LockBit 3.0 code release opens Pandora’s box of new threats

When LockBit 3.0 was launched in June, the group touted it as the most powerful encryptor ever built. The launch also led to a 17 percent rise in cyber incidents directly linked to the encryptor. The new variant brought in new features such as more payment options across cryptocurrencies, new monetization options, and more means to recover or destroy data as per the outcome of negotiations with the victim. The files were not just encrypted but exfiltrated as well to put additional pressure on the victim. A typical attack begins with the victim’s device being infected and the files being encrypted with a jumbled extension. The process of data encryption is done at a rapid speed with multiple tasks being done in parallel. The infection becomes apparent with the wallpaper of the victim’s machine being changed to a ransom note. In case the ransom is not paid on time, the victim’s data is then put up for sale on the Dark Web and other forums. Sample of LockBit 3.0 Ransome Note At the time of writing this blog post, we did come across an APAC enterprise that was successfully targeted by the LockBit 3.0 group. The ransom note asked the victim to pay $10000 to extend the deadline by 24 hours, $500000 to destroy all information, and a similar amount to download the data at any time. LockBit 3.0 was much in demand in Ransomware as a Service market. Which explains the sudden and steep rise in LockBit 3.0-linked attacks. The group even ran a bounty program to incentivize the detection of bugs in its code. LockBit operators were keen on preventing non-group members from obtaining the decryption tool. Since it was first detected in the wild in mid-June, LockBit 3.0 has been reported consistently from over 33 honeypot locations of Sectrio indicating its prevalence and global presence. It even outcompeted rivals such Hiveleaks and Blackbasta in infecting maximum victims since launch as documented by Sectrio’s threat researchers. For a while, everything seemed to be going the way of LockBit 3.0 developers until an alleged disgruntled developer threw a spanner in the works by releasing the code of the encryptor which subsequently made its appearance on Twitter at least a couple of times. This will enable other ransomware groups to build on the encryptor (or modify it) and launch new and more stealthy variants. What’s next for LockBit 3.0 and other ransomware groups? New ransomware groups could theoretically launch their operations with these modified variants. Such variants could also be re-engineered in academic or research labs and in case these variants are accidentally or deliberately released into the web in the future, then the chain of attacks linked to LockBit 3.0 will continue to worry cyber defenders for months or even years.

LockBit 3.0 code release opens Pandora’s box of new threats Read More »

