It has been reported that one of Iran’s most active hacker groups appears to have shifted focus. Rather than just standard IT networks, they’re targeting the physical control systems used in electric utilities, manufacturing, and oil refineries. At the CyberwarCon conference today, a Microsoft security researcher plans to present new findings that show this shift in the activity of the Iranian hacker group APT33, also known by the names Holmium, Refined Kitten, or Elfin.
Microsoft warns that Iranian hacker group APT33 has been targeting dozens of suppliers of industrial control systems, possibly with the intention of disruptive attacks. “They’re looking to inflict some pain on someone’s critical infrastructure.” https://t.co/0ZfPm92lOR
— Andy Greenberg (@a_greenberg) November 20, 2019
Experts Comments
November 23, 2019
Aside from something with criminals attacking companies for financial gain, there are state-sponsored and other groups engaged in espionage against specific industries and the automotive industry is no exception.
While the FBI has not offered details in its report, it is clear that these criminal actors often gain access through phishing emails or by compromising weak credentials.
As such, user awareness and training is is an essential part of protecting organisations. A strong security.....Read More
Like(
November 23, 2019
Governments and critical infrastructure organisations should absolutely be worried about these threats. As the lines between IT and OT become more and more blurry, cybercriminals and nation states are realising that targeting these critical OT systems can cause huge damage, especially if their end goal is chaos and disarray. Because utilities offer critical services, it will increasingly make them targets for these kind of attacks. What’s more, they often can have significant gaps in.....Read More
November 23, 2019
MFA is always the first line of defence against automated password attacks. This should be combined with enforcing strong password policies, and ideally checking passwords against known breached credentials. But even if APT33 does not succeed in accessing your environment, it can still cause damage - the side effect of password spray attacks is that accounts are locked due to too many failed password attempts. This lockout can persist for as long as the attack lasts, preventing the legitimate.....Read More
November 23, 2019
Partially, the attacks as described below are crude and loud, but they seem to work. This is of course a risk and shows again that the use of multi-factor authentication is a good precaution. Anyone operating ICS networks should be careful, and worried, about the security of those devices. The worst cases are when they are exposed in such a manner that they can be reached from the internet or from networks where users are working. A few years back Outpost24 researched SCADA systems in use in.....Read More
November 23, 2019
Sadly, one can only hope - at least for the time being - that APT33’s or any other group’s focus on manufacturers and ICS-related industries is limited to reconnaissance and espionage. The damage of identity or IP theft would pale in comparison to the catastrophic failure of a power plant in the dead of winter or any number of unthinkable scenarios.
In a world where there general public has grown largely desensitized to the daily occurrence of data breach, it’s likely that attacks on.....Read More
November 22, 2019
There’s a common misconception that OT systems are less vulnerable to attack that IT systems. It’s not necessary to hack physical equipment to cause disruption or damage to industrial equipment. The control system (SCADA and others) are largely run on conventional Windows machines and vulnerable to a wide range of external, supply chain and insider attacks. We’ve seen repeatedly, with attacks from Stuxnet to Triton/Trisis, that fileless, and in-memory attacks can take hijack the control.....Read More
November 22, 2019
Sadly, one can only hope - at least for the time being - that APT33’s or any other group’s focus on manufacturers and ICS-related industries is limited to reconnaissance and espionage. The damage of identity or IP theft would pale in comparison to the catastrophic failure of a power plant in the dead of winter or any number of unthinkable scenarios.
In a world where there general public has grown largely desensitized to the daily occurrence of data breach, it’s likely that attacks on.....Read More
November 22, 2019
Microsoft's research into APT33's recent targeting of industrial control systems reminds us that in the great cyber game, it’s about using peacetime to build “optionality”; amass assets, resources and access. The Iranian cyber forces are masters of this, and seeing increases in the cold war that is cyber conflict, it makes sense that they would continue to grow what’s worked in the past: expand penetration of weak networks with high access, produce tools for use in the ecosystem of.....Read More
Submit Your Expert Comments
What do you think of the topic? Do you agree with expert(s) or share your expert opinion below.Be part of our growing Information Security Expert Community (1000+), please register here.
Linkedin Message
@Raphael Reich, Vice President, provides expert commentary at @Information Security Buzz.
"Finding and eliminating this shadow risk is a prerequisite to keeping attackers out of organizations...."
#infosec #cybersecurity #isdots
https://informationsecuritybuzz.com/expert-comments/comment-notorious-iranian-hacking-crew-is-targeting-industrial-control-systems
Facebook Message
@Raphael Reich, Vice President, provides expert commentary at @Information Security Buzz.
"Finding and eliminating this shadow risk is a prerequisite to keeping attackers out of organizations...."
#infosec #cybersecurity #isdots
https://informationsecuritybuzz.com/expert-comments/comment-notorious-iranian-hacking-crew-is-targeting-industrial-control-systems