Cyber attacks targeting industrial control systems on the rise

Malicious activity targeting industrial control systems (ICS) affected 47.2% of computers protected by security firm Kaspersky Lab in 2018, up from 44% in 2017.

This increase indicates the cyber threat against computers defined as part of organisations’ industrial infrastructure is rising, according to the latest Threat landscape for industrial automation systems report by Kaspersky Lab’s ICS computer emergency response team (Cert).

The Cert is aimed at coordinating the efforts of automation system suppliers, industrial facility owners and operators, and IT security researchers to protect industrial enterprises from cyber attacks.

Malicious cyber activities on ICS computers are considered an “extremely dangerous threat”, the company said, because they could potentially cause material losses and production downtime in the operation of industrial facilities, which can include systems that form part of countries’ critical national infrastructure.

The financial impact of the recent ransomware attack affecting industrial systems at Norwegian aluminium producer Norsk Hydro could be up to nearly $41m, according to preliminary estimates.

The top three countries in terms of the percentage of ICS computers on which Kaspersky Lab prevented malicious activity were Vietnam (70%), Algeria (69.9%) and Tunisia (64.5%).

The most secure countries in the ranking are Ireland (11.7%), Switzerland (14.9%), Denmark (15.2%), Hong Kong (15.3%), the UK (15.7%) and the Netherlands (15.7%).

“Despite the common myth, the main source of threat to industrial computers is not a targeted attack, but mass-distributed malware that gets into industrial systems by accident, over the internet, through removable media such as USB-sticks or e-mails,” said Kirill Kruglov, security researcher at Kaspersky Lab ICS Cert.

“However, the fact that the attacks are successful because of a casual attitude to cyber security hygiene among employees means they can potentially be prevented by staff training and awareness – this is much easier than trying to stop determined threat actors,” he said.

In August 2018, researchers at security firm Cybereason concluded there was a distinct set of cyber attackers who specialise in targeting ICS computers, based on a study that analysed the data collected in a honeypot that was designed to look like a power transmission sub-station of an electricity supplier.

The attackers who accessed the honeypot appeared to have been specifically targeting the ICS environment from the moment they got into the environment, the researcher said, demonstrating non-commodity skills, techniques and a pre-built playbook for pivoting from an IT environment towards an OT environment.

Accessing the OT environment is the ultimate goal of these specialised attackers, the researchers said, because these systems operate the pumps, monitors, breakers and other hardware found in utility providers that could be used to control or disrupt services.