According to the recent
Kaspersky
ICS CERT report, a concerning percentage of industrial control system (ICS)
computers in the energy sector globally were targeted by cyberattacks in the
first six months of 2019. Of the Kaspersky solutions installed on ICS
computers, 41.6% experienced and blocked a cyber threat. The three main cyber
threats detected in energy ICS environments included worms (7.1%), spyware
(3.7%) and cryptocurrency miners (2.9%).
Industrial cyber incidents are among the most dangerous
cyberattacks as they typically result in production downtime, tangible
financial losses and are difficult to overcome. This is especially true when
incidents occur in critical, life-supporting sectors such as energy. Malware
infections can also negatively affect the availability and integrity of ICS and
other systems that are part of the industrial network.
Among the threats that were detected in H1 2019, a few were
particularly unique. This includes Agent Tesla, a specialized Trojan spy
malware designed to steal authentication data, screenshots and data captured
from web cameras and keyboards. Kaspersky products also identified and blocked
cases of the Meterpreter backdoor which was being used to remotely control
computers on the industrial networks of energy systems. Attacks that use the
backdoor are targeted and often conducted in manual mode. Syswin, a new wiper
worm written in Python and packed into the Windows executable format, was also
detected. This threat can have a significant impact on ICS computers due to its
ability to self-propagate and destroy data.
Kaspersky experts also analyzed the automotive manufacturing
(39.3%) and building automation (37.8%) industries, taking the second and the
third place respectively to the percentage of ICS computers on which malicious
objects were blocked.
Additional report findings include:
- On average, ICS
computers do not operate entirely inside the security perimeter of typical
corporate environments, meaning tasks related to protecting the ICS and
corporate segment are, to some extent, unrelated.
- Generally, the level of
malicious activity inside the ICS segment is connected with malware
activity happening in the country where the ICS environment is located.
- In countries where the
security of ICS is favorable, low levels of compromised ICS computers are
attributable to protection measures and tools that are in place rather
than a limited level of malicious activity.
- Self-propagating
malicious programs are very active in some countries. In the cases
analyzed, these were worms designed to infect removable media (USB flash
drives, removable hard drives, mobile phones, etc.). It appears that
infections with worms via removable media is the most common infection
scenario for ICS computers.
"The collected statistics, as well as analysis into
industrial cyberthreats, are a proven asset for assessing current trends and
predicting what type of danger we should all prepare for," says Kirill
Kruglov, security researcher at Kaspersky. "This report has identified that
security experts should be particularly cautious about malicious software that
aims to steal data, spy on critically important objects, penetrate the
perimeter and destroy the data. All of these types of incident could cause lots
of trouble for the ICS industry."
For more information, read the full report on
Kaspersky ICS CERT.