Access member only content, take part in discussions with comments on blogs, news and reviews and receive all the latest security industry news directly to your inbox. Join now for free.
Processing registration... Please wait.
This process can take up to a minute to complete.
A confirmation email has been sent to your email address - SUPPLIED EMAIL HERE. Please click on the link in the email to verify your email address. You need to verify your email before you can start posting.
If you do not receive your confirmation email within the next few minutes, it may be because the email has been captured by a junk mail filter. Please ensure you add the domain @scmagazine.com.au to your white-listed senders.
Organisations focused on industrial control system (ICS) security have been hit with sophisticated phishing attacks designed to implant malware and steal data.
The attacks, against universities and defence contractors, came to light after staff at ICS security consultancy Digital Bond received a phishing email purporting to have been sent from the company’s boss, Dale Peterson.
Digital Bond provides security advice for large operators of the security systems.
Attackers pasted text from an email Peterson had previously sent and booby-trapped a PDF attachment of his 2009 paper on vulnerabilities in distributed control system field devices.
Peterson said it was concerning that the attackers had targeted an ICS-specific organisation.
"The attacker clearly went to enough trouble to try to understand ICS security lingo to get the employee to open the link, and had to compromise a DNS server," he said.
The phishing email was recieved by a Digital Bond contractor who had forwarded it to Peterson. The malicious attachment was not opened by staff, Peterson said.
The payload embedded in the document was detected by only seven of 42 anti-virus systems, indicating attackers had held the malware for use in the attacks.
Shadowserver’s Ned Moran said hacked servers were used for command and control through which remote access tool (RAT) Dalbot.gen was served onto infected machines.
That tool resembled a RAT used in the ShadyRAT attacks against similar targets, further research by AlienVault’s James Blasco found.
ShadyRAT was a five-year espionage campaign reportedly launched from China-based attackers against defence contractors and government agencies, among other targets.
Blasco and IOActive’s Ruben Santamarta discovered the attacks were part of a campaign targeting multiple ICS firms over several months.
They detailed a series of malicious and benign files that were distributed under the campaign, revealing possible targets including Purdue, Rhode Island and Carnegie Mellon universities, defence contractor NJVC and government consultancy Chertoff Group.
The campaign displayed characteristics pointing to China-based attackers.
“According to the information collected, the targets of these campaigns are somehow related with the US Government or US defense contractors directly, providing different services such as authentication software/hardware, ICS security, or strategic consulting,” Santamarta said.
“Despite the fact that attribution is the most polemic task nowadays, we would like to note that code, tricks and certain infrastructure usually present in the Chinese hacking scene have been identified in this campaign.”
Copyright © SC Magazine, Australia
To begin commenting right away, you can log in below or register an account if you don't yet have one. Please read our guidelines on commenting. Offending posts will be removed and your access may be suspended. Abusive or obscene language will not be tolerated. The comments below do not necessarily reflect the views or opinions of SC Magazine, Haymarket Media or its employees.