ICS security firms targeted in phishing campaign

Powered by SC Magazine

Defence contractors, universities primed.

Organisations focused on industrial control system (ICS) security have been hit with sophisticated phishing attacks designed to implant malware and steal data.

The attacks, against universities and defence contractors, came to light after staff at ICS security consultancy Digital Bond received a phishing email purporting to have been sent from the company’s boss, Dale Peterson.

Digital Bond provides security advice for large operators of the security systems.

Attackers pasted text from an email Peterson had previously sent and booby-trapped a PDF attachment of his 2009 paper on vulnerabilities in distributed control system field devices. 

The phishing email

Peterson said it was concerning that the attackers had targeted an ICS-specific organisation.

"The attacker clearly went to enough trouble to try to understand ICS security lingo to get the employee to open the link, and had to compromise a DNS server," he said.

The phishing email was recieved by a Digital Bond contractor who had forwarded it to Peterson. The malicious attachment was not opened by staff, Peterson said.

The payload embedded in the document was detected by only seven of 42 anti-virus systems, indicating attackers had held the malware for use in the attacks.

Shadowserver’s Ned Moran said hacked servers were used for command and control through which remote access tool (RAT) Dalbot.gen was served onto infected machines.

That tool resembled a RAT used in the ShadyRAT attacks against similar targets, further research by AlienVault’s James Blasco found.

ShadyRAT was a five-year espionage campaign reportedly launched from China-based attackers against defence contractors and government agencies, among other targets.

Blasco and IOActive’s Ruben Santamarta discovered the attacks were part of a campaign targeting multiple ICS firms over several months.

They detailed a series of malicious and benign files that were distributed under the campaign, revealing possible targets including Purdue, Rhode Island and Carnegie Mellon universities, defence contractor NJVC and government consultancy Chertoff Group.

The campaign displayed characteristics pointing to China-based attackers.

“According to the information collected, the targets of these campaigns are somehow related with the US Government or US defense contractors directly, providing different services such as authentication software/hardware, ICS security, or strategic consulting,” Santamarta said.

“Despite the fact that attribution is the most polemic task nowadays, we would like to note that code, tricks and certain infrastructure usually present in the Chinese hacking scene have been identified in this campaign.”

Copyright © SC Magazine, Australia

ICS security firms targeted in phishing campaign
Top Stories
Meet FABACUS, Westpac's first computer
GE225 operators celebrate gold anniversary.
NSW Govt gets ready to throw out the floppy disks
[Opinion] Dominic Perrottet says its time for government to catch up.
iiNet facing new copyright battle with Hollywood
Fighting to protect customer details.
Sign up to receive iTnews email bulletins
Latest Comments
In which area is your IT shop hiring the most staff?

   |   View results
IT security and risk
Sourcing and strategy
IT infrastructure (servers, storage, networking)
End user computing (desktops, mobiles, apps)
Software development

Would your InfoSec team be prepared to share threat data with the Australian Government?

   |   View results