Threat actors have new tools for attacking ICS, SCADA devices, say US cyber agencies

Share post:

American cyber intelligence agencies are warning that unnamed advanced threat actors now have the ability to gain full system access to multiple industrial control system (ICS)/supervisory control and data acquisition (SCADA) devices. The alert issued Wednesday by the U.S. Department of Energy, the Cybersecurity and Infrastructure Security Agency (CISA), the NSA and the FBI is particularly aimed at energy providers. But it also applies to any organization that uses ICS and SCADA devices. The alert says the threat groups have the capability to access a number of devices but particularly:
  • Schneider Electric programmable logic controllers (PLCs);
  • OMRON Sysmac NEX PLCs;
  • Open Platform Communications Unified Architecture (OPC UA) servers.
The threat actors have developed custom-made tools for targeting ICS/SCADA devices., the alert says. The tools enable them to scan for, compromise, and control affected devices once they have established initial access to the operational technology (OT) network. In addition, the actors can compromise Windows-based engineering workstations, which may be present in information technology (IT) or OT environments, using an exploit that compromises an ASRock motherboard driver with known vulnerabilities. By compromising and maintaining full system access to ICS/SCADA devices, APT actors could elevate privileges, move laterally within an OT environment, and disrupt critical devices or functions, the report emphasizes. It urges critical infrastructure organizations to implement the detection and mitigation recommendations provided in the report to detect potential malicious activity and harden their ICS/SCADA devices. Those mitigations include:
  • isolating ICS/SCADA systems and networks from corporate and internet networks using strong perimeter controls, and limit any communications entering or leaving ICS/SCADA perimeters;
  • enforcing multifactor authentication for all remote access to ICS networks and devices whenever possible.
Models at risk
The Schneider Electric MODICON and MODICON Nano PLCs at risk include the TM251, TM241, M258, M238, LMC058, and LMC078 models. The OMRON Sysmac NJ and NX PLCs at risk include the NEX NX1P2, NX-SL3300, NX-ECC203, NJ501-1300, S8VK, and R88D-1SN10F-ECT models. The post Threat actors have new tools for attacking ICS, SCADA devices, say US cyber agencies first appeared on IT World Canada.
Howard Solomon
Howard Solomonhttps://www.itworldcanada.com
Currently a freelance writer, I'm the former editor of ITWorldCanada.com and Computing Canada. An IT journalist since 1997, I've written for ITBusiness.ca and Computer Dealer News. Before that I was a staff reporter at the Calgary Herald and the Brampton (Ont.) Daily Times.

SUBSCRIBE NOW

Related articles

Cyber Security Today, May 24, 2024 – A threat actor leverages Windows BitLocker in ransomware attacks, beware of ORB networks, and more

A threat actor leverages Windows BitLocker in ransomware attacks, beware of ORB networks, and more. Welcome to Cyber Security...

Canada centralizing cybersecurity efforts of federal IT departments

Federal departments and agencies are making only marginal progress in improving their cyber maturity, Ottawa said Wednesday as...

Cyber Security Today, May 22, 2024 – LockBit ransomware gang hits more victims, Fluent Bit servers need to be updated, and more

LockBit ransomware gang hits more victims, Fluent Bit servers need to be updated, and more. Welcome to Cyber Security...

Google criticizes Microsoft’s security practices in new report

Google has publicly criticized Microsoft for a series of security missteps, suggesting that organizations might consider more secure...

Become a member

New, Relevant Tech Stories. Our article selection is done by industry professionals. Our writers summarize them to give you the key takeaways