_Digital Transformation - Addressing cybersecurity challenges

Close your Digital Transformation cybersecurity gaps now

ICS, IoT, OT / vikas.karunakaran

In the first two quarters of 2022, the attacks on digital transformation projects have grown manifold in the Middle East. Threat actors are targeting production systems, assembly lines, safety and instrumentation systems (including legacy systems dating back to 2017 or earlier), IoT devices, and IoT and OT networks. A new set of actors is relentlessly scanning networks belonging to diverse enterprises to expose gaps that could be exploited to harvest data or plant malware. Read now: 2022 IoT and OT threat landscape assessment report With such a rise in cyberattacks and due to increasing insider threats, the risk of serious industrial cyber incidents from IoT and OT infrastructure has also risen significantly. Industrial companies that invested significantly in OT infrastructure have also turned into prime targets for ransomware and sophisticated attacks. Such attacks can lead to an erosion of revenue, invested capital, data, and credibility. The loss of production window and destabilization of production schedules will continue to impact bottom lines for months, if not years. Thus, the need to close digital transformation gaps is now more essential than ever. Even a single exposed threat surface in your infrastructure can be detrimental to your overall security posture. Digital transformation and security gaps Digital transformation driven by data harvesting and integration of assets and networks is opening up new threat surfaces and latent gaps. These gaps serve as attack pathways that are linked through cloud and application services, supply chains, remote workforce, and untested IoT devices. Such vulnerabilities that extend into critical control systems when exploited by a sophisticated hacker can derail even the most mature first response plan as the hacker moves laterally in the system disrupting operations while covering new ground and exploiting new gaps. A traditional IT-focused approach to digital transformation security has proven to be the bane of many industries and security teams. Most IoT and OT systems lack advanced capabilities and often operate in alignment with last year’s threat environment. With the proliferation of sophisticated threat actors, mature cybersecurity programs based on threat anticipation and response are no longer a matter of choice. Learn more: Consulting Security for Digital Transfromation Most of the IoT and OT cybersecurity programs that are being run by businesses lack active defenses, skilled workforce, and tools needed to detect and address multiple vulnerabilities. The number of businesses that have a roadmap in place with investments and management buy-in for a significant improvement in security posture is even less. Most businesses lack the resources and expertise to execute secure deployment of innovative digital transformation efforts. Sometimes such programs would have consumed more budgets than allocated and teams often try and cut corners by downgrading the original security program in terms of measures and tools to save money. More access, less security There is a demand from multiple stakeholders for providing direct access to infrastructure components including safety and instrumentation systems (SIS), core engineering systems, and cloud-based data analytics systems. Third-party vendors often ask for network access to service remote hardware and predictive maintenance systems share data with multiple vendors in some instances. In many parts of the Middle East such as the United Arab Emirates and Saudi Arabia, we have seen drones being used for surveilling remote locations. Such drones are often connected to multiple networks each of which could serve as entry points for complex malware or multi-payload droppers. Also read: Complete Guide to Cyber Threat Intelligence Feeds Digital transformation relies on improving operational transparency, overall efficiency, effectiveness, productivity, and process consistency. To attain these goals, security configurations are often overlooked or de-prioritized. In a Sectrio survey conducted between April and May 2022 over 80 percent of CISOs admitted to lacking the desired level of visibility into their operations. In the Middle East CISOs also spoke about using systems that were not hardened from a security standpoint and were thus liable to be exploited by threat actors. Such gaps increase the risk of disruptive cyber incidents that can impact safety, infrastructure integrity, and business continuity. Join us to address your digital transformation cyber security gaps Join us at Digital Transformation Security Drive organized jointly by Sectrio and Spire where our cybersecurity expert Gopal Krishnan will help you chalk out a roadmap to: Date: August 24th, 2022Time: 9:00 AM to 2:00 PMVenue: Al Mawad Meeting Room, Le Meridien – Al Khobar This is an in-person event. Reach out now to secure your slot for free: Book your time now

Close your Digital Transformation cybersecurity gaps now Read More »

How to secure a smart factory?

ICS, Manufacturing, OT / vikas.karunakaran

Securing smart factories is a relatively new priority for many manufacturers. Which is why many manufacturers often struggle with basic cybersecurity requirements while addressing larger security goals. The problem is compounded by lack of skills, policies, and employee sensitization in some instances. For smart factory projects to be successful, the outcomes need to be secured and security needs to be treated as one of the core pillars of the digital transformation effort. Security challenges in upgrading to a smart factory: Thus while smart factories have made substantial gains through infusion of technology in non-security areas, security as an essential enabler of smart production is yet to receive its due. This trend is clearly reflected in the way digital factories have turned into vulnerable targets for hackers and bad actors. Hacker groups are consistently scanning and placing newer variants of malware and multi-loaders such as Bumblebee to exfiltrate data and extort ransom. Why do hackers target smart factories? How to secure smart factories Even before you start on the journey to improve cybersecurity for your smart manufacturing plants, you need to answer these basic but important cybersecurity questions: Answers to these questions will give you your first steps that need to be taken to secure your establishment. Paying attention early has its benefits Security should ideally begin at the blueprint/design stage. When the project is still on paper, IIoT security governance mechanisms, roles and responsibilities (of key personnel), and detection and defence solutions should be considered and finalized. We have often seen that the understanding and appreciation of the threat environment facing smart factories varies from team to team. So coordinating efforts to arrive at a consensus for a governance model is essential. (Building policies and frameworks like OT Cybersecurity Policy Template or IEC 62443, NIST Table of Roles & Responsibilities Template will go a long way in elevating your cybersecurity posture to the next level) Ensuring maturity of response to breach attempts is another strategic priority. Breach detection solutions that integrate with the governance model and the SOC facility should be deployed while the governance and security model is being finalized. Since threat actors will not wait for everything to fall in place before attacking parts of the smart factory, it is important that detection and remediation solutions must be deployed to address these threats. Once the governance model is finalized, the solution can then be aligned to the outcomes expected of it as per the chosen model. Also read: How to get started with OT security Defense and response playbooks can go a long way in fashioning a well-etched and coherent first response to any signs of a cyberattack or a breach attempt. This playbook can define attack scenarios or even suggest basic cyber hygiene tactics that can be deployed to prevent breaches in the first place. Here are a few other steps that can be taken to secure smart factories. Thinking of where to start? Let our cybersecurity experts map your security journey: Schedule a time Learn more about Sectrio’s security solutions for smart factories: Cybersecurity for Smart Factories and Manufacturing Find out what threats are lurking in your smart infrastructure, go for a level 1 threat assessment now.

How to secure a smart factory? Read More »

Complete Guide to OT Security

Cyber Security, ICS, OT / Abhay S K

Oldsmar, a small city in the state of Florida, has a population of about 15,000. It was February 5th, 2021. At the Oldsmar Water Treatment facility, a vigilant employee noticed a spike in the levels of Sodium Hydroxide – or Lye. The levels of Lye were changed to 11,000 ppm from 100 ppm – a 10,000% jump. The hacker managed to infiltrate the critical infrastructure and release excess Lye into the water that serves the entire city. Public Utility systems without an upright security posture as far as Operational Technology is concerned, are vulnerable to such kinds of threats. The threats are real with attackers possessing advanced capabilities increasing at an alarming rate. Fears of security experts have come true, and they only compound with time. 2 in every 5 enterprises revealed that hackers targeted their OT device. Likewise, over 60% of respondents in a survey felt that the volume, complexity, and frequency of threats are likely to increase in the coming future. For an enterprise or an industrial unit, Operational Technology security is of paramount importance. In the case of infrastructure like power grids, it is a matter of national security. What is Operational Technology(OT)? The technology associated with the detection of a change or causes a change using hardware and software is defined as Operation Technology. This change can either be via direct control and/or monitoring of hardware like valves, sensors, I/O devices, switches, PLCs, actuators, switches, etc.), and software (customized and machine-specific). Along with the above-mentioned components, OT systems employ a wide range of control components that act together to achieve an objective. Unlike other information processing systems, any change in an OT network has its effect in the real world. Owing to this, safety and security are of paramount importance in OT systems conflicting with security design and operations frequently. Different types of OT systems: 1. Supervisory Control and Data Acquisition Systems (SCADA) The SCADA systems collect data from many Input-Output devices across a larger geography. Its architecture consists of computers, and networked data communications having a graphical user interface. Commands sent from the command control (using GUI) are executed by PID controllers and PLCs (Programmable Logic Controllers) at the endpoints. Electric Lines, Pipelines, railways, and power transmission often comprise SCADA systems. 2. Distributed Control Systems – DCS The DCS is seen in an environment having many control loops, offering both central supervisory equipment and local control level. It is seen in areas like refining, manufacturing, and power generation where high reliability and security are very important 3. Medical Systems On-site medical devices comprise in-hospital facilities like MRI scanners, infusion pumps, EKG/ECG Machines, defibrillators, and others. These run on age-old Operating Systems and proprietary protocols. Consumer medical devices comprise insulin pumps, artificial pacemakers, and prenatal monitors belonging to the class of IoT smart devices. 4. Physical Access Control and Building Automation Systems Every inch of an industrial complex – designing, fabrication, or manufacturing zone – needs to be protected. Right from HVAC systems, elevators, swipe cards, security cameras, biosecurity machines, and others, everything needs to be secured. OT Security without IoT integration: OT networks run off the grid – isolated from other networks – greatly limiting security vulnerabilities. Every process in an OT environment runs on proprietary control protocols. Critical infrastructure like transport, power distribution, healthcare, and others are an example of OT networks. In an event of an on-site security lapse, an intruder or a group of attackers may manage to get into the premises of an industrial workhouse. The threats arising from such events can be avoided by improving security and surveillance along with the deployment of multi-layered security. This is to ensure access to critical assets and control rooms is always restricted to unauthorized personnel even in an event of an on-site security lapse. Also read: Complete Guide to Cyber Threat Intelligence Feeds There have also been reports of identity card and swipe card thefts, giving unauthorized people access to OT infrastructure facilities. Did the adoption of IoT make OT systems more vulnerable? Smart transportation, smart power transmission, smart manufacturing – every ‘smart’ thing that is a part of our day-to-day lives is an upgrade of its cousin from the pre-internet days. Anyone associated – government, private contractor, or even an academician, wants to make an OT system more reliable, cost-effective, and efficient. To achieve this goal, the adoption of services like big data analytics and other enterprise software has been integrated with the OT networks. This means IT has been integrated with OT. This brought more misery than what OT systems have seen cumulated across the past 200 years. With the integration of Information Technology and the Internet of Things into Operational Technology, the security of the critical infrastructure that holds a nation has been put under scrutiny. To mitigate risks arising out of IT and IoT integration with OT, traditional security solutions along with strategies like defense-in-depth, layered security mechanisms, and other sophisticated modern security systems should be deployed. Also Read: How to get started with OT security The OT systems have moved from the state of Complete Isolation to a state where complete isolation is impossible. While the integration between IT, IoT, and OT was bound to happen sooner or later, the threats and security vulnerabilities were to follow. Just like IT Cybersecurity went through some rough patches during its infancy some 3 decades ago and is still fighting with a positive spirit, hybrid-modern OT systems to are expected to continue. How OT Security differs from IT Security Operation Technology is industry-oriented and focuses on the manufacturing, production, and transmission landscape. A single failure in an OT system can hurt industrial operations directly leading to long non-production hours. There have been instances of fatal accidents in some cases. Though such incidents are of low frequency, they have a destructive effect, threatening national security at times. OT security puts Safety at the forefront, despite being non-dynamic. On the other side of the fence, IT Security deals with data flowing across various IT systems. IT security primarily is a business-oriented vertical driven by an enterprise landscape. An IT

Complete Guide to OT Security Read More »

9 important tips for selecting an OT security vendor

Cyber Security, ICS, OT / vikas.karunakaran

With rising cyberattacks and inbound scans from sophisticated actors, security teams managing OT networks and assets are under immense pressure. In addition to SOC fatigue, there are also challenges associated with rising threats to OT infrastructure that could cause a shutdown or make critical equipment unavailable. In a study conducted by Sectrio’s threat research team in June 2022, we found many ports on OT networks easily accessible from outside. Because of a lack of network visibility and cyber hygiene, hackers can access networks and move laterally across infrastructures and locations. This is not just a dangerous trend but it can also severely dent the ability of such businesses to ward off cyberattacks in the future as they may already be hosting malware loaders and multiple stealthy malware that is either exfiltrating data or keeping the infrastructure available for attacks in the future. Investing in better cybersecurity practices and an OT security solution is thus imperative. But then, choosing such a solution should ideally involve a round of diligence. To help you we have identified a set of tips that can hasten the process of selecting an OT security solution with the right features, capabilities, and endurance. 9 vital tips for selecting the right OT security vendor 1. Does the vendor understand OT protocols? A vendor that understands and covers varied OT protocols could be considered as a mature vendor. 2. Is it a mixed bag solution? If the OT security vendor has chosen detection or mitigation exclusively from another vendor or vendors, then that is a huge red flag. Such a security solution would induce a detection and mitigation lag and the vector might just slip through the integration gaps. An ideal solution should have all modules coming from the same vendor. 3. Did the vendor acquire any other capability inorganically, recently? Lots of mergers and acquisitions occur in the OT security industry so be careful about any solution coming from a vendor that has acquired another security vendor recently as the integration of capabilities and features may not have been tested fully and be bug-free. The solution can however be considered after an extended POC 4. Do they offer asset discovery and vulnerability management? You will be surprised to know that many OT security vendors do not provide these capabilities as part of their core solution. This is a clear disadvantage as these are essential capabilities to ensure a robust security posture. 5. How do they get their threat intelligence? Only a few vendors offer native OT threat intelligence feeds. If a vendor is offering this, it should be considered a clear advantage. 6. Has the solution addressed unique security challenges that you can identify with? Read some of their case studies and check if the solution is addressing real problems rather than academic ones. 7. Ease of deployment and decision data accessibility. Is the solution modular and permits rapid deployment? Once you have selected the solution you would want it to integrate with your environment rapidly. The data dashboards should be clutter-free and permit decision-making across views. 8. Support for mixed environments The solution should be able to work across hybrid environments with various technologies and devices of all vintages 9. Do they offer comprehensive consulting and compliance services as well? Vendors that offer security services for specific end needs score high on the ratings as consulting services are often required to build a security roadmap and build OT security skills and knowledge in the workforce. With new compliance mandates getting added, businesses need to get help in configuring their workflows, processes, and systems for audit, reporting, or any other compliance need. Need help with selecting an OT security solution, talk to our solution experts to take the next steps here: Contact us Is your existing OT security solution failing you? Download the checklist to learn how to move on to a new solution with ease – Download checklist now

9 important tips for selecting an OT security vendor Read More »

How to get started with OT security

Cyber Security, ICS, OT / Prayukth K V

In the last couple of years, OT security has managed to get plenty of attention from security teams. Some businesses have even started having dedicated teams to manage OT security and tools. However, many businesses are still in the process of figuring out a strategy to deal with OT threats and specific risks to infrastructure and networks. This article will shed some light on how to improve OT security without putting strain on your existing resources. Where to start? In a manufacturing plant in the APAC region that was attacked in May last year, security teams were unable to agree on which tool to choose for securing OT systems. This resulted in a prolonged delay in decision-making. The teams met over 22 times in 6 months without being able to come to a consensus on the way forward. In every meeting, the IT security team, the SCADA and ICT team, and the CISO’s nominee would discuss and agree to disagree on these points: The IT team wanted to go with the existing vendor who was offering an untested and unproven solution for OT security for free The SCADA team wanted to go for a proven OT solution but the CISO’s nominee was not comfortable with the budgets that were being sought The logjam continued for almost 200 days till a cyberattack crippled their plant operations. The assembly line sustained much damage but luckily since the plant was not operational during late evening after work hours, no loss of life was reported. The teams holding disparate opinions on how to deal with OT security came together and agreed on a line of approach immediately and thus, the plant got a new security solution in just 23 hours and that was not all. A cybersecurity audit for all systems including vulnerability scans was conducted and everyone chipped in to identify new security standards to readily embrace to keep the focus on OT security going. Lesson: move fast. Learn rapidly, decide early, and execute with diligence without wasting any time. Even small steps implemented early can lead to incremental OT security gains. On the other side, the more you delay, the greater are your chances of falling victim to a debilitating attack. Also read: The 2022 global threat landscape report 1. Conduct an OT threat assessment By doing a comprehensive OT threat assessment exercise, you will be able to identify and understand the threats, their sources as also the level of intervention required to deal with them. Sectrio can help with a custom threat assessment for your business. Share a few details here to get started. 2. Know your network and assets OT and associated networks often harbor devices that have not been part of any inventory for years. We have seen power plants and manufacturing shop floors host complex OT devices serving simple functions that may once have been part of an inventory but are now transparent to the security operations team and to inventory managers. There could be two reasons for this: These devices are no longer playing a major role in the overall scheme of things (though they are still connected to the overall network) Or such devices are part of a sub-inventory that is managed separately Without an integrated inventory, it becomes difficult to know what to protect which might add major gaps to the security posture of a business. Over a period of time, such devices are not just forgotten but they are also not maintained in any way and certainly not patched. Lesson: put an inventory together of all assets without any discrimination. 3. Publish an OT security policy Publishing an OT security policy will serve many purposes. It can be a statement of intent as also a statement of direction and confidence in the need to address OT security. We have put together a template for you here that you can readily use. The OT security policy can very well be the first step but always ensure that there are regular follow-ups to draw and act on action items. If this is not done, then the policy will remain on paper and will not be of much help to the organization. The OT security policy should be action-oriented. 4. Investigate and patch all vulnerabilities Every vulnerability is an invitation to a hacker to exploit and attack. Run frequent scans for detecting vulnerability and patch status of devices. Act on the vulnerabilities detected and patch all unpatched devices. Calendarize such scans and also check the CVE DBs frequently for any new vulnerabilities that may be associated with the devices in your network. These are essential parts of your overall cyber hygiene and must be given adequate priority. 5. Integrate OT risk exposure into your institutional risk management plan All OT risks identified should be part of the institutional plan along with identified timelines for addressing these risks. OT risks can be addressed in isolation at a tactical level if they do not have any dependency on the overall infrastructure (which is rarely the case). Risks related to device patching for instance can be handled as part of an OT security plan but that plan has to connect with the institutional risk management plan at a strategic level. This will ensure more visibility for OT risks and also help in generating awareness on the need to address OT risks. 6. Identify standards and mandates to comply with All security measures should have benchmarks to look up to. This is where NIST CSF, IEC 62443, and many ISO measures come into play. Many countries are now passing legislation mandating businesses to comply with new and stringent reporting requirements. Even before that, businesses need to look at streamlining their security measures and align them with the best standards out there. This will give your security team added motivation as well. When you declare your organization to be say IEC62443 compliant, it will also give your customers more confidence to engage your organization. 7. Work with the right threat intelligence

