While news reports indicate no impact to the utilities company’s ability to deliver electricity to its’ customers, this could be the start of attacks on critical infrastructure in Australia.
On November 27, Australian electricity giant, CS Energy released a statement indicating they had suffered a ransomware attack by a Conti ransomware affiliate. Early indications pointed to the attack coming from China, but there is no conclusive evidence that this was a nation-state attack.
According to an update on the situation, CS Energy indicated that cybersecurity safeguards designed to isolate the infected corporate from their operational network that is responsible for delivering electricity contained the attack, and that operations have been continuous throughout their response, as they continue to restore impacted systems.
The United States has had its’ fair share of attacks on critical infrastructure and utilities companies, causing response and action from the federal government. We will need to keep an eye collectively and see if this same attack trend follows suit into Australia.
In a recent Conti attack, threat actors used malicious Google Ads mixed with social engineering to trick users into engaging with malicious content that inevitably installed ZLoader – a delivery mechanism for Conti.
It’s critical for utilities companies around the world to realize the target that exists on their corporate back; threat actors see these kinds of companies as prime targets that may be more apt to pay a ransom to ensure needed services stay operational. One method includes enabling users to identify suspicious content before engaging with it through Security Awareness Training. By continually educating users on the scams, tactics, and campaigns used by cybercriminals, the likelihood of successful attack drops significantly.
Here's how it works:
