Phishing continues to be a primary initial access vector in cyberattacks against industrial control systems, according to researchers at Dragos. Out of the fifteen threat groups tracked by the security firm, ten rely on spear phishing attachments to compromise their victims, and thirteen abuse valid accounts to maintain persistence.
STIBNITE, a threat actor that targets wind turbine companies in Azerbaijan, uses fake login pages and malware-laden documents to compromise its victims.
“STIBNITE gains initial access via credential theft websites spoofing Azerbaijan government organizations and phishing campaigns using variants of malicious Microsoft Office documents,” Dragos says. “STIBNITE also used information related to the global COVID-19 pandemic for malicious document themes.”
TALONITE, a threat group that focuses on the US electric sector, uses spear phishing to deliver malicious documents.
“TALONITE’s phishing campaigns utilize electric and power grid engineering-specific themes and concepts, indicating an intent to gain a foothold within energy sector entities,” the researchers write. “Such access could facilitate gathering host and identity information, collecting sensitive operational data, or mapping the enterprise environment to identify points of contact with ICS. The identified infrastructure and phishing emails spoofed the National Council of Examiners for Engineering and Surveying (NCEES), North American Electric Reliability Corporation (NERC), the American Society of Civil Engineers (ASCE), and Global Energy Certification (GEC).”
Dragos stresses that malicious cyber activity targeting industrial control systems is increasing, with four new ICS-targeting threat actors spotted in 2020.
“Data from our YIR report shows that this trend corresponds with a 3X rise in ICS-focused threats,” said Dragos’ CEO, Robert M. Lee. “The convergence of an increasingly ICS-aware and capable threat landscape with the trend towards more network connectivity means that the practical observations and lessons learned contained in our 2020 YIR report are timely as the community continues to work to provide safe and reliable operations
New-school security awareness training can give your organization an essential layer of defense by enabling your employees to thwart targeted phishing attacks.
Dragos has the full story.
Here's how it works:
