Threat groups are increasingly targeting critical infrastructure for malicious attacks by using direct access to cyber-physical systems, according to a report released Wednesday by Claroty, a firm that specializes in industrial security.
These attackers, which often are state-sponsored or hacktivist groups, are abusing virtual network protocol in a majority of cases to gain remote access to exposed internet-facing assets.
In two-thirds of the tracked incidents, attackers are compromising human-machine interfaces or supervisory control and data acquisition systems, which are used to control various industrial processes in factories and other operational technology environments.
“When examining these attacks, we see a common methodology of ‘no vulnerabilities needed,’ in which attackers abuse misconfigured devices, insecure-by-design protocols and outdated insecure devices,” said Noam Moshe, head of Claroty’s Team82. “In their target picking, these opportunistic attackers look for internet-exposed devices, abusing default credentials/insecure protocols that do not have authentication, etc.”
The report opens a critical window into the attack risks facing critical infrastructure providers. The Iran war has raised the threat of direct attacks against key industries in the U.S., Israel and other allies in order to sow discord and disrupt essential services.
“Since it is now well established that critical infrastructure cannot be dissociated from national security and economic prosperity, they have become prime targets,” Katell Thielemann, distinguished VP analyst at Gartner, told Cybersecurity Dive
Just last week, a state-linked threat actor launched a major attack against Stryker, a Michigan-based company that is a major provider of surgical and orthopedic devices to hospitals worldwide. A threat group tracked as Handala claimed credit for the attack, which involved the abuse of Microsoft Intune to wipe data from thousands of employee devices. The attack disrupted manufacturing, ordering and shipping at the company. Stryker said it is beginning to restore key services.
The Cybersecurity and Infrastructure Security Agency warned in December that pro-Russia groups were targeting critical infrastructure using VNC connections. Targeted sectors have included drinking and wastewater, food and agriculture, and energy systems.
The Food and Agriculture-ISAC was one of several information sharing groups earlier this month to warn of state-sponsored and hacktivist threat activity linked to the Iran war.
The Claroty report is based on analysis of more than 200 attacks, which took place over a 12-month period.
