ICS Threat Analysis: New, Experimental Malware Can Kill Engineering Processes

Testo acquisito dalla fonte

Evento MISP pubblicato con TLP:CLEAR: ICS Threat Analysis: New, Experimental Malware Can Kill Engineering Processes. Summary # ICS Threat Analysis: New, Experimental Malware Can Kill Engineering Processes #### Summary * Our analysis of a public malware repository shows a constant drumbeat of OT/ICS malware * Since +20% of all OT/ICS attacks target engineering workstations, we focused on it * We saw 2 incidents with Mitsubishi engineering workstations infected with [Ramnit]([URL rimossa]) worm * We analyzed 3 samples of new malware that kills Siemens engineering processes —we’ve named it Chaya\_003 #### Guidance * Harden engineering workstations * Segment the network * Monitor for threats * Full analysis and recommendations for mitigation are below OT-specific malware – such as FrostyGoop/BUSTLEBERM – is still much less common than malware targeting enterprise software or mobile operating systems by volume. But there’s little room to sleep easily if you’re a security operator in OT or manage [industrial control system security](/glossary/ics-security/). Malware in OT/ICS is more common than you think — and engineering workstations connected to the internet are targets. We [recently analyzed](/blog/targeting-ot-security-ics-threats-malware/) automated botnet families, such as Aisuru, Kaiten and Gafgyt, that could be found on the VirusTotal public malware repository around the same time as FrostyGoop/BUSTLEBERM. What we found included either default credentials of OT devices for initial infectio