How to get started with OT security Read More »

Understanding the implications of OTCC-1: 2022 for your business

OT, ICS / Abhay S K

The National Cyber Security Authority of Saudi Arabia recently issued the “Cyber Security Controls Document for Operational Systems (OTCC-1:2022)”. This document aims at enabling sensitive industrial facilities, critical infrastructure, private businesses, and government agencies to adopt best practices and standards to ensure the security of operations at all times. Specifically, (OTCC-1:2022) has been developed to increase the level of cyber protection accorded to OT/ICS environments in view of the rising attacks on OT and OT-linked infrastructure and networks. What do you need to look out for in the NCA’s OTCC-1:2022? According to the authority, the document outlines the approved controls for operational systems to help them align towards reducing the cyber risks to operational technology-based systems. The document aims to raise the bar as far as cybersecurity is concerned to ensure that the businesses and entities concerned enforce minimum requirements for protection and follow them up by extending basic cybersecurity controls to improve risk management. As per the accompanying mandate issued by the NCA, these controls must be implemented as an extension to NCA’s Essential Cybersecurity Controls (ECC-1: 2018) issued earlier. The term Industrial Control Systems (ICS) includes all devices, systems, or networks used to operate and/or automate industrial processes. The issuance of these controls comes within the authority’s mandate to set policies, governance mechanisms, frameworks, standards, controls, and guidelines related to cyber security in the Kingdom and based on its role in regulating and protecting cyberspace, and seeking to promote and protect vital interests and sensitive national infrastructures by enhancing cyber security for operational systems at the national level. To comply with the requirements suggested by the document, businesses and agencies should: Rise the level of baseline protection accorded to OT systems Invest in continually improving security measures Revisit risk management measures to align them with emerging cyber threats Expand the scope of basic security controls as a follow-up to point 1 Identify security gaps and work towards addressing them to improve the overall security posture Implications of OTCC-1: 2022 for your business OTCC-1:2022 has multiple implications for your business. From the data layer up to cloud ingress, underlying controls, first response mechanisms, and back-ups, a streamlined effort is needed to comply with this mandate and to ensure the minimization of your institutional risk exposure. Sectrio is a leading provider of IoT, OT, IT cybersecurity solutions, and threat intelligence. Our proven expertise can help your business in meeting its compliance mandates and infrastructure protection needs. Sectrio’s cybersecurity experts can help you draw a roadmap to comply with this OTCC-1:2022 and to improve your risk management measures to contain and mitigate threats. Speak to our experts now to initiate your threat assessment and mitigation journey. Talk to us about the simplified approach to OT security that minimizes your institutional risk exposure significantly. Worried about not having the right threat intelligence for improving your SecOps? Talk to us to try our threat intelligence feeds for free for the next two weeks. Participate in the CISO Peer Survey 2022 and make your opinion count now, fill up our uniquely designed survey here: CISO Peer Survey 2022 Book a demo now to see our IT, OT and IoT security solution in action: Request a Demo Try our threat intelligence feeds for free for the next two weeks. Get access to enriched IoT-focused cyber threat intelligence for free for 15 days

Understanding the implications of OTCC-1: 2022 for your business Read More »

BazarLoader malware opens a new frontier in cyberspace

Cyber Security, ICS, IoT, OT / Prayukth K V

While reports were coming in of hackers using company forms to trick employees to download a variant of BazarLoader malware, Sectrio’s research team has come across another method that hackers are using to push this malware. What is BazarLoader? It is a very stealthy and sophisticated malware that serves as the level one infector to drop multiple payloads. Since it serves to push for multiple malware payloads once installed, it is a much sought out malware among hackers. It is by design a highly resilient and complex malware that has been used extensively in multiple campaigns including those associated with Ryuk and Conti. BazarLoader utilizes the EmerDNS domain name and record system which is based on blockchain. This renders it safe from any form of censorship and modification from non-author entities. So, shutting the associated domains is a tough proposition. Since the last few weeks, security teams have been discussing hackers using company forms to push infected links. WeTransfer, TransferNow, and in some instances even Dropbox links were being used to transfer a .ISO file with a .LNK shortcut and a masked DLL file after the hacker established a line of communication with the purported victim. Sectrio’s researchers intercepted an email earlier today that claimed to be coming from a prominent software review site. A look at the email address revealed that it was from another domain altogether and was being pushed through many server loops to improve its authenticity. On clicking any link, the attack chain is activated with the download of an .ISO file with the shortcut and the masked DLL file. Since this email was targeting a team that would usually be interested in such communication, this was likely a targeted attack through a spoofed ID. Such variation in phishing methods within just a couple of weeks indicates that hackers are working hard to improvise their tactics to push BazarLoader. For more informational content, subscribe to our weekly updates and stay tuned with updates from Sectrio. Try our rich OT and IoT-focused cyber threat intelligence feeds for free, here: IoT and OT Focused Cyber Threat Intelligence Planning to upgrade your cybersecurity measures? Talk to our IoT and OT security experts here: Reach out to sectrio. Visit our compliance center to advance your compliance measures to NIST and IEC standards: Compliance Center Get access to enriched IoT-focused cyber threat intelligence for free for 15 days

