Comment: Notorious Iranian Hacking Crew Is Targeting Industrial Control Systems

It has been reported that one of Iran’s most active hacker groups appears to have shifted focus. Rather than just standard IT networks, they’re targeting the physical control systems used in electric utilities, manufacturing, and oil refineries. At the CyberwarCon conference today, a Microsoft security researcher plans to present new findings that show this shift in the activity of the Iranian hacker group APT33, also known by the names Holmium, Refined Kitten, or Elfin.

Experts Comments

November 23, 2019
Raphael Reich
Vice President
CyCognito
In today's hyperconnected world, discovering attack vectors such as software vulnerabilities means first discovering all of the assets in an organization's attacker-exposed IT ecosystem. But, many of these assets and their associated risks lurk in the shadows because they are unmanaged by the organization itself. Instead, the assets belong to cloud providers, partners, subsidiaries, etc. Finding and eliminating this shadow risk is a prerequisite to keeping attackers out of organizations.
November 23, 2019
Javvad Malik
Security Awareness Advocate
KnowBe4
Aside from something with criminals attacking companies for financial gain, there are state-sponsored and other groups engaged in espionage against specific industries and the automotive industry is no exception. While the FBI has not offered details in its report, it is clear that these criminal actors often gain access through phishing emails or by compromising weak credentials. As such, user awareness and training is is an essential part of protecting organisations. A strong security.....Read More
Aside from something with criminals attacking companies for financial gain, there are state-sponsored and other groups engaged in espionage against specific industries and the automotive industry is no exception. While the FBI has not offered details in its report, it is clear that these criminal actors often gain access through phishing emails or by compromising weak credentials. As such, user awareness and training is is an essential part of protecting organisations. A strong security culture can help protect against attacks through phishing and also no reduce the likelihood that employees will use weak passwords or reuse passwords across different services. Beyond that companies should also have good monitoring and threat detection controls in place so that if they are breached, threats can be detected and remediated in a timely manner.  Read Less
November 23, 2019
Moreno Carullo
Co-founder and CTO
Nozomi Networks
Governments and critical infrastructure organisations should absolutely be worried about these threats. As the lines between IT and OT become more and more blurry, cybercriminals and nation states are realising that targeting these critical OT systems can cause huge damage, especially if their end goal is chaos and disarray. Because utilities offer critical services, it will increasingly make them targets for these kind of attacks. What’s more, they often can have significant gaps in.....Read More
Governments and critical infrastructure organisations should absolutely be worried about these threats. As the lines between IT and OT become more and more blurry, cybercriminals and nation states are realising that targeting these critical OT systems can cause huge damage, especially if their end goal is chaos and disarray. Because utilities offer critical services, it will increasingly make them targets for these kind of attacks. What’s more, they often can have significant gaps in cybersecurity protection. Therefore, into 2020 and beyond, these organisations need to step up efforts and ensure they have total visibility into their OT environments, the same as they do for IT, so that they can react quickly to potential vulnerabilities and breaches of their defences.  Read Less
November 23, 2019
Stuart Sharp
VP of Solution Engineering
OneLogin
MFA is always the first line of defence against automated password attacks. This should be combined with enforcing strong password policies, and ideally checking passwords against known breached credentials. But even if APT33 does not succeed in accessing your environment, it can still cause damage - the side effect of password spray attacks is that accounts are locked due to too many failed password attempts. This lockout can persist for as long as the attack lasts, preventing the legitimate.....Read More
MFA is always the first line of defence against automated password attacks. This should be combined with enforcing strong password policies, and ideally checking passwords against known breached credentials. But even if APT33 does not succeed in accessing your environment, it can still cause damage - the side effect of password spray attacks is that accounts are locked due to too many failed password attempts. This lockout can persist for as long as the attack lasts, preventing the legitimate user from logging in.Modern SSO methods can protect against account lockout by offering passwordless login flows that prevent password spray attacks from even submitting a password in the first place.  Read Less
November 23, 2019
Martin Jartelius
CSO
Outpost24
Partially, the attacks as described below are crude and loud, but they seem to work. This is of course a risk and shows again that the use of multi-factor authentication is a good precaution. Anyone operating ICS networks should be careful, and worried, about the security of those devices. The worst cases are when they are exposed in such a manner that they can be reached from the internet or from networks where users are working. A few years back Outpost24 researched SCADA systems in use in.....Read More
Partially, the attacks as described below are crude and loud, but they seem to work. This is of course a risk and shows again that the use of multi-factor authentication is a good precaution. Anyone operating ICS networks should be careful, and worried, about the security of those devices. The worst cases are when they are exposed in such a manner that they can be reached from the internet or from networks where users are working. A few years back Outpost24 researched SCADA systems in use in Europe and within a short span of time had contacted a large set of vendors. Very few of the risks received a patch, and for those devices that did indeed receive a patch, none of the patches were rolled out to more than a fraction of the systems we are aware of. This is also one of the reasons they are high value targets for attackers, generally implanting on those systems will grant a persistent access to networks for many years to come, even if the device themselves are not used to cause damage, they are a means to gain a maintained access to networks where they are deployed.  Read Less
