New Russian-Linked Malware Poses “Immediate Threat” to Energy Grids

New Russian-linked malware intended to get down energy networks has been determined by Mandiant threat scientists, who have urged electricity companies to just take action to mitigate this “immediate menace.”

The specialized operational technology (OT) malware, dubbed COSMICENERGY, has similarities to malware used in former attacks targeting electric power grids, like the ‘Industroyer’ incident that took down power in Kiev, Ukraine in 2016.

COSMICENERGY is built to disrupt electrical electric power by interacting with IEC 60870-5-104 (IEC-104) common gadgets, this sort of as distant terminal models. These devices are frequently utilised in electrical transmission and distribution operations in Europe the Middle East and Asia.

Likewise, in the Industroyer attack in 2016, thought to have been perpetrated by Russian APT group Sandworm, the malware issued IEC-104 ON/OFF instructions to interact with RTUs, and may well have produced use of an MSSQL server as a conduit procedure to entry OT.

This enabled attackers to mail remote instructions to have an impact on the actuation of energy line switches and circuit breakers, thus triggering ability disruption.

Mandiant reported that COSMICENERGY was uploaded to a public malware scanning utility by a submitter in Russia in December 2021. Curiously, from its subsequent investigation, the business thinks Russian cybersecurity enterprise Rostelecom-Photo voltaic or a contractor could have to begin with made the malware for coaching uses – to recreate actual attack scenarios against power grid assets.

Mandiant scientists said it is then feasible that a danger actor, with or without the need of permission, reused code linked with the cyber vary to create this malware.

This will make COSMICENERGY distinct from former OT malware created to choose down electricity grids – as threat actors are leveraging know-how from former attacks to generate new offensive instruments, thereby reducing he barrier to entry to attack OT units.

This is significantly relating to “since we usually observe these styles of capabilities confined to properly resourced or condition sponsored actors.”

Thus, the scientists warned: “Given that risk actors use purple team resources and public exploitation frameworks for focused danger exercise in the wild, we believe COSMICENERGY poses a plausible risk to impacted electrical grid assets. OT asset entrepreneurs leveraging IEC-104 compliant devices should really consider action to preempt opportunity in the wild deployment of COSMICENERGY.”

The workforce observed that COSMICENERGY lacks discovery abilities, “which implies that to effectively execute an attack the malware operator would have to have to conduct some inner reconnaissance to get natural environment information and facts.”

Some elements of this article are sourced from:
www.infosecurity-journal.com