BazarLoader malware opens a new frontier in cyberspace Read More »

Starlink disruption in Ukraine and the persistent threat to critical infrastructure

OT, ICS, IoT / Prayukth K V

In an apparent response to reports of disruption of Starlink connectivity in conflict zones in Ukraine, Elon Musk just announced that SpaceX will work towards improving its cyber defense measures and put in more effort in overcoming signal jamming. According to a Starlink coverage tracker screenshot provided by Mike Puchol dated March 5th, 2022, Starlink connectivity seems to be impacted in many parts of Eastern Ukraine that are witnessing or have witnessed intense conflicts between the Russian and Ukrainian armed forces. Starlink, according to Musk has now pushed an update that bypasses the jamming to ensure seamless connectivity. Specifics were not provided but it is apparent that he will not stop there and continue working on sustaining connectivity sans disruption from cyber adversaries or malicious elements under any circumstance. How did Startlink respond to this disruption? Starlink in this instance responded quickly to overcome what could have become an escalating problem as the conflict intensifies and spreads. More Starlink terminals could have been impacted if the problem was left unaddressed and the quality of connectivity, if available, may not have supported the levels of bandwidth needed to support multiple end uses in a conflict zone. Cybersecurity problems with critical infrastructure Unfortunately, critical infrastructure across the globe is not anywhere close to being this resilient when it comes to warding off cyberattacks and getting things back in order quickly. We have had instances where after a cyberattack, large-scale public healthcare and safety challenges were averted due to sheer luck and not due to diligence or planning. Some of the key critical infrastructure related cybersecurity issues that we have been tracking for a while include: Delayed response to cyberattacks or intrusion attempts degrades the quality of response and puts more resources at risk Converged surfaces are still not secure enough. This leaves the door wide open for threats to move laterally Lack of visibility into key parts of maintenance operations due to use of legacy devices that do not support logging Lack of relevant threat intelligence Forward planning to cover post-event scenarios and cyber response planning is simply not there Digital transformation among some parts of the infrastructure has created zones of opportunity for hackers as these host new and untested devices that could serve as a gateway for malware and cyberattacks Cybersecurity is still looked at from an operational perspective. This means that if a tabletop exercise or addition of cybersecurity solutions causes downtime, then usually a decision is taken to delay such measures indefinitely as operations teams do not want to take any chances with disruption or downtime The ‘Chernobyl’ syndrome refers to employees not being aware of the threat envelope surrounding key elements of the infrastructure. Thus, during a cyberattack, the first response is sheer panic or to shut down everything. The second step is usually to pay the ransom after some negotiations Dummy attacks: even critical infrastructure at rest is not sparred from cyber attacks as we saw during an attack on an airport in Prague during the first wave of Covid-19 when the airport was not functioning at full capacity. This means that even during a lean phase, cybersecurity teams cannot afford to look away from critical systems. Such attacks can also tire and tiedown SOC teams Monitoring insider activity is still on the to-do list of critical infrastructure operators Lack of adherence to standards and frameworks such as IEC 62443 and NIST regulations Cybersecurity is still not treated as a health and safety linked issue Ukraine has been subjected to cyberattacks in the recent past. Hackers have been using its cyberspace as a playground for launching new malware and for trying new breach techniques. Similarly, many countries were subjected to widespread cyberattacks to either steal sensitive information, create large-scale disruption or to simply deploy malware that will stay hidden till the cyber adversary decides on a right time to unleash them. Cybersecurity lessons and the way ahead If anything, incidents such as the Starlink jamming should now be used to launch a new thrust on critical infrastructure cybersecurity. After all communication enablers in a war zone/ zone of humanitarian interest can be and should be treated as critical infrastructure and this incident has lessons for all critical infrastructure operators. To learn more about how to improve your compliance posture, download our compliance kits. We have the right threat intelligence for your critical infrastructure. Try it right now: Threat Intelligence We also have the right cybersecurity solutions for your critical infrastructure. Allow us to give you a sneak preview of its capabilities through a no-obligation demo.

