A highly capable malware reportedly used in a failed plot to blow up a Saudi petrochemical plant has now been linked to a second compromised facility.
FireEye researchers say the unnamed “critical infrastructure” facility was the latest victim of the powerful Triton malware, the umbrella term for a series of malicious custom components used to launched directed attacks.
Triton, previously linked to the Russian government, is designed to burrow into a target’s networks and sabotage their industrial control systems, often used in power plants and oil refineries to control the operations of the facility. By compromising these controls, a successful attack can cause significant disruption — even destruction.
Industries such as manufacturing, energy, utilities, and more using control systems to automate processes are susceptible to attack, resulting in financial and operational damage.
When a piece of malware compromised an endpoint used by a simple knowledge worker, the damage may be limited to that single endpoint and the user’s productivity. But when endpoints running software used to manage industrial control systems (ICS) are attacked, it’s likely that a far worse outcome is intended. These endpoints can control a material portion of an industrial process, bringing operations to a halt should the endpoint be compromised.
And because the endpoints need to, first and foremost, work with the ICS software, many endpoints still run older (read: more vulnerable) versions of Windows.
According to the latest Threat Landscape for Industrial Automation Systems in H2 2018 data from security vendor Kaspersky:
- Nearly 41% of all ICS endpoints were attacked
- Trojan malware was found on 27% of ICS endpoints
- 26% of attacks come from the Internet
Removable media and email also remain concerns, according to the report.
Organizations using ICS software need to make attempts to eliminate vulnerabilities with up-to-date patching of the OS, applications, and web browsers. Additionally, users should be placed in Security Awareness Training to fend of the possible attack vectors mentioned in the Kaspersky report. By educating users on safe security practices around removable media, phishing attacks, and more, organizations with ICS endpoints can minimize the risk of attack, infection, and compromise.
Find out how affordable new-school security awareness training is for your organization. Get a quote now.
