Our research team has put together all of the most relevant news topics in the Ransomware and IoT security fields, as well as their impacts and their expert recommendations:

On April 27, the Cybersecurity and Infrastructure Security Agency (CISA), published a joint advisory in collaboration with CSA/NSA/FBI/ACSC and other cybersecurity authorities, providing details on the top 15 vulnerabilities routinely exploited by threat actors in 2021,and other CVEs frequently exploited.

Russian-backed Group Attempts to Compromise Ukrainian Power Grid Using Industroyer2 Malware

As part of their ongoing military assault against neighboring Ukraine, Russian-backed hacker group Sandworm launched a series of cyber attacks that threaten the critical infrastructure of the beleaguered country. 

Russian-backed Group Attempts to Compromise Ukrainian Power Grid Using Industroyer2 Malware

As part of their ongoing military assault against neighboring Ukraine, Russian-backed hacker group Sandworm launched a series of cyber attacks that threaten the critical infrastructure of the beleaguered country. 

Dangerous New Malware Can Shut Down, Sabotage Industrial Sites

Two vulnerabilities in Rockwell programmable logic controllers and engineering workstation software have been disclosed. These vulnerabilities give attackers a way to modify automation processes and potentially disrupt industrial operations, cause physical damage to factories, and perform other malicious actions.

Our research team has put together all of the most relevant news topics in the ICS, IT, Ransomware & OT security fields, as well as their impacts and their expert recommendations:

Our research team has put together all of the most relevant news topics in the ICS, IT, Ransomware & OT security fields, as well as their impacts and their expert recommendations:

ICS:

1. Title: Access:7 Vulnerabilities Impact SCADA, Medical and IoT Devices
   Description: Seven vulnerabilities, tracked as Access:7, have been found in Parametric Technology Corporation’s (PTC) Axeda agent, used for remote access and management of over 150 connected devices from more than 100 vendors. Three of these flaws can be exploited to achieve remote code execution1.
   Besides healthcare-related technologies, these flaws also affect SCADA systems, asset monitoring technologies, IoT gateways, and more2.
   These are supply chain vulnerabilities, as Access:7 affects a solution sold to device manufacturers that did not develop their remote servicing system.

Attack Parameters: These vulnerabilities can be exploited by command injection, buffer overflow, and directory traversal.
Impact: Up to full compromise (RCE, DoS, sensitive data exposure, configuration modification, and specific services shut down)
SCADAfence Coverage: The SCADAfence Platform detects OS command injection and path traversal.

Recommendations: PTC has released patches for these vulnerabilities3.

2. Title: TLStorm Vulnerabilities Impact APC Smart-UPS
   Description: Three critical vulnerabilities in smart uninterruptible power supply (UPS) devices, dubbed TLStorm, could allow for remote takeover. APC is a subsidiary of Schneider Electric, one of the leading vendors of UPS devices. UPS devices provide emergency backup power for mission-critical assets that require high availability4.

Attack Parameters: These vulnerabilities can be exploited remotely. Two zero-click vulnerabilities are in the implementation of the TLS protocol that connects the devices to the Schneider Electric management cloud.
Impact: Up to full compromise (information theft, configuration modification, RCE).
This could allow attackers to disrupt business services or cause physical damage by taking down critical infrastructure.
Recommendations: Schneider Electric released patches for these vulnerabilities.

Additional mitigations include:

1. Deploying access control lists in which the UPS devices are only allowed to communicate with a small set of management devices and the Schneider Electric Cloud via encrypted communication.
2. Changing the default NMC password and installing a publicly-signed SSL certificate.

IT:

1. Title: Microsoft March Patch Tuesday

Description: Microsoft fixed 71 vulnerabilities, three of these critical, as they allow remote code execution. This Patch Tuesday also included fixes for three zero-day vulnerabilities5.

While these vulnerabilities haven’t been used in attacks, there are public PoC exploits for two of the zero-day vulnerabilities, one of them allowing remote code execution.

The remote code execution flaws which are more likely to be targeted are CVE-2022-23277 (Microsoft Exchange Server), CVE-2022-21990 (Remote Desktop Client), and CVE-2022- 24508 (Windows SMBv3 Client/Server)6.

Attack Parameters: Different for each vulnerability, though many can be exploited remotely. Impact: Up to full compromise (privilege escalation, information disclosure, DoS, RCE) SCADAfence Coverage:

1. The SCADAfence Platform provides the ability to detect anomalous SMB activity.
2. The CVEs mentioned above will be added to the Roadmap upon available POCs.

