US government warns specialized malware is targeting energy plants

Critical infrastructure organizations in the US are being targeted with custom-built malware, designed specifically for the hardware they use, security and law enforcement agencies in the country are warning.

The new warning was jointly published by the Department of Energy (DOE), the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Federal Bureau of Investigation (FBI).

In it, the agencies are warning of threat actors placing multiple industrial control systems (ICS) and supervisory control and data acquisition (SCADA) devices in their crosshairs – namely Schneider Electric programmable logic controllers (PLCs), OMRON Sysmac NEX PLCs, and Open Platform Communications Unified Architecture (OPC UA) servers.

Chernovite, the state-sponsored attacker

More precisely – Schneider Electric MODICON and MODICON Nano PLCs, including TM251, TM241, M258, M238, LMC058, and LMC078; and OMRON Sysmac NJ and NX PLCs, including NEX NX1P2, NX-SL3300, NX-ECC203, NJ501-1300, S8VK, and R88D-1SN10F-ECT, are being targeted.

Apparently, one of the threat actors is called CHERNOVITE, and this one is trying to deploy malware dubbed PIPEDREAM. Security researchers from cybersecurity firm Dragos have been tracking the ICS-specific malware for some time now, and discovered it initially targets Schneider Electric and Omron controllers. By taking advantage of the endpoints’ native functionality in operations, the malware is somewhat harder to spot.

Dragos CEO, Robert Lee, believes CHERNOVITE is a state-sponsored attacker. 

A separate cybersecurity firm, Mandiant, has been tracking a different malware, called INCONTROLLER. This one, too, targets Schneider Electric tools, and is, too, created and operated by a state-sponsored attacker. 

Although no countries were named, the publication does remind that the Ukrainian officials announced stopping an attack on an energy facility, recently.

Speaking to The Record, chief technology officer of ICS cybersecurity software firm aDolus Technology, said Schneider Electric MODICON PLCs and OPC Unified Architecture (OPC UA) servers are probably targeted because they’re extremely common in the industry.

The potential flaws that could be leveraged, could provide attackers with elevated privileges, lateral movement within an OT environment, and allow for critical devices or functions disruption, he added.

• If you’re looking for a dedicated server hosting service, try these providers

Via: The Record