DOCSLIB.ORG

A Report on Attackers in the Energy Industry CONTENTS

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
A Report on Attackers in the Energy Industry CONTENTS The state of the station A report on attackers in the energy industry CONTENTS Introduction 3 Outmoded and out there 4 Changing the game 4 The names 5 The profiles 5 Two groups, one spillover 9 A plethora of opportunity 10 Attack targets and the reasons behind them 10 The ‘How’ 11 Investigating and naming 12 Still succeeding 12 Mitigating 13 Conclusions 15 THE STATE OF THE STATION 2 INTRODUCTION Interconnected systems in the energy industry increase cyber vulnerabilities, with cyber attacks often going undetected for some time. Malicious actors are increasingly targeting critical infrastructure (CNI) sites and distribution facilities for energy, and cyber attacks have real-world effects. As energy companies save costs against the backdrop of a lower oil price, consolidating operations can weaken business resilience and redundancy levels. This gives rise to new, single critical points of failure, with any disruption across the supply chain potentially having increased consequences. Cyber attacks using individual vulnerabilities and exploits have, and always will be directed against the vast number of Programmable Logic Controllers (PLCs) in existence. However, connecting Industrial Control Systems (ICS) to the Internet and enterprise business networks is increasing. These factors, plus fewer backups in place with an increased dependency on fewer facilities, are only part of the picture. OUTMODED AND OUT THERE Many Operational Technology (OT) components connection was usual. Cyber security was not a have built-in remote operation capabilities, but are realistic threat when they were manufactured, and partly or entirely lacking in security protocols such legacy protocols and systems never had built-in as authentication. These concerns are not new, but security controls that we take for granted today. many have recognized the need for increased cyber Transitioning these systems to the Internet has security around CNI for years. opened them up to attacks from a myriad of angles. Critical infrastructure is unique in the threat Updates and security patching further complicate landscape, however. It is one of few sectors to be the issue – especially when a system needs to be tied to private and public infrastructure, with a wide “on” all the time. This leaves little-to-no time for spread of physical and mobile assets. Consequently, critical security improvements. Moreover, any there are a number of different factors that influence system costing millions and designed to work for who, how, and why attackers target CNI. decades is not going to be readily discarded and replaced by a new one, even if it is deemed to be A considerable number of CNI systems in use were insecure. Together, these factors allow attackers to installed before the advent of Stuxnet. Many of successfully penetrate ICSs. them were built decades ago before a 24/7 internet CHANGING THE GAME A variety of different adversaries, each with their ability to carry out other normal business functions, own motivations and tradecraft, constantly strive however. to compromise organizations that operate critical infrastructure. Nation-state sponsored Advanced Appropriating APTs to just nation-state groups belies Persistent Threat (APT) groups continue to seek the fact that the threat landscape has moved on, network foothold positions on CNIs and espionage however. Nation-state capabilities trickle down and opportunities in the interests of exercising become more widely available, giving other hacking political leverage. A realistic worst-case scenario groups the ability to be as advanced and persistent is a type of DoS attack against a power plant’s as APTs. Cyber criminals, who are generally after ICS infrastructure, driving the facility down and money, have acquired sophisticated tools as a making it unavailable for a long time. Potential result of the Shadow Brokers and Vault7 data outcomes include destroying the industrial control breaches and modified their operating procedures. devices and systems. As a rule, the segregation Money laundering techniques have also changed between operational and business IT assets (e.g. considerably, fueling ever-greater ransomware programmable logic controllers versus a corporate demands. user’s laptop) means that attacks of this type are unlikely to impact a power plant’s operational capability. They would impact a power plant’s THE STATE OF THE STATION 4 THE NAMES Determining the number of attackers/malwares/techniques targeting the energy industry is not an exact science, but 9 different ones stand out. These are: • Operation Sharpshooter (Lazarus Group) • Industroyer Malware – also known as • APT33 CrashOverride • GreyEnergy (the successor to the BlackEnergy • Dragonfly/Dragonfly 2.0 group) • Havex Malware • BlackEnergy 1, 2 and 3 Malware • ICS side-channel attack • TRITON/TRISIS Malware THE PROFILES Operation Sharpshooter: a name given by McAfee positions at unknown companies for a campaign which started on October 25, 2018. Additional evidence uncovered recently strengthens The job titles are: Strategic Planning Manager, suspicions that this campaign is operated by the Business Intelligence Administrator, and Customer Lazarus Group. Its current focus seems to be on Service Representative. These are distributed by an cyber espionage and reconnaissance. Using spear IP address in the United States through the Dropbox phishing, threat actors approach their targets service The group does not commonly attack the disguised as recruiters via a social media service energy industry, but the operation touching this using English-language job description titles for sector might have been collateral. Initial access: Spear phishing via service Execution: Scripting, user execution, command-line interface Persistence: Registry Run Keys / Startup Folder Defense evasion: Process injection, obfuscated files or information, file deletion, hidden files and directories Discovery: Account discovery, file and directory discovery, process discovery, system network configuration discovery, system network connections discovery, system time discovery, query registry Collection: Data from local system, automated collection Exfiltration: Automated exfiltration, exfiltration over command and control channel, data encrypted Command and control: Commonly-used port, remote access tools, web service, data encoding THE STATE OF THE STATION 5 APT33: believed to be supported by the December 2018, used a new variant of the Shamoon government of Iran focusing on cyber espionage disk wiper – a tool that wipes data on computers and reconnaissance. The malware has been tied to and can cause energy companies significant costs – an Iranian persona who may have been employed called Shamoon 3, which built on the capabilities of by the Iranian government to conduct cyber threat the previous versions. activity against its adversaries. Industry targets include mainly aviation and energy, It has shown increased activity since the US nuclear though it appears to be overall less advanced than deal withdrawal in May 2018. The latest attack, some other actors targeting the energy sector. It has against Italian oil and gas company Saipem in two aliases: Magic Hound, and Timber Worm. 2013 2016 - 2017 2018 First attributed cyber espionage Attacking aerospace and energy US nuclear deal withdrawal sparks operations in 2013. organizations. increased activity in APT 33 Initial access: Spear phishing link, spear phishing service Execution: Mshta, PowerShell, user execution, scripting, exploitation for client execution Persistence: Registry Run Keys / Startup Folder Privilege escalation: Valid accounts Defense evasion: Obfuscated files or information, de-obfuscate/decode files or information Credential access: Credential dumping, brute force Command and control: Data obfuscation GreyEnergy: the successor to BlackEnergy malware examined, is via a spear phishing attachment. still affecting Ukraine. Directed against energy and other high-value industry targets, the malware is The adversary uses decoy word documents with used to attack ICS control workstations running malicious macros used to download and execute Supervisory Control and Data Acquisition (SCADA) the GreyEnergy Mini Backdoor before escalating software and servers. privileges and installing the main one. Malware modules are encrypted or fileless in nature. Any The group focuses on cyber espionage and tools used are securely wiped from the target reconnaissance, with a high focus on stealth and systems. The most recent activity is traced to mid- leaving minimal footprints and traces. Initial access, 2018. like the majority of the groups/malware we have 2015 2014 - 2015 First GreyEnergy attributed 2016 2017 - 2018 The predecessor group “Black attack. Targeting an energy Early version of NotPetya worm Most recent activity recorded in Energy” is active and disappears company in Poland deployed by GreyEnergy. mid 2018 THE STATE OF THE STATION 6 Initial access: Exploit public-facing application, spear phishing attachment Execution: Scripting, service execution, user execution, PowerShell Persistence: Registry Run Keys / Startup Folder, modify existing service, Web Shell Privilege escalation: Valid accounts Defense evasion: Code signing, file deletion, masquerading, indicator removal on host, process injection, timestomp, deobfuscate/decode files or information, obfuscated files or information Credential access: Credential dumping, input capture, credentials in files, credentials in registry Discovery: Query registry, system information
Load more

Recommended publications
  • Ransom Where?