SCADAfence Recommendations:

1. Microsoft has released patches for these vulnerabilities.
2. RDP and SMB connections can be tracked with User Activity Analyzer.

Ransomware:

1. Title: Conti Ransomware Operation Leaks
   Description: A Ukrainian researcher leaked messages taken from the Conti and Ryuk ransomware gang’s private chat server. The information in these messages included bitcoin addresses, evading law enforcement, how they conduct their attacks, the source code for the administrative panel, the BazarBackdoor API, screenshots of storage servers, and more. A password-protected archive containing the source code for the Conti ransomware encryptor, decryptor, and builder was leaked as well. While the leaker did not share the password, another researcher cracked it, allowing everyone access to the source code7.

Impact: The source code provides insight into how the malware works. However, the availability of the source code could lead to the attempt of other threat actors to launch their own operations using the leaked code.
It is unclear yet how this data breach will affect Conti’s operation.

2. Title: Lapsus$ Extortion Group – NVIDIA and Samsung Breaches
   Description: Over the past two weeks, Lapsus$ extortion gang breached two international companies – NVIDIA and Samsung Electronics.
   Lapsus$ gang broke into NVIDIA’s network, stole information and threated to leak it unless the company removes the LHR limitations in the GeForce RTX 30 Series. The gang stole confidential information, the source code of its Deep Learning technology (DLSS), and more8. Employee credentials were leaked and two expired code signing certificates were stolen. These were used to sign malwares and tools, such as Cobalt Strike and Mimikatz9.
   A week later, the gang hit Samsung Electronics and exfiltrated data, including internal company data, the source code related to its Galaxy devices, the source code for trusted applets installed within TrustZone, algorithms for biometric authentication, and confidential data from its chip supplier Qualcomm10.
   Targets: NVIDIA, Samsung Electronics, Qualcomm
   Impact: Part of NVIDIA’s business was offline for two days. In the case of Samsung, the breach could provide a pathway into Samsung devices, rendering them vulnerable11.

SCADAfence Coverage: The SCADAfence Platform detects the use of Cobalt Strike and Mimikatz. Further investigation is pending the publication of additional technical information. Recommendations: Following are additional best practices recommendations:

1. Make sure secure offline backups of critical systems are available and up-to-date.
2. Apply the latest security patches on the assets in the network.
3. Use unique passwords and multi-factor authentication on authentication paths to OT assets.
4. Encrypt sensitive data when possible.
5. Educate staff about the risks and methods of ransomware attacks and how to avoid infection.

3. Title: RagnarLocker Ransomware
   Description: Ragnar Locker ransomware gang has breached the networks of at least 52 organizations from multiple US critical infrastructure sectors12.
   Targets: Entities in the critical manufacturing, energy, financial services, government, and information technology sectors.

Attack Parameters: RagnarLocker frequently change obfuscation techniques to avoid detection and prevention. IOCs associated with RagnarLocker activity include information on attack infrastructure, Bitcoin addresses used to collect ransom demands, and email addresses used by the gang’s operators, were released.
Impact: Unknown due to limited information published.

SCADAfence Coverage: The SCADAfence Platform detects the use of CMD to execute commands and the attempt to stop services, both techniques used by the gang.
Recommendations: The FBI advised against paying a ransom, and encouraged businesses to report any ransomware attacks to help prevent future incidents. An advisory was published providing IOCs that can be used to detect and defend against this ransomware.
Following are additional best practices recommendations:

1. Make sure secure offline backups of critical systems are available and up-to-date.
2. Apply the latest security patches on the assets in the network.
3. Use unique passwords and multi-factor authentication on authentication paths to OT assets.
4. Encrypt sensitive data when possible.
5. Educate staff about the risks and methods of ransomware attacks and how to avoid infection.

4. Title: Toyota Production Affected by Cyberattack
   Description: A system failure at one of Toyota’s suppliers of vital parts, Kojima Industries, caused Toyota to suspend the operation of 28 production lines in 14 plants in Japan13. Although Kojima has not published any official information, the company’s website was offline and Japanese news outlets claimed that the disruption is a result of a cyberattack. This attack could be linked to Japan’s sanctions on Moscow, though there is no confirmation of a Russian connection.
   Attack Parameters: Unknown due to limited information published.

Impact: The expected impact is a 5% drop in Toyota’s monthly production in Japan, which translates to roughly 13,000 units.
Recommendations: Unknown due to limited information published.

Additional Resources:

1 https://www.bleepingcomputer.com/news/security/access-7-vulnerabilities-impact-medical-and-iot-devices/, https://www.ptc.com/en/support/article/CS363561

2 https://www.darkreading.com/vulnerabilities-threats/medical-and-iot-devices-from-more-than-100-vendors-vulnerable-to-attack

3 https://www.forescout.com/resources/access-7-supply-chain-vulnerabilities-can-allow-unwelcomed-access-to-your-medical-and-iot-devices/

4 https://threatpost.com/zero-click-flaws-ups-critical-infratructure/178810/, https://info.armis.com/rs/645-PDC-047/images/Armis-TLStorm-WP%20%281%29.pdf

5 https://www.bleepingcomputer.com/news/microsoft/microsoft-march-2022-patch-tuesday-fixes-71-flaws-3-zero-days/, https://threatpost.com/microsoft- zero-days-critical-bugsmarch-patch-tuesday/178817/

6 https://www.darkreading.com/vulnerabilities-threats/microsoft-patches-critical-exchange-server-flaw

7 https://www.bleepingcomputer.com/news/security/conti-ransomware-source-code-leaked-by-ukrainian-researcher/

8 https://thehackernews.com/2022/03/hackers-who-broke-into-nvidias-network.html, https://www.bleepingcomputer.com/news/security/hackers-to-nvidia- remove-mining-cap-or-we-leak-hardware-data/,

9 https://www.securityweek.com/credentials-71000-nvidia-employees-leaked-following-cyberattack, https://www.bleepingcomputer.com/news/security/malware-now-using-nvidias-stolen-code-signing-certificates/

10 https://thehackernews.com/2022/03/samsung-confirms-data-breach-after.html , https://www.bleepingcomputer.com/news/security/samsung-confirms-hackers-stole-galaxy-devices-source-code/

11 https://threatpost.com/samsung-lapsus-ransomware-source-code/178791/

12 https://www.bleepingcomputer.com/news/security/fbi-ransomware-gang-breached-52-us-critical-infrastructure-orgs/

13 https://www.bleepingcomputer.com/news/security/toyota-halts-production-after-reported-cyberattack-on-supplier/ , https://threatpost.com/toyota-to-close-japan-plants-after-suspected-cyberattack/178686/

In recent weeks, Ukraine has been hit with numerous cyberattacks targeting its government and banking sector as a part of the Russo-Ukrainian crisis. Several Ukrainian government departments and banks were knocked offline by a DDoS attack, and multiple wiper malwares have been observed targeting Ukrainian organizations.

For its part, Russia claimed it has never conducted and does not conduct any malicious operations in cyberspace.

These attacks resulted in fear of a wider cyber conflict, with western governments bracing for Russian cyberthreats and considering their response.

The Russia-Ukraine Cyber Conflict

In January, about 70 government websites were taken offline by a DDoS attack. Shortly after, a destructive malware infected government, non-profit, and IT organization devices in Ukraine. This malware, dubbed WhisperGate, was designed to look like ransomware, but lacks a recovery feature, indicating that their goal was to destroy files rather than to encrypt them for ransom.

Hours prior to the beginning of the Russian invasion of Ukraine, a new wiper malware was discovered. This attack leveraged at least three components: HermeticWiper for data wiping, HermeticWizard for spreading in the network, and HermeticRansom acting as a decoy ransomware. HermeticWiper was seen conducting malicious activity as early as November 2021, indicating that the attack was prepared months in advance. 

As the invasion began, the second wiper malware, IsaacWiper, surfaced. IsaacWiper and HermeticWiper have no code similarities, the former is less sophisticated than the latter.

While it cannot be confirmed whether Russia is behind these attacks, it is believed they are part of Russia’s “hybrid warfare”, which consists of a combination of conventional and advanced methods.

Ukraine’s cyber activity has not been solely defensive, with the Ukrainian government forming an “IT Army”. Since the crisis began, several Russian government and media websites have been intermittently offline. Some of these attacks were carried out by the Anonymous hacktivist movement, which has pledged allegiance to Ukraine. The group and its affiliates also claimed to have compromised the Russian Nuclear Institute and the Control Center of the Russian Space Agency ‘Roscosmos’.

Russian APT Groups and Known Attacks

There are a number of APT groups affiliated with Russian organizations:

APT28

• Attribution: Russia’s General Staff Main Intelligence Directorate (GRU)
• Active since: 2004
• Targets: The defense and energy sectors and government organizations
• Associated attacks: The Hillary Clinton campaign, the Democratic National Committee, and the Democratic Congressional Campaign Committee in 2016
• Tools used: Koadic, Mimikatz, Net, Responder, Tor, USBStealer, Zebrocy

APT29

• Attribution: Russia’s Foreign Intelligence Service (SVR)
• Active since: 2008
• Targets: Government networks in Europe and NATO member countries, research institutes, and think tanks
• Associated attacks: The SolarWinds supply chain compromise cyber operation was attributed to the SVR, public statements included citations to APT29
• Tools used: Mimikatz, Net, Cobalt Strike, PsExec, CosmicDuke, FatDuke, GeminiDuke, PowerDuke, SeaDuke, SUNBURST

Sandworm Team

• Attribution: Russia’s General Staff Main Intelligence Directorate (GRU)
• Active since: 2009
• Targets: Ukrainian electrical companies and government organizations, Georgia
• Associated attacks: The 2015 and 2016 attacks against Ukrainian electrical companies and government organizations, the NotPetya attack, the 2018 Olympic Destroyer attack, and attacks against Georgia in 2018 and 2019
• Tools used: Mimikatz, Net, PsExec, BlackEnergy, Industroyer, NotPetya, KillDesk

Wizard Spider

• Attribution: Russia-based financially motivated threat group
• Active since: 2016
• Targets: The group has conducted ransomware campaigns against a variety of organizations, ranging from major corporations to hospitals
• Associated attacks: The group is originally known for the creation and deployment of TrickBot
• Tools used: Mimikatz, Net, Cobalt Strike, PsExec, Empire, Bazar, Conti, Dyre, Emotet, GrimAgent, Ryuk, TrickBot

Dragonfly 2.0

• Attribution: A suspected Russian threat group
• Active since: 2015
• Targets: Government entities and multiple U.S. critical infrastructure sectors and parts of the energy sector within Turkey and Switzerland
• Associated attacks: 
• Tools used: Net, PsExec, Reg, CrackMapExec, Impacket

Additional Russian APT groups include ALLANITE, Indrik Spider, Nomadic Octopus, TEMP.Veles, and Turla.

Tools and Vulnerabilities

These APT groups use various tools and malwares in their attacks, ranging from commercial, open-source software, to custom software designed for malicious purposes.

Tools:

1. Mimikatz – Mimikatz is a credential dumper capable of obtaining plaintext Windows account logins and passwords.
2. Net – The Net utility is a component of the Windows operating system, which can be useful for an adversary, such as gathering system and network information for discovery, moving laterally through SMB/Windows admin shares, and interacting with services.
3. Cobalt Strike – Cobalt Strike is an adversary simulation software designed to execute targeted attacks and emulate the post-exploitation actions of advanced threat actors.
4. PsExec – PsExec is a tool that can be used to execute a program on another computer. It is used by IT administrators and attackers.
5. Empire – Empire is a post-exploitation tool which was one of five tools singled out by a joint report on public hacking tools being widely used by adversaries.

ICS Malwares:

1. BlackEnergy – BlackEnergy is a malware toolkit that was originally designed to create botnets for use in conducting DDoS attacks. It is well known for being used during the confrontation between Georgia and Russia in 2008, as well as in targeting Ukrainian institutions.
2. Industroyer – Industroyer is a sophisticated malware framework designed to impact the working processes of industrial control systems (ICS), specifically components used in electrical substations. It was used in the attacks on the Ukrainian power grid in December 2016.
   
   

Additional Malwares and Ransomwares:

1. NotPetya – While NotPetya appears as a form of ransomware, its main purpose was to destroy data and disk structures on compromised systems. It contains worm-like features to spread itself across a computer network using the SMBv1 exploits EternalBlue and EternalRomance.
2. Bazar – Bazar is a downloader and backdoor with infections primarily against professional services, healthcare, manufacturing, IT, logistics and travel companies across the US and Europe.
3. Conti – Conti is a ransomware-as-a-service that has been used against major corporations and government agencies, particularly those in North America.
4. Emotet – Emotet is a modular malware variant used as a downloader for other malwares such as TrickBot. It has been primarily used to target the banking sector.
5. Ryuk – Ryuk is a ransomware designed to target enterprise environments.
6. TrickBot – TrickBot is a Trojan spyware program used for targeting banking sites in North America, Australia, and throughout Europe; it has since been used against all sectors worldwide as part of “big game hunting” ransomware campaigns.
   
   

How SCADAfence Helps Industrial Organizations

We provide a comprehensive solution – The SCADAfence platform which was built to protect industrial organizations like yours from industrial cyber attacks (including ransomware). It also helps you implement better security practices amongst its built-in features. Some of these include:

• Asset Management 
• Network Maps
• Traffic Analyzers

The platform, which is also the highest-rated OT & IoT security platform, also monitors the network traffic for any threats, including ones that are found in typical ransomware attacks; such as:

• Security exploits being sent across the network.
• Lateral movement attempts using the latest techniques.
• Network scanning and network reconnaissance.
  
  

SCADAfence’s security research team is constantly tracking events and incidents, analyzing them, and implementing different ways to detect those events.

• The SCADAfence Platform detects the use of WMI and SMB, used by HermeticWizard for spreading across the network.
• The Platform also detects various tools and vulnerabilities used by Russian APTs, attacks and malware such as: EternalBlue & EternalRomance, BlueKeep, Metasploit, Cobalt-Strike, Remote Services, Remote Scheduled Tasks, OS Credential Dumping (Mimikatz), BITSAdmin and SMB brute-force.
• The Platform provides an up to date reputation service to track malicious files, IPs and domains associated with Russian APTs and malware.

Recommendations & Best Practices

SCADAfence team recommends following the best practices:

• Make sure secure offline backups of critical systems are available and up-to-date.
• Apply the latest security patches on the assets in the network.
• Use unique passwords and multi-factor authentication on authentication paths to OT assets.
• Enable strong spam filters to prevent phishing emails from reaching end users.
• Disable ports and protocols that are not essential.
• Encrypt sensitive data when possible.
• Educate staff about the risks and methods of ransomware attacks and how to avoid infection.
• Recommendation for HermeticWizard: Monitor traffic on the ports HermeticWizard uses to worm through networks – ports 20, 21, 80, 135, 137, 139, 443, and 445.
• Recommendation for HermeticRansom: Consider using the Go script in the following link for decryption purposes.

NEW YORK and TEL AVIV, Israel, Jan. 18, 2022 /PRNewswire/ — SCADAfence, the global leader in cybersecurity for Operational Technology (OT) and Internet of Things (IoT) environments, announced today that they were named a market leader in the new ISG Provider Lens™ – Manufacturing Industry Services 2021 report which was published by ISG, a leading global technology research and advisory firm.

Analyst firm ISG has recognized SCADAfence as the market leader in portfolio attractiveness & competitive strength in their latest ISG Provider Lens report

In this quadrant report, ISG lays out the current market positioning of providers of OT security solutions and how they address the key challenges that industrial organizations face. ISG observes that the traditional OT security market is niche and mature, with focused products that address legacy industrial platforms and networks. As these legacy systems evolve into cyber-physical systems, their security becomes strategically important for both OT and IT stakeholders. ISG’s 2021 report is relevant to enterprises across all industries that are evaluating solution providers of OT security solutions.

The ISG report commends SCADAfence for its unique approach to governance and compliance in OT security. SCADAfence’s industry-leading IT/OT governance and compliance portal takes the passive data existing in their networks and enables customers to find out their degree of compliance with their industry standards. The portal covers industrial compliance frameworks such as IEC62443, ISO27001, NERC, NIST, CMMC, and other important compliance regulations. ISG analysts view the governance portal as a true differentiator for SCADAfence in the OT security market.

ISG highlighted the different product strengths of SCADAfence in the OT security landscape such as the new multi-site portal and 100% deep packet inspection. The analysts noted SCADAfence’s multisite portal benefits their customers with central configuration, management, licensing, and centralized software updates all in one platform. The full report can be accessed here.

“We are pleased to recognize SCADAfence as a leader in our quadrant report,” said Avimanyu Basu, Senior Lead Analyst at ISG.

“SCADAfence’s OT security platform DNA is integrated with a product-led growth approach around IT/OT governance and compliance and proprietary DPI-based technology. With their advanced OT security capabilities, we expect SCADAfence to dominate the OT security market.”

“We’re honored to be recognized as a leader by ISG in their Provider Lens report for Manufacturing Industry Services 2021, OT security solutions,” said Elad Ben-Meir, CEO of SCADAfence. “This acknowledgment and industry recognition for our ongoing efforts in the OT & IoT security space is an affirmation of our hard work and the strength of our unique product vision in the OT security market.”