s attempts to compromise oil refineries didn’t stop. According to the indictment, Gladkikh found a research paper authored in the 1970s on a site run by the US Department of Defense that included an extensive survey of oil refineries in the US and their physical vulnerabilities, including the impact of possible explosions and fires. This paper allowed him and his co-conspirators to identify two refineries that are currently operated by a US-based company and then attempt to gain access to public servers run by that company through SQL injections and vulnerability scans. These attempts were unsuccessful.

Gladkikh was charged with one count of conspiracy to cause damage to an energy facility and one count of attempt to cause damage to an energy facility, both carrying a maximum sentence of 20 years in prison each, and one count of conspiracy to commit computer fraud, which carries a maximum sentence of five years in prison.

In another indictment, the DoJ charged Pavel Aleksandrovich Akulov, Mikhail Mikhailovich Gavrilov, and Marat Valeryevich Tyukov, three officers in Military Unit 71330 or “Center 16” of the FSB, Russia’s internal security service, with computer fraud and abuse, wire fraud, aggravated identity theft and causing damage to the property of an energy facility. These charges are in relation to the use of the Havex malware between 2012 and 2017 against multiple organizations.

The Havex malware is a remote access Trojan that the security industry attributed in the past to a Russian state-sponsored threat group tracked as Dragonfly, Berzerk Bear, or Energetic Bear. Havex is also noteworthy because between 2012 and 2014 attackers used software supply chain compromises, among other attack vectors, to distribute it.

Particularly, the hackers managed to compromise servers belonging to companies that provided ICS and SCADA software and Trojanize their software updates. Examples include the MESA Imaging driver; a component called eCatcherSetup made by eWON, a company that provided a remote maintenance service for ICS systems; and multiple tools made by MB Connect, a company that provided a VPN service and network router for industrial systems.

The Dragonfly group used many other attack vectors as well, including watering hole techniques that involved compromising websites commonly visited by employees from its targeted sector to serve credential theft malware, spear phishing emails sent from fake addresses created from inside compromised energy organizations, exploiting web-based vulnerabilities in publicly exposed servers, and more.

The Havex malware was not directly designed to compromise ICS controllers, but it contains a module that allows attackers to scan the compromised networks for SCADA applications. These are management applications that usually run on Windows workstations and are designed to monitor and control industrial processes. This shows the attackers had a clear interest in gaining control over such workstations.

Over its years of operation, the Dragonfly group managed to infect over 17,000 unique systems with Havex, including ICS/SCADA controllers used by power and energy companies, the prosecutors say. The group’s spear-phishing attacks targeted more than 3,300 users at over 500 organizations in the US and abroad, including the US Nuclear Regulatory Commission.

Following the unsealing of the indictments, CISA and the Department of Energy published a detailed advisory with additional technical details about the Triton and Dragonfly attacks. The advisory also includes security best practices and recommendations for critical infrastructure operators.

Related Topics:
Continue Reading

Cloud

SentinelOne Simplifies Secure Cloud Migrations on AWS

Published

9 hours ago

on

June 13, 2025

By

SentinelOne today announced its participation in the Amazon Web Services (AWS) Independent Software Vendor (ISV) Workload Migration Program. This initiative supports AWS Partner Network (APN) members with SaaS offerings on AWS to accelerate and streamline workload migrations.

Through the program, SentinelOne will provide AWS customers with accelerated, secure cloud migration support, leveraging modern AI-powered CNAPP capabilities to ensure rapid and protected transitions. With access to AWS funding, technical resources, and go-to-market support, SentinelOne will help organizations reduce migration timelines and costs while maintaining robust security.

SentinelOne’s Singularity Cloud Security delivers real-time visibility and protection throughout the migration journey—whether from on-premises or another cloud—enabling a secure, seamless transition to AWS.

“Through our participation in the AWS ISV Workload Migration Program, SentinelOne is helping customers accelerate secure cloud migrations with end-to-end protection and visibility,” said Ric Smith, President of Product, Technology, and Operations at SentinelOne. “Whether moving from on-prem or another cloud to AWS, organizations can count on us to deliver the security they need throughout their journey—realizing the performance, speed, agility, and cost benefits of the cloud.”

Singularity Cloud Security combines agentless and agent-based protection for deep visibility, continuous posture management, and real-time threat detection across hybrid and multi-cloud environments. By collaborating with AWS and ecosystem partners, SentinelOne ensures seamless integration into migration projects, helping customers move faster, reduce risk, and scale confidently in the cloud.

Availability: SentinelOne’s solutions are available globally.