    Ransom where? Holding data hostage with ransomware May 2019 Author With the evolution of digitization and increased interconnectivity, the cyberthreat landscape has transformed from merely a security and privacy concern to a danger much more insidious by nature — ransomware. Ransomware is a type of malware that is designed to encrypt, Imani Barnes Analyst 646.572.3930 destroy or shut down networks in exchange [email protected] for a paid ransom. Through the deployment of ransomware, cybercriminals are no longer just seeking to steal credit card information and other sensitive personally identifiable information (PII). Instead, they have upped their games to manipulate organizations into paying large sums of money in exchange for the safe release of their data and control of their systems. While there are some business sectors in which the presence of this cyberexposure is overt, cybercriminals are broadening their scopes of potential victims to include targets of opportunity1 across a multitude of industries. This paper will provide insight into how ransomware evolved as a cyberextortion instrument, identify notorious strains and explain how companies can protect themselves. 1 WIRED. “Meet LockerGoga, the Ransomware Crippling Industrial Firms” March 25, 2019; https://www.wired.com/story/lockergoga-ransomware-crippling-industrial-firms/. 2 Ransom where? | May 2019 A brief history of ransomware The first signs of ransomware appeared in 1989 in the healthcare industry. An attacker used infected floppy disks to encrypt computer files, claiming that the user was in “breach of a licensing agreement,”2 and demanded $189 for a decryption key. While the attempt to extort was unsuccessful, this attack became commonly known as PC Cyborg and set the archetype in motion for future attacks.
    [Show full text]
  • Attacking from Inside
    WIPER MALWARE: ATTACKING FROM INSIDE Why some attackers are choosing to get in, delete files, and get out, rather than try to reap financial benefit from their malware. AUTHORED BY VITOR VENTURA WITH CONTRIBUTIONS FROM MARTIN LEE EXECUTIVE SUMMARY from system impact. Some wipers will destroy systems, but not necessarily the data. On the In a digital era when everything and everyone other hand, there are wipers that will destroy is connected, malicious actors have the perfect data, but will not affect the systems. One cannot space to perform their activities. During the past determine which kind has the biggest impact, few years, organizations have suffered several because those impacts are specific to each kinds of attacks that arrived in many shapes organization and the specific context in which and forms. But none have been more impactful the attack occurs. However, an attacker with the than wiper attacks. Attackers who deploy wiper capability to perform one could perform the other. malware have a singular purpose of destroying or disrupting systems and/or data. The defense against these attacks often falls back to the basics. By having certain Unlike malware that holds data for ransom protections in place — a tested cyber security (ransomware), when a malicious actor decides incident response plan, a risk-based patch to use a wiper in their activities, there is no management program, a tested and cyber direct financial motivation. For businesses, this security-aware business continuity plan, often is the worst kind of attack, since there is and network and user segmentation on top no expectation of data recovery.
    [Show full text]
  • FSRM : Protéger Son Serveur De Fichiers Des Ransomwares Jeudi 20 Avril 2017 16:33
    FSRM : Protéger son serveur de fichiers des ransomwares jeudi 20 avril 2017 16:33 • I. Présentation • II. Installation du gestionnaire de ressources du serveur de fichiers • III. Configurer le SMTP pour recevoir les notifications • IV. Création d’un groupe d’extensions de fichiers • V. Créer un modèle de filtre de fichiers • VI. Créer un filtre de fichiers • VII. Test de la configuration • VIII. Pour aller plus loin I. Présentation Les données qu’elles soient personnelles ou professionnelles ont une valeur certaine, et ça il y a des personnes malintentionnées qu’ils l’ont bien compris et qui veulent en tirer profit avec des malwares, ou plus particulièrement avec les ransomwares qui sont la grande tendance depuis quelque temps. Pour rappel, un ransomware, en français rançongiciel, est un logiciel qui va chiffrer vos données et vous demander de l’argent pour pouvoir récupérer les données, sous peine de les perdre. Pour se protéger face à cette menace, que l’on peut représenter par Cryptolocker ou plus récemment Locky, il y a différentes couches de sécurité à mettre en place. Tout d’abord, ça passe par une protection au niveau des e-mails avec un filtre anti-spam, du filtrage web pour éviter que les utilisateurs aillent sur des sites où ils n’ont rien à faire, ou encore protéger votre serveur de fichiers, c’est d’ailleurs ce dernier point qui nous intéresse. Dans le cadre de ce tutoriel, il sera question de protéger un serveur de fichiers sous Windows Server 2012 R2 ou sur Windows Server 2008 R2, pour cela on s’appuie sur le File Server Resource Manager (FSRM) , en français « Gestionnaire de ressources du serveur de fichiers ».
