Energy War

Indicators of Compromise

APT Groups

Notes

<p style="box-sizing: border-box; margin-bottom: 10px; line-height: 1.5; font-size: 16px; color: rgb(51, 51, 51); font-family: &quot;">ICS-CERT has determined that users of HMI products from various vendors have been targeted in this campaign, including GE Cimplicity, Advantech/Broadwin WebAccess, and Siemens WinCC. It is currently unknown whether other vendor’s products have also been targeted. ICS‑CERT is working with the involved vendors to evaluate this activity and also notify their users of the linkages to this campaign.</p><p style="box-sizing: border-box; margin-bottom: 10px; line-height: 1.5; font-size: 16px; color: rgb(51, 51, 51); font-family: &quot;">At this time, ICS-CERT has not identified any attempts to damage, modify, or otherwise disrupt the victim systems’ control processes. ICS-CERT has not been able to verify if the intruders expanded access beyond the compromised HMI into the remainder of the underlying control system. However, typical malware deployments have included modules that search out any network-connected file shares and removable media for additional lateral movement within the affected environment. The malware is highly modular and not all functionality is deployed to all victims.</p><p style="box-sizing: border-box; margin-bottom: 10px; line-height: 1.5; font-size: 16px; color: rgb(51, 51, 51); font-family: &quot;">In addition, public reports<a class="see-footnote" id="footnoterefb_c9yf0tm" href="https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-14-281-01B#footnoteb_c9yf0tm" style="box-sizing: border-box; background-color: transparent; color: rgb(43, 114, 175);">b</a>&nbsp;<a class="see-footnote" id="footnoterefc_0p0enr6" href="https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-14-281-01B#footnotec_0p0enr6" style="box-sizing: border-box; background-color: transparent; color: rgb(43, 114, 175);">c</a>&nbsp;reference a BlackEnergy-based campaign against a variety of overseas targets leveraging vulnerability CVE-2014-4114<a class="see-footnote" id="footnoterefd_cgmoe24" href="https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-14-281-01B#footnoted_cgmoe24" style="box-sizing: border-box; background-color: transparent; color: rgb(43, 114, 175);">d</a>&nbsp;(affecting Microsoft Windows and Windows Server 2008 and 2012). ICS-CERT has not observed the use of this vulnerability to target control system environments. However, analysis of the technical findings in the two report shows linkages in the shared command and control infrastructure between the campaigns, suggesting both are part of a broader campaign by the same threat actor.</p><p style="box-sizing: border-box; margin-bottom: 10px; line-height: 1.5; font-size: 16px; color: rgb(51, 51, 51); font-family: &quot;">ICS-CERT strongly encourages asset owners and operators to look for signs of compromise within their control systems environments. Any positive or suspected findings should be immediately reported to ICS-CERT for further analysis and correlation.</p><div><br></div><div style="box-sizing: border-box; color: rgb(51, 51, 51); font-family: &quot;"></div>

Mitigation

<div>ICS-CERT has published a TLP Amber version of this alert containing additional information about the malware, plug-ins, and indicators to the secure portal. ICS-CERT strongly encourages asset owners and operators to use these indicators to look for signs of compromise within their control systems environments. Asset owners and operators can request access to this information by emailing [email protected].</div><div><br></div><div>Any positive or suspected findings should be immediately reported to ICS-CERT for further analysis and correlation.</div><div><br></div><div>ICS-CERT strongly encourages taking immediate defensive action to secure ICS systems using defense-in-depth principles.CSSP Recommended Practices, https://ics-cert.us-cert.gov/Recommended-Practices, web site last accessed October 28, 2014. Asset owners should not assume that their control systems are deployed securely or that they are not operating with an Internet accessible configuration. Instead, asset owners should thoroughly audit their networks for Internet facing devices, weak authentication methods, and component vulnerabilities. Control systems often have Internet accessible devices installed without the owner’s knowledge, putting those systems at increased risk of attack.</div><div><br></div><div>ICS-CERT recommends that users take defensive measures to minimize the risk of exploitation due to this unsecure device configuration of these vulnerabilities. Specifically, users should:</div><div><br></div><div>Minimize network exposure for all control system devices. Control system devices should not directly face the Internet.</div><div>Locate control system networks and devices behind firewalls, and isolate them from the business network.</div><div>If remote access is required, employ secure methods, such as Virtual Private Networks (VPNs), recognizing that VPN is only as secure as the connected devices.</div><div>Remove, disable, or rename any default system accounts wherever possible.</div><div>Apply patches in the ICS environment, when possible to mitigate known vulnerabilities.</div><div>Implement policies requiring the use of strong passwords.</div><div>Monitor the creation of administrator level accounts by third-party vendors.</div><div>ICS-CERT reminds organizations to perform proper impact analysis and risk assessment prior to taking defensive measures.</div><div><br></div>