CP
cyberpings
Threat IntelHIGH

Critical OT Attacks Loom as State Hackers Shift Tactics

CSCSO Online
VoltziteKamaciteElectrumDragosICS
🎯

Basically, state-affiliated hackers are now trying to disrupt industrial systems, and few can detect them.

Quick Summary

State-affiliated hackers are shifting focus to disrupt industrial systems, posing a serious risk to essential services. With fewer than 10% of OT networks able to detect these threats, the potential for chaos is high. Experts urge immediate action to enhance monitoring and patch vulnerabilities.

What Happened

A chilling shift is happening in the world of cybersecurity. State-linked hackers are now focusing on disrupting operational technology (OT) networks instead of just gaining access. This change poses a significant threat, especially since less than 10% of OT networks have monitoring systems to detect such disruptions, according to industrial cybersecurity firm Dragos.

One notable group, known as Voltzite, has been linked to China’s Volt Typhoon campaign. They were recently observed manipulating engineering workstations within U.S. energy and pipeline networks. Their goal? To identify operational conditions that could trigger process shutdowns?. This move elevates them to Stage 2 of Dragos’ ICS Cyber Kill Chain?, indicating a more aggressive approach.

Another group, Kamacite, has shifted its focus from corporate supply chains to directly scanning U.S. industrial control devices. For four months, they mapped specific control loops, raising alarms about their intentions. Their partner group, Electrum, previously targeted Polish energy infrastructure, marking a significant escalation in cyberattacks on distributed energy resources (DERs). Robert M. Lee, CEO of Dragos, noted that these state teams are likely being directed to leverage their access within a short timeframe, increasing the urgency of the threat.

Why Should You Care

You might think this is just a problem for big companies, but it affects you, too. Imagine if hackers could disrupt the power grid or water supply in your city. The reality is that many OT asset owners have little visibility into their own networks, making it likely that some compromised sites will never be cleaned up. This lack of oversight means that hackers can set up disruptive capabilities that could be triggered during geopolitical conflicts.

It’s like leaving the back door of your house unlocked; you might not notice until something valuable is stolen. If these hackers succeed, it could lead to widespread outages or even worse, impacting essential services we rely on daily. The stakes are high, and the potential for chaos is real.

What's Being Done

So, what’s being done to combat this threat? Experts are closely monitoring these groups and their activities. Here are some immediate action items:

  • Increase monitoring: Ensure your OT networks have proper monitoring systems in place.
  • Patch vulnerabilities: Stay updated on patches for devices like VPN appliances and network-edge devices.
  • Educate staff: Train your team to recognize suspicious activities within your networks.

Experts are watching for how these state-affiliated groups will continue to evolve. The combination of sophisticated tactics and the apparent lack of defenses in many OT environments means that the threat landscape is changing rapidly. Be prepared for what’s next.

💡 Tap dotted terms for explanations

🔒 Pro insight: The operational readiness of these state teams suggests a coordinated strategy that could lead to rapid escalations in cyber conflict.

Original article from

CSO Online

Read Full Article

Share

Related Pings

HIGHThreat Intel

Threat Intel - AiTM Phishing Kit Hijacks AWS Accounts

Hackers are using an AiTM phishing kit to hijack AWS accounts. Meanwhile, a year-long malware campaign is targeting HR departments, posing serious risks to sensitive data. Organizations must act swiftly to bolster their defenses.

Help Net Security·
HIGHThreat Intel

Storm-2561 Campaign Targets Users with Fake VPN Sites

Storm-2561 is tricking users into downloading fake VPN software. This affects anyone searching for trusted VPN clients. The risk includes stolen corporate credentials and potential data breaches. Stay vigilant and verify software sources.

Security Affairs·
HIGHThreat Intel

Operation Synergia III: 45,000 Malicious IPs Taken Down Globally

INTERPOL's Operation Synergia III dismantled 45,000 malicious IPs and arrested 94 suspects. This global effort highlights the growing threat of cybercrime. Authorities are committed to ongoing investigations and collaboration to combat these issues.

Security Affairs·
HIGHThreat Intel

Massive Crackdown on 45,000 Malicious IPs Behind Ransomware

In a historic crackdown, INTERPOL and 72 nations shut down over 45,000 malicious IPs linked to cybercrime. This operation highlights the global effort to combat ransomware and phishing attacks. With numerous arrests and seized servers, authorities are making strides to dismantle cybercriminal networks.

Cyber Security News·
HIGHThreat Intel

AI Phishing Attacks Surge with Malicious SVGs Post-Holiday

AI phishing attacks have surged post-holidays, with a 50-fold increase in malicious SVGs. Many users are affected as attackers impersonate trusted entities. This evolving threat highlights the need for enhanced email security measures.

SC Media·
HIGHThreat Intel

Europol Shuts Down Major Phishing Platform: Tycoon 2FA

Europol and vendors have taken down the Tycoon 2FA phishing platform. This operation disrupts a major threat to users. Stay alert and protect your data from phishing scams.

Proofpoint Threat Insight·