    [Show full text]
  • The Middle East Under Malware Attack Dissecting Cyber Weapons
    The Middle East under Malware Attack Dissecting Cyber Weapons Sami Zhioua Information and Computer Science Department King Fahd University of Petroleum and Minerals Dhahran, Saudi Arabia [email protected] Abstract—The Middle East is currently the target of an un- have been designed by the same unknown entity 1. The next precedented campaign of cyber attacks carried out by unknown malware of this lineage was Flame [7] which was discovered parties. The energy industry is praticularly targeted. The in May 2012 by Kaspersky Lab while investigating another attacks are carried out by deploying extremely sophisticated malware. The campaign opened by the Stuxnet malware in piece of malware called Wiper [8]. Flame features very 2010 and then continued through Duqu, Flame, Gauss, and unusual characteristics such as large size, large number of Shamoon malware. This paper is a technical survey of the modules, self adapting, etc. As Duqu, Flame’s objective is attacking vectors utilized by the three most famous malware, data collection and espionnage. Gauss [9] is another data namely, Stuxnet, Flame, and Shamoon. We describe their main stealing malware discovered in June 2012 by Kaspersky Lab modules, their sophisticated spreading capabilities, and we discuss what it sets them apart from typical malware. The focusing on banking information. Flame and Gauss exhibit main purpose of the paper is to point out the recent trends striking similarities and several technical evidences indicate infused by this new breed of malware into cyber attacks. that they come from the same “factories” that produced Stuxnet and Duqu [9]. The latest malware-based attack Keywords-Malwares; Information Security; Targeted At- tacks; Stuxnet; Duqu; Flame; Gauss; Shamoon targeting the middle east was the Shamoon attack on Saudi Aramco [10].
    [Show full text]
  • Analysis of the Teslacrypt Family and How to Protect Against Future
    Sophia Wang COMP 116 Final Project Analysis of the TeslaCrypt Family and How to Protect Against Future Ransomware/Cyber Attacks Abstract Ransomware accounts for a large majority of the malicious attacks in the cyber security world, with a company hit with a ransomware attack once every 40 seconds. There was a 300% increase in ransomware attacks from 2015 to 2016 — and it’s only going up from there. One family of Trojan-style ransomware technology that introduced itself in early 2015 is TeslaCrypt. TeslaCrypt affected Windows users from the US, Germany, Spain, Italy, France, and the United Kingdom, targeting mostly gamers. This form of ransomware would encrypt the victim’s files using a highly complicated encryption key and demand $250 to $1,000 for ransom. The creators of TeslaCrypt eventually released the master decryption key in May of 2016, so in the end the victims were able to recover their files and systems. This paper will explore the process by which the TeslaCrypt ransomware infected a system, the steps that were taken to ameliorate this issue, and what steps should be taken to avoid an incident like this in the future. Introduction Ransomware is a special form of malware that can infect a system through either encrypting and denying users access to their files, or restricting access and locking users out of their systems. Once the ransomware has the target’s files and/or system on lock, it demands a ransom be paid, usually through some form of cryptocurrency. In February of 2015, a new family of file-encrypting Trojan-style ransomware technology was introduced — TeslaCrypt.
