Move Over, APTs: Cybercriminals Now Target Critical Infrastructure Too
Danish energy sector attacks attributed to Russia's Sandworm APT turn out to be the work of a new concern: cyber opportunists.
January 11, 2024
![Arrows sticking out of a target Arrows sticking out of a target](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/blt6f6657360cd86e97/65a06c068edbf5040af567d7/Target_hoch2wo_Alamy.jpg?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
A "crimewave" of mass exploitation of Zyxel firewall devices has been washing over critical infrastructure in Europe — and Sandworm, the Russian state-sponsored advanced persistent threat (APT) that specializes in such attacks, is behind only part of it.
According to an analysis from Forescout Research, Vedere Labs this week, one of two previously reported attacks against the Danish energy sector in May was mistakenly attributed to Sandworm.
Mass Exploitation of CVE-2023-27881 in Zyxel Firewalls
At the time, Danish critical infrastructure security nonprofit SektorCERT noted that attackers were leveraging multiple, critical vulnerabilities in Zyxel gear, including two zero-days, to isolate targets from the national grid, and that command-and-control (C2) servers known to be associated with Sandworm were involved, across two different campaigns.
Further analysis however shows that "the second wave of attacks took advantage of unpatched firewalls using a newly 'popular' CVE-2023-27881, and additional [C2] addresses that went unreported," according to the firm. "Forescout evidence suggests the second wave was part of a separate mass exploitation campaign."
Forescout researchers noted that the perpetrators are targeting firewalls indiscriminately and only changing staging servers periodically — a very different M.O. from that of the infamous APT.
"Distinguishing between a state-sponsored campaign aimed at disrupting critical infrastructure and a crimewave of mass exploitation campaigns, while also accounting for potential overlaps between the two, is more manageable in hindsight than in the heat of the moment," notes Elisa Costante, vice president of research at Forescout Research. "This report underscores the significance of contextualizing observed events with comprehensive threat and vulnerability intelligence to improve operational technology (OT) network monitoring and enhance incident response plans."
After the Danish attacks, further cyberactivity targeted exposed devices within critical infrastructure worldwide for months, with Forescout researchers detecting numerous IP addresses attempting to exploit the Zyxel bug across various devices as recently as October. And attacks could continue still: At least six different power companies in European countries utilize Zyxel firewalls and may remain susceptible to potential exploitation by malicious actors, according to Forescout.
Critical Infrastructure: Not Just a State-Sponsored Target
The fact that garden-variety opportunistic cyberattackers are getting into the ICS game should worry cyber defenders, according to John Gallagher, vice president of Viakoo Labs at Viakoo.
"Forescout's analysis points to the spillover from nation-state directed cyber exploits to mass exploitation campaigns, which is an alarming trend," he says. "As 'mass market' threat actors become more skilled at working within the unique languages and protocols of ICS systems, it dramatically increases the risk of nonaffiliated threat actors providing 'as-a-service' ICS exploitation."
That trend will ironically be exacerbated by the modernization of the technology used by utilities and other critical infrastructure environments, notes Craig Jones, vice president of security operations at Ontinue.
"As infrastructure becomes increasingly connected and reliant on digital systems, the potential attack surface for cybercriminals rises," Jones explains. "We can expect to see more sophisticated attacks that exploit specific vulnerabilities in these systems moving forward. Furthermore, the ever-growing value of data may lead to more targeted ransomware attacks that aim to extract or encrypt particularly valuable or sensitive information."
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024