Energy: the new target
A hacker group called Xenotime, described as “the most dangerous”, has a new target: the power grid.
According to Dragos, a well-known security company, cyber threats to ICS systems are proliferating.
Not only that, the most dangerous hacker groups have now turned their attention to one of the most important and sensitive sectors in today’s world: energy.
Read their report HERE.
“The most dangerous threat to ICS systems has new targets in its sights”, said Dragos. “This expansion towards higher-level targets illustrates a trend that is likely to occur with other hacker groups that target ICS.”
In particular, the same group of people believed to be behind the attacks on petrochemical plants in Saudi Arabia is now threatening power grids around the world.
Xenotime has in fact attacked some organisations operating in the US energy sector using the same methods previously seen against Saudi Arabia: the malware known as TriSIS.
“ICS asset owners and operators must be aware of the tactics, techniques and procedures of these cyber criminals.”
Dragos
The purpose of these attacks is anything but peaceful or a form of protest.
The malware was designed to cause physical harm to property and people (even death).
Xenotime is in fact the only known group that targets safety instrumented systems alone, and for destructive purposes.
Only in 2019 did Dragos identify the correlation between the various attacks that have occurred around the world. This activity indicates that the group may be preparing for a future large-scale cyber attack.
It should be stressed that the observed behaviour is an “expansion” and not a shift of the threat, so oil and gas entities must remain vigilant.
“Although none of the electric utility events has led to a known, successful intrusion into the victim organisations to date, the persistent attempts and the expansion in scope are cause for clear concern”.
Dragos
Organisations that operate industrial control systems should prepare for potential breach and disruption scenarios.
The most important thing a security team can do is improve awareness of ICS network activity.
Companies should work on scenarios that handle the potential loss of system integrity, with security tools such as an incident response team and data controls, both to compare against possibly compromised devices and to aid recovery in the event of a breach.
ICS infrastructure – from power grids to factories and rail networks – is on the rise and “… the most capable adversaries are investing heavily in the ability to disrupt critical infrastructure such as oil and gas, electric power, water and more”.
Dragos
Now is the time to plan, implement and enforce security standards and response processes in industrial environments.