    [Show full text]
  • A Systematic Empirical Analysis of Unwanted Software Abuse, Prevalence, Distribution, and Economics
    UNIVERSIDAD POLITECNICA´ DE MADRID ESCUELA TECNICA´ SUPERIOR DE INGENIEROS INFORMATICOS´ A Systematic Empirical Analysis of Unwanted Software Abuse, Prevalence, Distribution, and Economics PH.D THESIS Platon Pantelis Kotzias Copyright c 2019 by Platon Pantelis Kotzias iv DEPARTAMENTAMENTO DE LENGUAJES Y SISTEMAS INFORMATICOS´ E INGENIERIA DE SOFTWARE ESCUELA TECNICA´ SUPERIOR DE INGENIEROS INFORMATICOS´ A Systematic Empirical Analysis of Unwanted Software Abuse, Prevalence, Distribution, and Economics SUBMITTED IN PARTIAL FULFILLMENT OF THE REQUIREMENTS FOR THE DEGREE OF: Doctor of Philosophy in Software, Systems and Computing Author: Platon Pantelis Kotzias Advisor: Dr. Juan Caballero April 2019 Chair/Presidente: Marc Dasier, Professor and Department Head, EURECOM, France Secretary/Secretario: Dario Fiore, Assistant Research Professor, IMDEA Software Institute, Spain Member/Vocal: Narseo Vallina-Rodriguez, Assistant Research Professor, IMDEA Networks Institute, Spain Member/Vocal: Juan Tapiador, Associate Professor, Universidad Carlos III, Spain Member/Vocal: Igor Santos, Associate Research Professor, Universidad de Deusto, Spain Abstract of the Dissertation Potentially unwanted programs (PUP) are a category of undesirable software that, while not outright malicious, can pose significant risks to users’ security and privacy. There exist indications that PUP prominence has quickly increased over the last years, but the prevalence of PUP on both consumer and enterprise hosts remains unknown. Moreover, many important aspects of PUP such as distribution vectors, code signing abuse, and economics also remain unknown. In this thesis, we empirically and sys- tematically analyze in both breadth and depth PUP abuse, prevalence, distribution, and economics. We make the following four contributions. First, we perform a systematic study on the abuse of Windows Authenticode code signing by PUP and malware.
    [Show full text]
  • Ransomware Behavior Attack Construction Via Graph Theory Approach
    (IJACSA) International Journal of Advanced Computer Science and Applications, Vol. 11, No. 2, 2020 Ransomware Behavior Attack Construction via Graph Theory Approach Muhammad Safwan Rosli1, Raihana Syahirah Abdullah2* Warusia Yassin3, Faizal M.A4, Wan Nur Fatihah Wan Mohd Zaki5 Centre of Advanced Computing Technology, Fakulti Teknologi Maklumat dan Komunikasi, Universiti Teknikal Malaysia Melaka, Hang Tuah Jaya, 76100 Durian Tunggal, Melaka, Malaysia1, 2, 3, 4, 5 Abstract—Ransomware has becoming a current trend of amount of resources such as RAM, machine storage which are cyberattack where its reputation among malware that cause a time consuming [3]. So, to mitigate the concern issues, massive amount recovery in terms of cost and time for researchers need to come with different approaches and ransomware victims. Previous studies and solutions have showed solutions to defend against current and future threats and also that when it comes to malware detection, malware behavior need to understand the behavior of the malware attacks and their to be prioritized and analyzed in order to recognize malware interactions with victim‟s machine [4]. attack pattern. Although the current state-of-art solutions and frameworks used dynamic analysis approach such as machine The main problem remain persists yet and it still needs to learning that provide more impact rather than static approach, keep on update where the researchers need to understand the but there is not any approachable way in representing the malware behavior whether it is in network traffic or file analysis especially a detection that relies on malware behavior. activity system in the form of statistical and dynamic. This Therefore, this paper proposed a graph theory approach which is research also stressed out the problem in visualizing malware analysis of the ransomware behavior that can be visualized into behavior since the data can be represented in an easy way to be graph-based pattern.
