The state of the station A report on attackers in the energy industry CONTENTS Introduction 3 Outmoded and out there 4 Changing the game 4 The names 5 The profiles 5 Two groups, one spillover 9 A plethora of opportunity 10 Attack targets and the reasons behind them 10 The ‘How’ 11 Investigating and naming 12 Still succeeding 12 Mitigating 13 Conclusions 15 THE STATE OF THE STATION 2 INTRODUCTION Interconnected systems in the energy industry increase cyber vulnerabilities, with cyber attacks often going undetected for some time. Malicious actors are increasingly targeting critical infrastructure (CNI) sites and distribution facilities for energy, and cyber attacks have real-world effects. As energy companies save costs against the backdrop of a lower oil price, consolidating operations can weaken business resilience and redundancy levels. This gives rise to new, single critical points of failure, with any disruption across the supply chain potentially having increased consequences. Cyber attacks using individual vulnerabilities and exploits have, and always will be directed against the vast number of Programmable Logic Controllers (PLCs) in existence. However, connecting Industrial Control Systems (ICS) to the Internet and enterprise business networks is increasing. These factors, plus fewer backups in place with an increased dependency on fewer facilities, are only part of the picture. OUTMODED AND OUT THERE Many Operational Technology (OT) components connection was usual. Cyber security was not a have built-in remote operation capabilities, but are realistic threat when they were manufactured, and partly or entirely lacking in security protocols such legacy protocols and systems never had built-in as authentication. These concerns are not new, but security controls that we take for granted today. many have recognized the need for increased cyber Transitioning these systems to the Internet has security around CNI for years. opened them up to attacks from a myriad of angles. Critical infrastructure is unique in the threat Updates and security patching further complicate landscape, however. It is one of few sectors to be the issue – especially when a system needs to be tied to private and public infrastructure, with a wide “on” all the time. This leaves little-to-no time for spread of physical and mobile assets. Consequently, critical security improvements. Moreover, any there are a number of different factors that influence system costing millions and designed to work for who, how, and why attackers target CNI. decades is not going to be readily discarded and replaced by a new one, even if it is deemed to be A considerable number of CNI systems in use were insecure. Together, these factors allow attackers to installed before the advent of Stuxnet. Many of successfully penetrate ICSs. them were built decades ago before a 24/7 internet CHANGING THE GAME A variety of different adversaries, each with their ability to carry out other normal business functions, own motivations and tradecraft, constantly strive however. to compromise organizations that operate critical infrastructure. Nation-state sponsored Advanced Appropriating APTs to just nation-state groups belies Persistent Threat (APT) groups continue to seek the fact that the threat landscape has moved on, network foothold positions on CNIs and espionage however. Nation-state capabilities trickle down and opportunities in the interests of exercising become more widely available, giving other hacking political leverage. A realistic worst-case scenario groups the ability to be as advanced and persistent is a type of DoS attack against a power plant’s as APTs. Cyber criminals, who are generally after ICS infrastructure, driving the facility down and money, have acquired sophisticated tools as a making it unavailable for a long time. Potential result of the Shadow Brokers and Vault7 data outcomes include destroying the industrial control breaches and modified their operating procedures. devices and systems. As a rule, the segregation Money laundering techniques have also changed between operational and business IT assets (e.g. considerably, fueling ever-greater ransomware programmable logic controllers versus a corporate demands. user’s laptop) means that attacks of this type are unlikely to impact a power plant’s operational capability. They would impact a power plant’s THE STATE OF THE STATION 4 THE NAMES Determining the number of attackers/malwares/techniques targeting the energy industry is not an exact science, but 9 different ones stand out. These are: • Operation Sharpshooter (Lazarus Group) • Industroyer Malware – also known as • APT33 CrashOverride • GreyEnergy (the successor to the BlackEnergy • Dragonfly/Dragonfly 2.0 group) • Havex Malware • BlackEnergy 1, 2 and 3 Malware • ICS side-channel attack • TRITON/TRISIS Malware THE PROFILES Operation Sharpshooter: a name given by McAfee positions at unknown companies for a campaign which started on October 25, 2018. Additional evidence uncovered recently strengthens The job titles are: Strategic Planning Manager, suspicions that this campaign is operated by the Business Intelligence Administrator, and Customer Lazarus Group. Its current focus seems to be on Service Representative. These are distributed by an cyber espionage and reconnaissance. Using spear IP address in the United States through the Dropbox phishing, threat actors approach their targets service The group does not commonly attack the disguised as recruiters via a social media service energy industry, but the operation touching this using English-language job description titles for sector might have been collateral. Initial access: Spear phishing via service Execution: Scripting, user execution, command-line interface Persistence: Registry Run Keys / Startup Folder Defense evasion: Process injection, obfuscated files or information, file deletion, hidden files and directories Discovery: Account discovery, file and directory discovery, process discovery, system network configuration discovery, system network connections discovery, system time discovery, query registry Collection: Data from local system, automated collection Exfiltration: Automated exfiltration, exfiltration over command and control channel, data encrypted Command and control: Commonly-used port, remote access tools, web service, data encoding THE STATE OF THE STATION 5 APT33: believed to be supported by the December 2018, used a new variant of the Shamoon government of Iran focusing on cyber espionage disk wiper – a tool that wipes data on computers and reconnaissance. The malware has been tied to and can cause energy companies significant costs – an Iranian persona who may have been employed called Shamoon 3, which built on the capabilities of by the Iranian government to conduct cyber threat the previous versions. activity against its adversaries. Industry targets include mainly aviation and energy, It has shown increased activity since the US nuclear though it appears to be overall less advanced than deal withdrawal in May 2018. The latest attack, some other actors targeting the energy sector. It has against Italian oil and gas company Saipem in two aliases: Magic Hound, and Timber Worm. 2013 2016 - 2017 2018 First attributed cyber espionage Attacking aerospace and energy US nuclear deal withdrawal sparks operations in 2013. organizations. increased activity in APT 33 Initial access: Spear phishing link, spear phishing service Execution: Mshta, PowerShell, user execution, scripting, exploitation for client execution Persistence: Registry Run Keys / Startup Folder Privilege escalation: Valid accounts Defense evasion: Obfuscated files or information, de-obfuscate/decode files or information Credential access: Credential dumping, brute force Command and control: Data obfuscation GreyEnergy: the successor to BlackEnergy malware examined, is via a spear phishing attachment. still affecting Ukraine. Directed against energy and other high-value industry targets, the malware is The adversary uses decoy word documents with used to attack ICS control workstations running malicious macros used to download and execute Supervisory Control and Data Acquisition (SCADA) the GreyEnergy Mini Backdoor before escalating software and servers. privileges and installing the main one. Malware modules are encrypted or fileless in nature. Any The group focuses on cyber espionage and tools used are securely wiped from the target reconnaissance, with a high focus on stealth and systems. The most recent activity is traced to mid- leaving minimal footprints and traces. Initial access, 2018. like the majority of the groups/malware we have 2015 2014 - 2015 First GreyEnergy attributed 2016 2017 - 2018 The predecessor group “Black attack. Targeting an energy Early version of NotPetya worm Most recent activity recorded in Energy” is active and disappears company in Poland deployed by GreyEnergy. mid 2018 THE STATE OF THE STATION 6 Initial access: Exploit public-facing application, spear phishing attachment Execution: Scripting, service execution, user execution, PowerShell Persistence: Registry Run Keys / Startup Folder, modify existing service, Web Shell Privilege escalation: Valid accounts Defense evasion: Code signing, file deletion, masquerading, indicator removal on host, process injection, timestomp, deobfuscate/decode files or information, obfuscated files or information Credential access: Credential dumping, input capture, credentials in files, credentials in registry Discovery: Query registry, system information