ICS security firms targeted in phishing campaign

Defence contractors, universities primed.

Organisations focused on industrial control system (ICS) security have been hit with sophisticated phishing attacks designed to implant malware and steal data.

The attacks, against universities and defence contractors, came to light after staff at ICS security consultancy Digital Bond received a phishing email purporting to have been sent from the company’s boss, Dale Peterson.

Digital Bond provides security advice for large operators of the security systems.

Attackers pasted text from an email Peterson had previously sent and booby-trapped a PDF attachment of his 2009 paper on vulnerabilities in distributed control system field devices. 

The phishing email

Peterson said it was concerning that the attackers had targeted an ICS-specific organisation.

"The attacker clearly went to enough trouble to try to understand ICS security lingo to get the employee to open the link, and had to compromise a DNS server," he said.

The phishing email was recieved by a Digital Bond contractor who had forwarded it to Peterson. The malicious attachment was not opened by staff, Peterson said.

The payload embedded in the document was detected by only seven of 42 anti-virus systems, indicating attackers had held the malware for use in the attacks.

Shadowserver’s Ned Moran said hacked servers were used for command and control through which remote access tool (RAT) Dalbot.gen was served onto infected machines.

That tool resembled a RAT used in the ShadyRAT attacks against similar targets, further research by AlienVault’s James Blasco found.

ShadyRAT was a five-year espionage campaign reportedly launched from China-based attackers against defence contractors and government agencies, among other targets.

Blasco and IOActive’s Ruben Santamarta discovered the attacks were part of a campaign targeting multiple ICS firms over several months.

They detailed a series of malicious and benign files that were distributed under the campaign, revealing possible targets including Purdue, Rhode Island and Carnegie Mellon universities, defence contractor NJVC and government consultancy Chertoff Group.

The campaign displayed characteristics pointing to China-based attackers.

“According to the information collected, the targets of these campaigns are somehow related with the US Government or US defense contractors directly, providing different services such as authentication software/hardware, ICS security, or strategic consulting,” Santamarta said.

“Despite the fact that attribution is the most polemic task nowadays, we would like to note that code, tricks and certain infrastructure usually present in the Chinese hacking scene have been identified in this campaign.”