    [Show full text]
  • A PRACTICAL METHOD of IDENTIFYING CYBERATTACKS February 2018 INDEX
    In Collaboration With A PRACTICAL METHOD OF IDENTIFYING CYBERATTACKS February 2018 INDEX TOPICS EXECUTIVE SUMMARY 4 OVERVIEW 5 THE RESPONSES TO A GROWING THREAT 7 DIFFERENT TYPES OF PERPETRATORS 10 THE SCOURGE OF CYBERCRIME 11 THE EVOLUTION OF CYBERWARFARE 12 CYBERACTIVISM: ACTIVE AS EVER 13 THE ATTRIBUTION PROBLEM 14 TRACKING THE ORIGINS OF CYBERATTACKS 17 CONCLUSION 20 APPENDIX: TIMELINE OF CYBERSECURITY 21 INCIDENTS 2 A Practical Method of Identifying Cyberattacks EXECUTIVE OVERVIEW SUMMARY The frequency and scope of cyberattacks Cyberattacks carried out by a range of entities are continue to grow, and yet despite the seriousness a growing threat to the security of governments of the problem, it remains extremely difficult to and their citizens. There are three main sources differentiate between the various sources of an of attacks; activists, criminals and governments, attack. This paper aims to shed light on the main and - based on the evidence - it is sometimes types of cyberattacks and provides examples hard to differentiate them. Indeed, they may of each. In particular, a high level framework sometimes work together when their interests for investigation is presented, aimed at helping are aligned. The increasing frequency and severity analysts in gaining a better understanding of the of the attacks makes it more important than ever origins of threats, the motive of the attacker, the to understand the source. Knowing who planned technical origin of the attack, the information an attack might make it easier to capture the contained in the coding of the malware and culprits or frame an appropriate response. the attacker’s modus operandi.
    [Show full text]
  • Best Practices to Protect Against Ransomware, Phishing & Email Fraud
    WHITE PAPER Best Practices for Protecting Against Phishing, Ransomware and Email Fraud An Osterman Research White Paper Published April 2018 SPON Osterman Research, Inc. P.O. Box 1058 • Black Diamond • Washington • 98010-1058 • USA +1 206 683 5683 • [email protected] www.ostermanresearch.com • @mosterman Executive Summary • Various types of security threats are increasing in number and severity at a rapid pace, most notably cryptojacking malware that is focused on mining coins for the roughly 1,400 cryptocurrencies currently in use. • Organizations have been victimized by a wide range of threats and exploits, most notably phishing attacks that have penetrated corporate defenses, targeted email attacks launched from compromised accounts, and sensitive or confidential information accidentally leaked through email. • Threats are becoming more sophisticated as well-financed cybercriminal gangs develop improved variants of malware and social engineering attacks. The result is that the perceived effectiveness of current security solutions is not improving – or is actually getting worse – for many organizations. • Decision makers are most concerned about endpoints getting infected with malware through email or web browsing, user credentials being stolen through email-based phishing, and senior executives’ credentials being stolen through email-based spearphishing. • Four of the five leading concerns expressed by decision makers focus on email as the primary threat vector for cybercriminal activity, and nearly one-half of attacks are focused on account takeovers. Many organizations • Most decision makers have little confidence that their security infrastructure can adequately address infections on mobile devices, are not CEO Fraud/BEC, and preventing users personal devices from introducing malware into the corporate network.
