Sonal Patel reports that DHS and FBI warned in an e-mail on October 20 that an ongoing cyberattack campaign is targeting the nuclear, energy, and other critical infrastructure sectors since at least May 2017, with results ranging from cyber espionage to the ability to disrupt energy systems in the event of a hostile conflict. The federal agencies on October 20 also released a joint technical alert, which provides information on what they deem are “advanced persistent threat” actions.
The report outlines “indicators of compromise” as well as technical details on the tactics, techniques, and procedures used by the threat actors on compromised networks. The alarm sounded by the DHS and FBI is serious and should be heeded, said Dana Tamir, vice president of Market Strategy for Indegy, a cybersecurity solutions and technology firm. “This is the first time we are seeing such a widespread campaign that is specifically targeting industrial control systems (ICS) which are responsible for managing and controlling the physical processes in nuclear, water, aviation, and critical manufacturing sectors.” The Dragonfly security threat is aimed at power companies have been on the rise and are growing more diverse, experts generally note. Following the unprecedented disruption of electric grid operations in Ukraine on December 23, 2015—an attack attributed to the use of BlackEnergy 3 malware—a second attack employing CrashOverride malware in December 2016 left portions of Kiev without power.
On October 10, cybersecurity firm FireEye reported its devices detected and blocked spear-phishing emails sent on September 22 to U.S. electric companies by threat actors “likely affiliated with the North Korean government.” But the firm reported that the activity was “early-stage reconnaissance, and not necessarily indicative of an imminent, disruptive cyber attack that might take months to prepare if it went undetected (judging from past experiences with other cyber threat groups).” It added that it had not observed suspected North Korean actors using any tool or method specifically designed to compromise or manipulate the ICS networks, concluding that the actors may not “have access to any such capability at this time.”
The joint analysis report by the DHS and FBI released on Friday, however, describes “distinct indicators and behaviors” of a potentially more disruptive cyber-attack campaign, and it points specifically to Dragonfly, a group that has reportedly stepped up cyberattacks aimed at severely crippling operations in the European and North American energy sectors.
Managed & Built by I2M Consulting, LLC | © 2010-