Starlink disruption in Ukraine and the persistent threat to critical infrastructure Read More »

State of IoT and OT security in the Middle East

ICS, IoT, OT / Prayukth K V

Cyber-attacks on Middle Eastern entities continued to rise throughout 2021. Most of this rise came from threat actors connected to 5 known clusters outside the region that were targeting critical infrastructure, manufacturing, utilities, and oil and gas infrastructure. These attacks were characterized by: The exponential increase in the degree of sophistication in targeting and breach formulation A strong geopolitical connect; extensive involvement of APT actors has been confirmed The timing of the attacks was designed to coincide with major offline events including the onset of holidays, reopening of offices, and even government to government discussions Malware deployed in the region showed higher levels of new codes and segments indicating that the hackers may be working towards exclusively targeting entities in the region or using the region as testing grounds Attacks on manufacturing registered a 200 percent rise Cyberattacks are carried out in waves on targets with increasing intensity and loss of data registered in each wave New APT clusters have sprung up within the region and are now targeting strategic sectors of the economy in countries like Saudi Arabia, UAE, and Oman As we investigate the emerging threats in the region, three themes stand out: Hackers are focusing on maximizing disruption by targeting industrial control systems, supply chains and IoT networks Ransom is the ultimate objective; the attacks are being carried out by well-organized cyber-criminal gangs. Regional ransom rates have also gone up Lack of visibility into operations and involuntary insider activity are both turning into major weaknesses. In converged networks that are connected with IoT, OT and IT, threat actors are finding it easier to breach and load their malware payload Sectoral updates on IoT and OT Security Attacks on oil and gas entities and manufacturing sectors continue to rise disproportionately. Through infrastructure optimization measures, many new devices and systems were introduced into the networks of companies in these two sectors in 2020 and 2021. Some of these devices were introduced without adequate levels of security testing and this has led to the emergence of new vulnerabilities that hackers are exploiting. With widened gaps, cyber threats will find it easier to spread across these two sectors and beyond. In industries such as cement and food and beverage manufacture, we have seen the emergence of specialized threats. These are targeting certain production aspects including assembly lines, manipulation of proprietary formulation, and production processes. A large number of digital transformation projects have taken off in countries like UAE, Saudi Arabia, Oman, and Qatar in 2021. Most of the projects involve a phased transition to technologies such as IoT, AI, blockchain, and others. Due to this transition as well as the increased infusion of automation, an increasing number of enterprises and business units are now functional with a diverse array of infrastructure subsystems, sub-networks, and connectivity flavors that enable cyberattacks by stealthy malware that move laterally across networks. Extensive use of social engineering Hackers are also deploying a wide variety of social engineering and insider luring means to attack and engage targets. These include forged official emails from vendors, government, and other entities and messages from instant messaging and other platforms to deceive the recipient. We also came across some instances of reply phishing as well. Bleeding data UAE firms lost the maximum amount of data per cyber-attack as compared to other countries in the region. Other countries also lost data in proportion to the volume of cyberattacks experienced by them. Such data is turning up in all sorts of places. We are not sure about the amount of ransom that could have been paid by companies in the region but by looking at the volume of data leaked so far, significant amounts of ransom could possibly have exchanged hands in 2021. The above is an extract from Sectrio’s Threat Landscape Assessment and Analysis Report 2022. To access the full report, visit this link: The 2022 IoT and OT Global Threat Landscape and Assessment Report Wish to learn about simple measures to improve your cybersecurity posture? Meet our cybersecurity experts at GISEC 2022. Book your complimentary meeting slot now. Get access to enriched IoT-focused cyber threat intelligence for free for 15 days

State of IoT and OT security in the Middle East Read More »

By Industry

By Compliance

Business Needs

Services

Contact Us