    [Show full text]
  • Fractional Dynamics of Stuxnet Virus Propagation in Industrial Control Systems
    mathematics Article Fractional Dynamics of Stuxnet Virus Propagation in Industrial Control Systems Zaheer Masood 1, Muhammad Asif Zahoor Raja 2,* , Naveed Ishtiaq Chaudhary 2, Khalid Mehmood Cheema 3 and Ahmad H. Milyani 4 1 Department of Electrical and Electronics Engineering, Capital University of Science and Technology, Islamabad 44000, Pakistan; [email protected] 2 Future Technology Research Center, National Yunlin University of Science and Technology, 123 University Road, Section 3, Douliou 64002, Taiwan; [email protected] 3 School of Electrical Engineering, Southeast University, Nanjing 210096, China; [email protected] 4 Department of Electrical and Computer Engineering, King Abdulaziz University, Jeddah 21589, Saudi Arabia; [email protected] * Correspondence: [email protected] Abstract: The designed fractional order Stuxnet, the virus model, is analyzed to investigate the spread of the virus in the regime of isolated industrial networks environment by bridging the air-gap between the traditional and the critical control network infrastructures. Removable storage devices are commonly used to exploit the vulnerability of individual nodes, as well as the associated networks, by transferring data and viruses in the isolated industrial control system. A mathematical model of an arbitrary order system is constructed and analyzed numerically to depict the control mechanism. A local and global stability analysis of the system is performed on the equilibrium points derived Citation: Masood, Z.; Raja, M.A.Z.; for the value of a = 1. To understand the depth of fractional model behavior, numerical simulations Chaudhary, N.I.; Cheema, K.M.; are carried out for the distinct order of the fractional derivative system, and the results show that Milyani, A.H.
    [Show full text]
  • Malware Trends
    NCCIC National Cybersecurity and Communications Integration Center Malware Trends Industrial Control Systems Emergency Response Team (ICS-CERT) Advanced Analytical Laboratory (AAL) October 2016 This product is provided subject only to the Notification Section as indicated here:http://www.us-cert.gov/privacy/ SUMMARY This white paper will explore the changes in malware throughout the past several years, with a focus on what the security industry is most likely to see today, how asset owners can harden existing networks against these attacks, and the expected direction of developments and targets in the com- ing years. ii CONTENTS SUMMARY .................................................................................................................................................ii ACRONYMS .............................................................................................................................................. iv 1.INTRODUCTION .................................................................................................................................... 1 1.1 State of the Battlefield ..................................................................................................................... 1 2.ATTACKER TACTIC CHANGES ........................................................................................................... 2 2.1 Malware as a Service ...................................................................................................................... 2 2.2 Destructive Malware ......................................................................................................................
    [Show full text]
  • FROM SHAMOON to STONEDRILL Wipers Attacking Saudi Organizations and Beyond
    FROM SHAMOON TO STONEDRILL Wipers attacking Saudi organizations and beyond Version 1.05 2017-03-07 Beginning in November 2016, Kaspersky Lab observed a new wave of wiper attacks directed at multiple targets in the Middle East. The malware used in the new attacks was a variant of the infamous Shamoon worm that targeted Saudi Aramco and Rasgas back in 2012. Dormant for four years, one of the most mysterious wipers in history has returned. So far, we have observed three waves of attacks of the Shamoon 2.0 malware, activated on 17 November 2016, 29 November 2016 and 23 January 2017. Also known as Disttrack, Shamoon is a highly destructive malware family that effectively wipes the victim machine. A group known as the Cutting Sword of Justice took credit for the Saudi Aramco attack by posting a Pastebin message on the day of the attack (back in 2012), and justified the attack as a measure against the Saudi monarchy. The Shamoon 2.0 attacks observed since November 2016 have targeted organizations in various critical and economic sectors in Saudi Arabia. Just like the previous variant, the Shamoon 2.0 wiper aims for the mass destruction of systems inside targeted organizations. The new attacks share many similarities with the 2012 wave, though featuring new tools and techniques. During the first stage, the attackers obtain administrator credentials for the victim’s network. Next, they build a custom wiper (Shamoon 2.0) which leverages these credentials to spread widely inside the organization. Finally, on a predefined date, the wiper activates, rendering the victim’s machines completely inoperable.
    [Show full text]