July 17, 2024
Researchers discover new ICS malware toolkit designed to trigger electrical energy outages

Over the previous few years state-sponsored attackers have been ramping up their capabilities of hitting essential infrastructure like energy grids to trigger severe disruptions. A brand new addition to this arsenal is a malware toolkit that appears to have been developed for red-teaming workouts by a Russian cybersecurity firm.

Dubbed COSMICENERGY by researchers from Mandiant, the malware can work together with distant terminal models (RTUs) and different operational know-how (OT) units that talk over the specialised IEC 60870-5-104 (IEC-104) protocol and are generally used for electrical engineering and energy automation.

“COSMICENERGY is the most recent instance of specialised OT malware able to inflicting cyber bodily impacts, that are hardly ever found or disclosed,” the Mandian researchers stated in their report. “Evaluation into the malware and its performance reveals that its capabilities are similar to these employed in earlier incidents and malware, equivalent to INDUSTROYER and INDUSTROYER.V2, which had been each malware variants deployed up to now to impression electrical energy transmission and distribution by way of IEC-104.”

Crimson workforce framework impressed by previous assaults

INDUSTROYER, also called Crashoverride, is a malware program that was utilized in 2016 in opposition to the Ukrainian energy grid and left a fifth of Kyiv, the nation’s capital, with out energy for one hour. The malware reached RTUs on the OT community by way of MS-SQL servers that acted as knowledge historians, then issued ON/OFF instructions by way of the IEC-104 to impression energy line switches and circuit breakers.

INDUSTROYER’s creation and use is attributed to Sandworm, an APT group that is believed to be a cyberwar unit throughout the GRU, Russia’s navy intelligence service. In 2022, Sandworm tried one other assault in opposition to Ukraine’s energy grid utilizing an up to date model of the malware dubbed INDUSTROYER.V2.

The brand new COSMICENERGY toolkit discovered by Mandiant was uploaded to a public malware scanning service in December 2021 by somebody in Russia. An evaluation of the code means that it was created for crimson workforce workouts hosted by a Russian cybersecurity firm referred to as Rostelecom-Photo voltaic that has ties to the Russian authorities.

“Though now we have not recognized ample proof to find out the origin or objective of COSMICENERGY, we imagine that the malware was probably developed by both Rostelecom-Photo voltaic or an related celebration to recreate actual assault situations in opposition to power grid property,” the researchers stated. “It’s potential that the malware was used to help workouts equivalent to those hosted by Rostelecom-Photo voltaic in 2021 in collaboration with the Russian Ministry of Power or in 2022 for the St. Petersburg’s Worldwide Financial Discussion board (SPIEF).”

Rostelecom-Photo voltaic has acquired funding from the Russian authorities to coach cybersecurity specialists and conduct electrical energy disruption and emergency response workouts. A module within the malware toolkit accommodates a reference to Photo voltaic Polygon and searchers for this time period tie it to Rostelecom-Photo voltaic.

In keeping with Mandiant, regardless of its obvious ties to crimson workforce workouts, the chance exists that this malware toolkit has or may be repurposed for real-world assaults, together with by Russian nation-state actors which have used personal contractors earlier than to develop instruments.

Manually deployed two-component malware payload

COSMICENERGY is made up of two elements — one written in Python and one in C++. The Python-based element, which Mandiant has dubbed PIEHOP, is designed to connect with MS-SQL servers and add information or situation instructions. As soon as linked, it deploys the second element dubbed LIGHTWORK which is designed to situation ON and OFF instructions to linked RTUs by way of IEC-104 over TCP.

“It crafts configurable IEC-104 Utility Service Knowledge Unit (ASDU) messages, to vary the state of RTU Data Object Addresses (IOAs) to ON or OFF,” the researchers stated. “LIGHTWORK makes use of positional command line arguments for goal gadget, port, and IEC-104 command.”

The IOAs correlate with inputs and outputs on RTUs, which relying on configuration and deployment may map to linked circuit breakers or energy line switches. Nonetheless, the IOAs mappings can differ between totally different RTU producers, particular person units and even environments, in keeping with Mandiant, which suggests the attackers have to have pre-existing reconnaissance details about the deployment they’re focusing on. The analyzed LIGHTWORK pattern had eight hard-coded IOAs, however it’s exhausting to find out what was the attackers’ intention when issuing instructions to them with out data of the precise focused property.

Moreover, the PIEHOP element and the malware itself haven’t any community discovery capabilities in-built, which signifies that attackers have to have already got details about the focused MSSQL servers and RTUs, equivalent to credentials and IP addresses, to deploy the elements efficiently. This makes it a post-intrusion toolkit.

Whereas COSMICENERGY does not share any code with earlier OT malware instruments, it does borrow methods from a number of of them, apart from INDUSTROYER: The usage of Python for OT malware improvement has additionally been noticed with IRONGATE and TRITON; the usage of open-source libraries that implement proprietary OT protocols and decrease the bar for creating such threats; and the abuse of protocols which are insecure by design equivalent to IEC-104 and lack authentication or encryption mechanisms.

Methods to mitigate and detect COSMICENERGY

Whereas there is not any proof that COSMICENERGY has been utilized in assaults within the wild, the chance can’t be discounted and on the very least it could possibly function inspiration for different OT malware builders, similar to INDUSTROYER served as inspiration for its creators.

The Mandiant report accommodates indicators of compromise and file hashes, however the firm additionally recommends that organizations conduct lively risk searching:

  • Set up assortment and aggregation of host-based logs for crown jewels techniques equivalent to human-machine interfaces (HMI), engineering workstations (EWS), and OPC consumer servers inside their environments and evaluate logs for the proof of Python script or unauthorized code execution on these techniques.
  • Determine and examine the creation, switch, and/or execution of unauthorized Python-packaged executables (e.g., PyInstaller or Py2Exe) on OT techniques or techniques with entry to OT sources.
  • Monitor techniques with entry to OT sources for the creation of authentic non permanent folders, information, artifacts, and exterior libraries required as proof of the execution of packaged Python scripts, eg. the creation of a short lived “_MEIPASS” PyInstaller folder.
  • Monitor MSSQL Servers with entry to OT techniques and networks for proof of: reconnaissance and enumeration exercise of MSSQL servers and credentials, unauthorized community connections to MSSQL servers (TCP/1433) and irregular or unauthorized authentication, enablement and utilization of SQL prolonged saved procedures for Home windows shell command execution and the switch, creation, staging, and decoding of base64 encoded executables.

Copyright © 2023 IDG Communications, Inc.