Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

09:02 AM
Connect Directly

3,000 Industrial Plants Per Year Infected with Malware

Targeted industrial control systems-themed malware is less prevalent yet persistent, including one variant posing as Siemens PLC firmware that has been in action since 2013, researchers find.

A piece of crimeware posing as legitimate Siemens PLC software has been in circulation for four years by an unknown attack group attempting to infect industrial networks mainly in the US.

The backdoor malware is packaged to appear as a Siemens programmable logic controller installer file, and around 10 industrial sites have reported coming across the targeted attack campaign, seven of which are located in the US as well as some in Europe and China, according to new research from Dragos.

"It tries to fool operators into installing what they expect to be files related to their PLCs, but in fact, it's a backdoor," says Robert M. Lee, founder and CEO of Dragos, a critical infrastructure security firm that today at the SANS ICS Summit released findings from its study of malware found in ICS networks.

Lee and his colleague Ben Miller, director of the Dragos Threat Operations Center, identified and analyzed malware cases associated with ICS networks, studying 15,000 malware samples from ICS environments over a three-month period. The researchers studied malware culled from public databases such as VirusTotal, where malware gets uploaded and tested against anti-malware products, as well as from Google searches and Doman Name Service (DNS) data.

Dragos' so-called Malware in Modern ICS (MIMICS) project was meant to provide a gut-check on the actual types of malware hitting ICS environments today. The researchers were able to identify mostly everyday malware: no new Stuxnet-type targeted malware attacks. Even the Siemens-themed malware, while targeting ICS networks, still uses a crimeware-type backdoor piece of malware: nothing destructive or customized like Stuxnet, Havex, or BlackEnergy2.

The researchers found mostly common and easily spreadable malware samples had hit ICS networks: Sivis was by far the most prolific, with 15,863 detections, followed by Lamer (6,830), Ramnit (3,716), Sinwal (2,909), and other common malware families including Virut (1,814) and Sality (1,225). The researchers calculate that some 3,000 industrial sites per year get infected with this type of non-targeted, everyday malware, a figure they consider conservative since not all infected sites necessarily submit their malware to VirusTotal, for instance.

"People expect Stuxnet 2.0 instead of obvious things [malware infections] happening," Lee says. "Our hypothesis is that it doesn't take Stuxnet 2.0 to get into [industrial] facilities. It's more impactful if you can show traditional malware used to target ICS."

The targeted attacks they found besides the Siemens PLC-poser malware were not as widespread as the non-targeted malware. There were around 10 other such ICS-themed malware cases, Lee says. One such attack, dating back to 2011, was a phishing email targeting multiple nuclear sites in the West, but mainly in the US. "We can't tell who was actually affected" from the data set, Lee says. "But we saw it did occur."

Lee says that the presence of any of this malware on ICS systems doesn't mean a manufacturing facility was shut down, or there was a nuclear meltdown. MIMICS' findings shows actual data on what type of malware and attacks are hitting ICS plants. "A lot of [plant owners] want to make user cases for security," he says. "The hope is that this will cut through the hype and show that there are issues." 

More unnerving, however, was how many legitimate ICS files MIMICS discovered incorrectly flagged as malware in VirusTotal and other public sites, leaving those files exposed to abuse by cybercriminals or other threat actors looking for that type of intel to wage a targeted attack on an industrial site. They discovered thousands of legit ICS software programs including human machine interface installers, data historian installers, and key generators for the software, all up for grabs by bad guys.

Lee and Miller found some 120 project files that had been flagged as malicious and submitted to those public databases, including a Nuclear Regulatory Commission report, substation layout specifics and maintenance reports, and other types of sensitive information inadvertently posted publicly.

Pulling off a targeted and destructive attack on an ICS system in an industrial plant isn't so simple. It takes a fair amount of knowledge and understanding of the physical layout of the plant, as well as some knowledge of the industrial processes there. ICS security experts such as Ralph Langner of Langner Communications have argued that in order to execute a "cyber-physical" attack that causes damage to the plant or its processes, the attacker needs knowledge of the physical and engineering aspects of the targeted site. That's a skillset that goes beyond malware and hacking, according to Langner.

But the legitimate files the Dragos team found online could be used as part of an intel- and reconnaissance operation by malicious attackers. "They could get information on where the site was, what the asset owner was, the configuration and layout of the process, what equipment they are using, what software they have," for instance, Lee says. "They could get a lot of information. It wouldn't necessarily give them the physical engineering" information, but it would provide a good amount of information, he says.

An attacker would need to do a large amount of research to hack a plant, but finding this type of legitimate data as well as files on VirusTotal, for example, would shorten that research process by the attacker, Lee notes.

ICS security expert Joseph Weiss this week in a blog post pointed out that malware indeed is resident in ICS systems, so plant operators must "focus on resilience and recovery" from potential cyberattacks. Ensuring that critical control systems are not available on the Internet, as well as establishing secure software updates and limiting access to trusted users are among some of the protections these sites should employ, he noted.

Related Content:



Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Oldest First  |  Newest First  |  Threaded View
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Register for Dark Reading Newsletters
White Papers
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2019-10-19
Information Disclosure is possible on WAGO Series PFC100 and PFC200 devices before FW12 due to improper access control. A remote attacker can check for the existence of paths and file names via crafted HTTP requests.
PUBLISHED: 2019-10-19
templates/pad.html in Etherpad-Lite 1.7.5 has XSS when the browser does not encode the path of the URL, as demonstrated by Internet Explorer.
PUBLISHED: 2019-10-18
In the Linux kernel before 5.3.4, a reference count usage error in the fib6_rule_suppress() function in the fib6 suppression feature of net/ipv6/fib6_rules.c, when handling the FIB_LOOKUP_NOREF flag, can be exploited by a local attacker to corrupt memory, aka CID-ca7a03c41753.
PUBLISHED: 2019-10-18
In xsltCopyText in transform.c in libxslt 1.1.33, a pointer variable isn't reset under certain circumstances. If the relevant memory area happened to be freed and reused in a certain way, a bounds check could fail and memory outside a buffer could be written to, or uninitialized data could be disclo...
PUBLISHED: 2019-10-18
HCL Traveler versions 9.x and earlier are susceptible to cross-site scripting attacks. On the Problem Report page of the Traveler servlet pages, there is a field to specify a file attachment to provide additional problem details. An invalid file name returns an error message that includes the entere...