Pipedream could target US infrastructure, Ukrainian Cybersecurity prevented a major
energy sector attack, and RaidForums is seized by law enforcement!
All that coming up now on ThreatWire.
Greetings!!
I’m Shannon Morse and this is ThreatWire for April 19 2022 - this is your summary of
the threats to our security, privacy and Internet freedom.
There are several industrial attacks happening across borders this week, so onto the first
news story.
A joint advisory from the Department of Energy (DOE), the Cybersecurity and Infrastructure
Agency (CISA), the NSA and the FBI was released last week and explains that advanced persistent
threat APT attackers have new tools that could allow them to get full system access of industrial
control systems (ICS) along with SCADA devices like the ones used for the energy sector.
The APTs have already demo nstrated that they can gain full access via their custom made
tools.
Specifically, this includes Schneider Electric PLCs, OMROM sysmac NEX PLCs, and Open Platform
Communications Unified Architecture servers.
If one of these servers got infected, that could lead to full compromise, including an
elevation of privileges, using the server for lateral movement through a network, critical
device or function disruption, etc.
That includes sabotaging critical functions for liquified natural gas (aka oil refinery)
sectors and the electric power grid sector.
The agencies also mention that Windows based engineering workstations could be compromised
too, by exploiting a known vulnerability within the ASRock motherboard driver.
This information comes to light from the ICS security firm Dragos, who nicknamed these
malicious tools as Pipedream.
Pipedream is not the first tool used to target ICS - it follows in the footsteps of Stuxnet,
Crashoverride, Triton and several more over the years.
Dragos believes this attack can be attributed to the APT actor Chevronite.
To note, earlier this year Mandiant also analyzed the malware for Schneider Electric and called
the tool InController.
Dragos mentions this has not been used in the wild yet in real world attacks, though
it’s entirely possible.
It’s important because, according to the VP of Threat Intelligence at Dragos, quote
“This is the most expansive industrial control system attack tool that anyone has ever documented”.
They call it the Swiss Army knife of attacks due to the amount of tools built into this
toolkit.
Because this APT group has already demonstrated their ability to use Pipedream, the agencies
recommend infrastructure orgs isolate ICS and SCADA systems, create and manage perimeter
controls, limit communications entering or leaving the network, and use multi factor
authentication for access as well as change passwords and remove any default passwords.
To build on this story, we have more critical infrastructure attacks happening across the
pond.
Lots of industrial attacks happened this week, although one potential attack failed during
its deployment.
Ukraine’s Computer Emergency Response Team thwarted the Russian APT group called Sandworm,
who tried to attack an undisclosed energy provider in the region.
According to a notification by CERT UA, Sandworm attackers attempted to target the electrical
substations using Industroyer2 malware, Windows operating systems using the CaddyWiper data
wiper, Linux operated server equipment using destructor scripts, and active networking
equipment.
CaddyWiper in particular has also been seen infecting Ukrainian bank networks in recent
weeks.
Researchers suspect the wipers would be used to destroy evidence of the malware after its
attack.
If Industroyer sounds familiar, that’s because it was used back in 2016 against Ukraine’s
power grid, so this was an updated version.
This malware is also called CrashOverride by some researchers and it has the ability
to control circuit breakers and switches at electricity stations.
The new version can also take over protection relays at substations, so it can be quite
dangerous.
That 2016 attack did cause power outages and blackouts but attacks that could do this haven’t
been seen since then, so it seems like the invasion of Ukraine is also reintroducing
old tricks with updated versions.
Sandworm attacked in two phases - one happened in February 2022, then the second was set
to occur on April 8, 2022, when they planned to shut down the substations and infrastructure.
This was prevented, though, when the energy provider detected the attack while it was
happening and stopped it before the attackers could again cause a blackout.
It’s not clear how the attackers gained that initial access nor how they moved from
an IT network over to the ICS network.
This group is believed to work for Russia’s GRU, the Main Intelligence Directorate.
In recent times this group has also targeted ASUS routers with the Cyclops Blink botnet.
We’ll likely see Sandworm continue their attacks, given they apparently never left
after the successful energy sector attack in 2016.
Big shoutout to my Hush Puppy perk level patrons for sharing their fur baby photos and for
the support.
THANK YOU to Ben for joining the alliance on Patreon.com/threatwire.
This week I’m trying something new - I have a fourth story to cover, which is only available
to the Patreon Alliance so check that out if you’re interested.
Let’s finish out today’s episode with my last top story, about hacker forums.
One of the largest hacker forums in the world, which was used to sell stolen personal information,
was seized by international law enforcement in a coordinated effort called Tourniquet.
The website is called RaidForums, and it was seized by law enforcement from the US, UK,
Sweden, Portugal, and Romania.
An arrest of the alleged forum admin was also made in England.
This admin, who went by the name Omnipotent, is said to be the found as well.
They’re a 21 year old Portuguese national who was arrested on January 31 and awaits
extradition to the US.
RaidForums had more than 500,000 users since launching in January of 2015, and databases
of stolen data included more than 10 billion unique records.
They contained credit card and bank account info, social security numbers, usernames and
passwords and more.
It’s likely law enforcement had access to the RaidForums data and servers since February
7, which is when the site started having database outages, until it eventually and mysteriously
went offline with the seizure happening on February 25.
Given that the Hydra marketplace was taken down last week by law enforcement, it appears
a lot of these investigations are now reaching a major turning point.
I still don’t think it’s the end of them though, because we always see new marketplaces
and forums pop up in their place.
Want to see more tech videos from me?
Check out my youtube channel - youtube.com/ShannonMorse for everything from tech reviews to security
tutorials, like my recent video about malware and tax season scams.
And with that, don't forget to like and subscribe to Hak5!
I'm Shannon Morse, I'll see you on the Internet!