Energy Sector Hacking Campaign Continues

Energy Sector Hacking Campaign Continues

The U.S. government has issued a rare technical alert, warning that attackers are continuing to compromise organizations across the energy sector, often by first hacking into less secure business partners and third-party suppliers.
See Also: How to Scale Your Vendor Risk Management Program
The 16-page joint technical alert was issued late Friday by the U.S. Department of Homeland Security and the FBI, which want targeted organizations to better secure their systems and block attacks to help arrest this hacking campaign.
The alert warns that since at least May, "a multistage intrusion campaign by threat actors" continues to target "low security and small networks to gain access and move laterally to networks of major, high-value asset owners within the energy sector."
Initial targets have included firms across the nuclear, water, aviation and critical manufacturing sectors, it says.
Despite this attack campaign having been previously spotted and attack methodologies detailed by security researchers, the U.S. government warns that the attacks have continued unabated.
"Based on malware analysis and observed IOCs, DHS has confidence that this campaign is still ongoing, and threat actors are actively pursuing their ultimate objectives over a long-term campaign," the DHS-FBI alert warns. The alert includes indicators of compromise, or IOCs, as well as technical details on the tactics, techniques and procedures, or TTPs, used by the APT attackers tied to this campaign.

Attackers are Pivoting

"Advanced Persistent Threat Activity Targeting Energy and Other Critical Infrastructure Sectors" joint alert (TA17-293A) from DHS and the FBI.
These TTPs continue to include open-source reconnaissance, spear-phishing emails from legitimate but compromised accounts, watering-hole attacks, credential harvesting as well as targeting industrial control systems, the alert warns.
The DHS-FBI alert warns that larger energy sector organizations are suffering intrusions because of poor information security practices on the part of their business partners and third-party suppliers.
"The initial victims are peripheral organizations such as trusted third-party suppliers with less secure networks," the alert says, adding that these victims function as the first stage in many attacks. "The threat actor uses the staging targets' networks as pivot points and malware repositories when targeting their final, intended victims. The ultimate objective of the cyber threat actors is to compromise organizational networks."
Critical infrastructure security expert Robert M. Lee says that while the DHS-FBI alert warns of an ongoing and successful "multistage intrusion campaign," it's referring to intrusions as well as attacks.

Comments

Post a Comment

Popular posts from this blog

Fake WAP

Image
Fake WAP There are a horde of things out there that goes under the general name 'hacking.' But what precisely are these demonstrations and what is the completely most effortless one for programmers to finish? This is a stealth assault, similar to a lethal ninja, known as a phony remote access point (Fake WAP). You may likewise know it as a 'man in the center' assault. Programmers can do this effectively enough, taking your information covertly with the goal that you're unaware. More regrettable yet, you'll HELP them do it! A VPN is your vital component to ensuring this doesn't transpire, regardless of the possibility that you do fall into their trap. As a reward, I get the chance to add pictures of ninjas to this post and it absolutely bodes well. What is a fake wireless access point This is the point at which a programmer utilizes a basic bit of programming and a remote system get to card. They will utilize these and go out into the general
Read more

The Secure Socket Tunneling Protocol

Image
The Secure Socket Tunneling Protocol This segment depends on a prerelease adaptation of Windows Server 2008. All data in this is liable to change. Virtual private system (VPN) bolster in Windows XP and Windows Server 2003 enables you to interface with your private intranet over the Internet, similarly as though your PC was connected to a neighborhood Ethernet port. Nonetheless, the VPN conventions in Windows XP and Windows Server 2003 don't work for some firewall arrangements what's more, for some circuitous arrangements, for example, when your PC is behind a Network Address Translator (NAT) or Web intermediary server—in which the movement for VPN associations is being blocked. To determine these challenges, Windows Server® 2008 and Windows Vista Service Pack 1 incorporate help for the new Secure Socket Tunneling Protocol (SSTP). VPN Access Problems In Windows® XP and Windows Server 2003, the VPN conventions that empower remote access associations with an intranet
Read more

Shift cipher

Image
Shift cipher Modular Math and the Shift Cipher The Caesar Cipher is a type of  shift cipher . Shift Ciphers work by using the modulo operator to encrypt and decrypt messages. The Shift Cipher has a  key K , which is an  integer from 0 to 25 . We will only share this key with people that we want to see our message. How to Encrypt: For every letter in the message  M  : 1.  Convert the letter into the number that matches its order in the alphabet starting from 0, and call this number  X . ( A=0, B=1, C=2, ...,Y=24, Z=25) 2.  Calculate:  Y  =  (X + K)  mod  26 3.  Convert the number  Y  into a letter that matches its order in the alphabet starting from 0. (A=0, B=1, C=2, ...,Y=24, Z=25) For Example:  We agree with our friend to use the Shift Cipher with  key K=19 for our message.  We encrypt the message  "KHAN",  as follows:​ So, after applying the Shift Cipher with key K=19 our message t
Read more