Continue Reading

Cyber Security

Beyond Blocklists: How Behavioural Intent Analysis Can Safeguard Middle East Businesses from Rising AI-Driven Bot Threats

Published

3 days ago

on

June 10, 2025

By

The Middle East is facing an unprecedented surge in AI-driven bot attacks, with malicious automation now outpacing traditional defenses. Mohammad Ismail, Vice President for EMEA at Cequence Security, warns that legacy tools like IP blocklists and rate limiting are no match for today’s sophisticated threats (more…)

Continue Reading

Cyber Security

Sophos Boosts Firewall with New Protection and Incident Response Features

Published

3 days ago

on

June 10, 2025

By

Sophos has announced a significant update to its Sophos Firewall software, introducing enhanced protection and incident response capabilities. This update notably includes Sophos NDR Essential, a new feature now available free of charge to all customers holding an XStream Protection license for Sophos Firewall.

This integration empowers Sophos Firewall with two dedicated artificial intelligence (AI) engines specifically designed to detect both malware communications and those utilizing algorithmically generated domain names. This advanced functionality, derived from the Sophos Network Detection and Response (NDR) probe, aims to identify sophisticated malware communications even if they are previously unknown or not yet indexed. It serves as a powerful complement to the Active Threat Response capabilities already embedded within Sophos firewalls.

Chris McCormack, Senior Product Marketing Manager at Sophos

Addressing the technical demands of such advanced detection, Chris McCormack, Senior Product Marketing Manager at Sophos, explained the strategic approach, “NDR traffic analysis requires substantial processing power. That’s why we’ve adopted a new approach by deploying an NDR solution in Sophos Cloud to offload the heaviest tasks from the firewall.” This cloud-centric design ensures optimal performance without burdening the firewall’s on-device resources.

Beyond network detection, the update also brings significant improvements to connectivity and user authentication. Sophos Connect now integrates EntraID for Single Sign-On (SSO). This new feature for the VPN client, bundled with Sophos Firewall, is set to enhance both the security and user experience for SSL and IPsec VPN connections. The integration with EntraID (Azure AD) enables users to authenticate and leverage multi-factor authentication for both Sophos Connect and access to the user portal hosted by the firewall, streamlining secure access.

Further VPN-related enhancements include:

  • Improved user interface and usability: Connection types have been renamed for greater clarity, with “site-to-site” now referred to as “policy-based” and tunnel interfaces as “route-based,” making configurations more intuitive.
  • Dynamic validation of the IP address pool: For VPN connections (SSL VPN, IPsec, L2TP, and PPTP), the system now dynamically validates the allocated IP address pool, helping to better resolve potential IP address conflicts.
  • Strict profile enforcement: IPsec profiles now exclude default values to ensure algorithm synchronization, effectively eliminating potential fragmentation of session negotiation packets that could otherwise prevent site-to-site VPN tunnels from being established.
  • Route-based VPN and SD-RED scalability: The system has been optimized to support up to 3,000 simultaneously established tunnels. Specifically, Sophos Firewall solutions can now manage up to 1,000 SD-RED site-to-site tunnels and connect up to 650 concurrent SD-RED devices.

Additional management improvements enhance administrative flexibility and search capabilities:

  • More flexible DHCP Prefix Delegation (IPv6 DHCP-PD): The system now supports a broader range of prefixes, from /48 to /64, improving compatibility with various internet service providers.
  • Router Advertisement (RA) and DHCPv6 server: These features are now enabled by default, simplifying IPv6 network setup.
  • Resizable table columns: The web admin interface continues its adaptation for ultra-wide screens, with many configuration pages now allowing users to resize columns as needed for improved usability.
  • Enhanced object search functionality: The search field within the SD-WAN routing configuration screen now supports more granular criteria, including route name, ID, objects, and object values like IP addresses and domains. Similarly, local ACL rules now also support object name and value searches, extending to content-based searches for more precise results.
  • Default configuration changes: To streamline initial setups, default firewall rules and rule groups previously created during new firewall deployments have been removed. The initial configuration now only includes the default network rule and MTA rules. Furthermore, the default firewall rule group and the default gateway probe for custom gateways are now set to “None” by default.

Sophos continues its commitment to cybersecurity through a “Secure by Design” approach, enhancing the intrinsic security of its firewalls. This methodology involves the containerization of specific features and rigorous integrity checks on critical operating system files using mathematical checksums. Any detected checksum mismatch triggers a potential compromise alert, enabling monitoring teams to proactively identify possible security incidents affecting the firewall OS integrity. This proactive detection allows incident response and development teams to react swiftly to critical security events.

This update is now available for manual download and deployment by customers with any Sophos Firewall equipped with a valid license.

Continue Reading
Advertisement

Follow Us

Trending

Copyright © 2021 Security Review Magazine. Rysha Media LLC. All Rights Reserved.