A hacking group described at the 'most dangerous threat' to industrial systems has taken a close interest in power grids in the US and elsewhere, according to a security company.
The hacking group believed to be behind the attack on the industrial control systems (ICS) of a petrochemical plant in Saudi Arabia are now apparently probing more potential victims around the world including US power grids according to security company Dragos.
"The most dangerous threat to ICS has new targets in its sights," Dragos said. "This expansion to a new vertical illustrates a trend that will likely continue for other ICS-targeting adversaries."
SEE: Can Russian hackers be stopped? Here's why it might take 20 years (TechRepublic cover story) | Download the PDF version
This particular hacking group is notable because of one incident it was involved with. In late 2017 it was revealed that hackers had infected the industrial control systems of a petrochemical plant in Saudi Arabia with malware – known as Triton or Trisis – which was designed to interfere with industrial safety systems.
The malware targeted the systems that controlled the emergency shutdown capabilities, and security companies warned that the attackers were developing the capability to cause physical damage and potentially shutdown operations. At the time analysts warned the activity was consistent with a nation state preparing for an attack; later analysis by security company FireEye linked the malware to a Russian state-owned research lab.
In April, FireEye also said the same malware had been discovered on systems at another, unnamed company. And now Dragos has warned that the group behind the malware – which is calls Xenotime - has been probing US and Asia-Pacific power networks after previously focusing only on oil and gas.
"Starting in late 2018, Xenotime began probing the networks of electric utility organizations in the US and elsewhere using similar tactics to the group's operations against oil and gas companies," Dragos said.
Dragos said the 2017 attack on the Saudi Arabian oil and gas facility represented an escalation of attacks on ICS because the malware targeted safety systems and was designed to cause loss of life or physical damage. The company said that since that attack the hacking group has expanded its operations to include oil and gas firms outside the Middle East and said the group compromised several ICS vendors and manufacturers in 2018.
Dragos said that since 2017 the hacking group's activities have included significant external scanning and research on potential victims and attempts at external access focused on North American and European companies.
In February this year, Dragos said, it spotted attempts to gather information associated with US and Asia-Pacific electric utilities.
"This behavior could indicate the activity group was preparing for a further cyberattack," the company said. Dragos said it had seen attempts to use lists of previously stolen usernames and passwords to try and force entry into target accounts. But it also said that none of the electric utility-targeting events has resulted in a successful intrusion.
Dragos said that evidence of this group's interest in electric utility operations is "a cause for deep concern given this adversary's willingness to compromise process safety."
The security company said most of the activity by the hacking group focuses on initial information gathering and access operations necessary for follow-on ICS intrusion operations and future attacks. But it also said there is no evidence indicating that this group is actually capable of executing a disruptive or destructive attack on electric utility operations
Dragos said that organisations running industrial control systems should prepare for potential breach and disruption scenarios. It said the most important thing a security team can do is improve their awareness of ICS network activity. Companies should also have worked on scenarios that deal with the potential loss of safety instrumented systems integrity, like having incident response teams on call and configuration and process data both for comparison to possible compromised devices, and aid recovery in the event of a breach.
"ICS operators must address such concerns in advance, rather than trying to figure out such sensitive, complex items mid- or post-intrusion," Dragos warned.
Threats to industrial control systems – the infrastructure that runs everything from power grids to factories and rail networks – are on the rise, according to security experts. "More capable adversaries are investing heavily in the ability to disrupt critical infrastructure like oil and gas, electric power, water, and more," said Dragos.