Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

09:02 AM
Connect Directly

3,000 Industrial Plants Per Year Infected with Malware

Targeted industrial control systems-themed malware is less prevalent yet persistent, including one variant posing as Siemens PLC firmware that has been in action since 2013, researchers find.

A piece of crimeware posing as legitimate Siemens PLC software has been in circulation for four years by an unknown attack group attempting to infect industrial networks mainly in the US.

The backdoor malware is packaged to appear as a Siemens programmable logic controller installer file, and around 10 industrial sites have reported coming across the targeted attack campaign, seven of which are located in the US as well as some in Europe and China, according to new research from Dragos.

"It tries to fool operators into installing what they expect to be files related to their PLCs, but in fact, it's a backdoor," says Robert M. Lee, founder and CEO of Dragos, a critical infrastructure security firm that today at the SANS ICS Summit released findings from its study of malware found in ICS networks.

Lee and his colleague Ben Miller, director of the Dragos Threat Operations Center, identified and analyzed malware cases associated with ICS networks, studying 15,000 malware samples from ICS environments over a three-month period. The researchers studied malware culled from public databases such as VirusTotal, where malware gets uploaded and tested against anti-malware products, as well as from Google searches and Doman Name Service (DNS) data.

Dragos' so-called Malware in Modern ICS (MIMICS) project was meant to provide a gut-check on the actual types of malware hitting ICS environments today. The researchers were able to identify mostly everyday malware: no new Stuxnet-type targeted malware attacks. Even the Siemens-themed malware, while targeting ICS networks, still uses a crimeware-type backdoor piece of malware: nothing destructive or customized like Stuxnet, Havex, or BlackEnergy2.

The researchers found mostly common and easily spreadable malware samples had hit ICS networks: Sivis was by far the most prolific, with 15,863 detections, followed by Lamer (6,830), Ramnit (3,716), Sinwal (2,909), and other common malware families including Virut (1,814) and Sality (1,225). The researchers calculate that some 3,000 industrial sites per year get infected with this type of non-targeted, everyday malware, a figure they consider conservative since not all infected sites necessarily submit their malware to VirusTotal, for instance.

"People expect Stuxnet 2.0 instead of obvious things [malware infections] happening," Lee says. "Our hypothesis is that it doesn't take Stuxnet 2.0 to get into [industrial] facilities. It's more impactful if you can show traditional malware used to target ICS."

The targeted attacks they found besides the Siemens PLC-poser malware were not as widespread as the non-targeted malware. There were around 10 other such ICS-themed malware cases, Lee says. One such attack, dating back to 2011, was a phishing email targeting multiple nuclear sites in the West, but mainly in the US. "We can't tell who was actually affected" from the data set, Lee says. "But we saw it did occur."

Lee says that the presence of any of this malware on ICS systems doesn't mean a manufacturing facility was shut down, or there was a nuclear meltdown. MIMICS' findings shows actual data on what type of malware and attacks are hitting ICS plants. "A lot of [plant owners] want to make user cases for security," he says. "The hope is that this will cut through the hype and show that there are issues." 

More unnerving, however, was how many legitimate ICS files MIMICS discovered incorrectly flagged as malware in VirusTotal and other public sites, leaving those files exposed to abuse by cybercriminals or other threat actors looking for that type of intel to wage a targeted attack on an industrial site. They discovered thousands of legit ICS software programs including human machine interface installers, data historian installers, and key generators for the software, all up for grabs by bad guys.

Lee and Miller found some 120 project files that had been flagged as malicious and submitted to those public databases, including a Nuclear Regulatory Commission report, substation layout specifics and maintenance reports, and other types of sensitive information inadvertently posted publicly.

Pulling off a targeted and destructive attack on an ICS system in an industrial plant isn't so simple. It takes a fair amount of knowledge and understanding of the physical layout of the plant, as well as some knowledge of the industrial processes there. ICS security experts such as Ralph Langner of Langner Communications have argued that in order to execute a "cyber-physical" attack that causes damage to the plant or its processes, the attacker needs knowledge of the physical and engineering aspects of the targeted site. That's a skillset that goes beyond malware and hacking, according to Langner.

But the legitimate files the Dragos team found online could be used as part of an intel- and reconnaissance operation by malicious attackers. "They could get information on where the site was, what the asset owner was, the configuration and layout of the process, what equipment they are using, what software they have," for instance, Lee says. "They could get a lot of information. It wouldn't necessarily give them the physical engineering" information, but it would provide a good amount of information, he says.

An attacker would need to do a large amount of research to hack a plant, but finding this type of legitimate data as well as files on VirusTotal, for example, would shorten that research process by the attacker, Lee notes.

ICS security expert Joseph Weiss this week in a blog post pointed out that malware indeed is resident in ICS systems, so plant operators must "focus on resilience and recovery" from potential cyberattacks. Ensuring that critical control systems are not available on the Internet, as well as establishing secure software updates and limiting access to trusted users are among some of the protections these sites should employ, he noted.

Related Content:



Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/21/2020
Cybersecurity Bounces Back, but Talent Still Absent
Simone Petrella, Chief Executive Officer, CyberVista,  9/16/2020
Meet the Computer Scientist Who Helped Push for Paper Ballots
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/16/2020
Register for Dark Reading Newsletters
White Papers
Latest Comment: Exactly
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-09-22
Arbitrary code execution vulnerability on Micro Focus Operation Bridge Reporter, affecting version 10.40 and earlier. The vulnerability could allow remote attackers to execute arbitrary code on affected installations of OBR.
PUBLISHED: 2020-09-22
WebAccess Node (All versions prior to 9.0.1) has incorrect permissions set for resources used by specific services, which may allow code execution with system privileges.
PUBLISHED: 2020-09-22
A vulnerability in Arista’s CloudVision Portal (CVP) prior to 2020.2 allows users with “read-only� or greater access rights to the Configlet Management module to download files not intended for access, located on the CVP server, by accessing ...
PUBLISHED: 2020-09-22
IBM Data Risk Manager (iDNA) 2.0.6 stores user credentials in plain in clear text which can be read by an authenticated user. IBM X-Force ID: 184976.
PUBLISHED: 2020-09-22
IBM Data Risk Manager (iDNA) 2.0.6 could allow a remote authenticated attacker to upload arbitrary files, caused by the improper validation of file extensions. By sending a specially-crafted HTTP request, a remote attacker could exploit this vulnerability to upload a malicious file, which could allo...