November 23, 2019
Adam Laub
CMO
STEALTHbits Technologies
Sadly, one can only hope - at least for the time being - that APT33’s or any other group’s focus on manufacturers and ICS-related industries is limited to reconnaissance and espionage. The damage of identity or IP theft would pale in comparison to the catastrophic failure of a power plant in the dead of winter or any number of unthinkable scenarios. In a world where there general public has grown largely desensitized to the daily occurrence of data breach, it’s likely that attacks on.....Read More
Sadly, one can only hope - at least for the time being - that APT33’s or any other group’s focus on manufacturers and ICS-related industries is limited to reconnaissance and espionage. The damage of identity or IP theft would pale in comparison to the catastrophic failure of a power plant in the dead of winter or any number of unthinkable scenarios. In a world where there general public has grown largely desensitized to the daily occurrence of data breach, it’s likely that attacks on ICS would jolt us all back into reality.  Read Less
November 22, 2019
Ray DeMeo
Co-Founder and COO
Virsec
There’s a common misconception that OT systems are less vulnerable to attack that IT systems. It’s not necessary to hack physical equipment to cause disruption or damage to industrial equipment. The control system (SCADA and others) are largely run on conventional Windows machines and vulnerable to a wide range of external, supply chain and insider attacks. We’ve seen repeatedly, with attacks from Stuxnet to Triton/Trisis, that fileless, and in-memory attacks can take hijack the control.....Read More
There’s a common misconception that OT systems are less vulnerable to attack that IT systems. It’s not necessary to hack physical equipment to cause disruption or damage to industrial equipment. The control system (SCADA and others) are largely run on conventional Windows machines and vulnerable to a wide range of external, supply chain and insider attacks. We’ve seen repeatedly, with attacks from Stuxnet to Triton/Trisis, that fileless, and in-memory attacks can take hijack the control systems, and then easily bring down physical industrial equipment. The ICS industry needs a serious wakeup call to take these threats more seriously, and rapidly implement stronger security across their entire IT/OT stacks.  Read Less
November 22, 2019
Adam Laub
CMO
STEALTHbits Technologies
Sadly, one can only hope - at least for the time being - that APT33’s or any other group’s focus on manufacturers and ICS-related industries is limited to reconnaissance and espionage. The damage of identity or IP theft would pale in comparison to the catastrophic failure of a power plant in the dead of winter or any number of unthinkable scenarios. In a world where there general public has grown largely desensitized to the daily occurrence of data breach, it’s likely that attacks on.....Read More
Sadly, one can only hope - at least for the time being - that APT33’s or any other group’s focus on manufacturers and ICS-related industries is limited to reconnaissance and espionage. The damage of identity or IP theft would pale in comparison to the catastrophic failure of a power plant in the dead of winter or any number of unthinkable scenarios. In a world where there general public has grown largely desensitized to the daily occurrence of data breach, it’s likely that attacks on ICS would jolt us all back into reality.  Read Less
November 22, 2019
Sam Curry
Chief Security Officer
Cybereason
Microsoft's research into APT33's recent targeting of industrial control systems reminds us that in the great cyber game, it’s about using peacetime to build “optionality”; amass assets, resources and access. The Iranian cyber forces are masters of this, and seeing increases in the cold war that is cyber conflict, it makes sense that they would continue to grow what’s worked in the past: expand penetration of weak networks with high access, produce tools for use in the ecosystem of.....Read More
Microsoft's research into APT33's recent targeting of industrial control systems reminds us that in the great cyber game, it’s about using peacetime to build “optionality”; amass assets, resources and access. The Iranian cyber forces are masters of this, and seeing increases in the cold war that is cyber conflict, it makes sense that they would continue to grow what’s worked in the past: expand penetration of weak networks with high access, produce tools for use in the ecosystem of cyber aggressors and build capacity. Iran has been on the receiving end of such attacks, as with Stuxnet, and it’s been the attacker too, as with Saudi Aramco in 2012 this isn’t new, and it isn’t a passing fad. The great game of nations has a cyber extension now for new, less risky and ever-more powerful extensions of politics by other means - to paraphrase Clauswitz. As early as 1992 with the alleged US attack on Siberian pipelines up to and including the Russian Black Energy attack in 2015 on Ukrainian power distribution companies or again the NotPetya attacks of 2017, there is a clear tradition of attacking critical infrastructure by cyber means. It should come as no surprise that nation states are looking to land, expand and grow their options. If you want to hamstring a country, drive trade concessions, win at the diplomacy table or amass power for strategic gains, cyber is the choice of the present and the foreseeable future.  Read Less
What do you think of the topic? Do you agree with expert(s) or share your expert opinion below.
Be part of our growing Information Security Expert Community (1000+), please register here.

Share on facebook
Share on twitter
Share on linkedin

Recent Posts

Information Security Buzz (aka ISBuzz News) is an independent resource that provides the experts comments, analysis and opinion on the latest Information Security news and topics

Twitter Facebook-f Linkedin Youtube

Working With Us

The Pages

Our Contributing Experts