{"id":21647,"date":"2022-04-14T17:34:01","date_gmt":"2022-04-14T17:34:01","guid":{"rendered":"https:\/\/www.esecurityplanet.com\/?p=21647"},"modified":"2023-07-27T15:14:59","modified_gmt":"2023-07-27T15:14:59","slug":"critical-infrastructure-ics-scada-under-attack","status":"publish","type":"post","link":"https:\/\/www.esecurityplanet.com\/threats\/critical-infrastructure-ics-scada-under-attack\/","title":{"rendered":"Critical Infrastructure, ICS\/SCADA Systems Under Attack by Advanced Threat Groups"},"content":{"rendered":"

Critical infrastructure<\/a>, industrial control (ICS) and supervisory control and data acquisition (SCADA) systems are under increasing threat of cyber attacks, according to a number of recent warnings from government agencies and private security researchers.<\/p>\n

CERT-UA (Computer Emergency Response Team of Ukraine) reported<\/a> a major attack on Ukrainian energy infrastructure last week. Researchers at ESET and Microsoft collaborated with CERT-UA to analyze the attacks and discovered evidence of a new variant of a known malware<\/a>.<\/p>\n

Sandworm<\/a>, the advanced persistent threat (APT)<\/a> group associated with the attack, attempted to disrupt high-voltage electrical substations, probably to destabilize critical energy infrastructures. The state-sponsored group used a new version of the malware \u201cIndustroyer,\u201d dubbed \u201cIndustroyer2\u201d (or \u201cIndustroyer reloaded\u201d), that focuses on disk-wiping and data destruction.<\/p>\n

They wrote advanced destructor scripts in Bash to erase traces of the attack and make the system unrecoverable. The ultimate objective was “decommissioning of several infrastructural elements,” according to CERT-UA.<\/p>\n

While the CERT team declared that “the implementation of the malicious plan has so far been prevented,” the incident adds to the heightened state of alert<\/a> that’s been in place since Russia’s imminent attack against Ukraine became apparent.<\/p>\n

U.S. cybersecurity agencies yesterday encouraged<\/a> U.S. critical infrastructure organizations to be on alert for similar threats against ICS\/SCADA systems and to review recommended mitigations to prevent attacks.<\/p>\n

Indeed, Sandworm’s tactics and procedures can be used to take down energy companies anywhere in the world, including U.S. and European facilities.<\/p>\n

Also read: SANS Outlines Critical Infrastructure Security Steps as Russia, U.S. Trade Cyberthreats<\/a><\/p>\n

Latest Sandworm Attack Against Ukraine<\/strong><\/h2>\n

The Sandworm APT group has been behind a number of destructive attacks, especially against Ukraine’s power grid<\/a>. For example:<\/p>\n