DHS &#8211; Russian APT groups are inside US critical infrastructure

DHS – Russian APT groups are inside US critical infrastructure

The US Government is warning of continuous intrusions in National critical infrastructure and it is blaming the Kremlin for the cyber attacks. According to the US Department of Homeland Security, Russia’s APT groups have already penetrated America’s critical infrastructure, especially power utilities, and are still targeting them. These attacks could have dramatic consequence, an attack against […]

July 24, 2018

The US Government is warning of continuous intrusions in National critical infrastructure and it is blaming the Kremlin for the cyber attacks.

According to the US Department of Homeland Security, Russia’s APT groups have already penetrated America’s critical infrastructure, especially power utilities, and are still targeting them.

These attacks could have dramatic consequence, an attack against a power grid could cause a massive power outage.

It isn’t a sci-fi, it has already happened in Ukraine and security experts blamed Russian APT groups tracked as Dragonfly and Energetic Bear.

According to the government experts, hackers were able to penetrate also air-gapped networks.

The Wall Street Journal quoted Homeland Security officials reporting various attacks.

“Hackers working for Russia claimed “hundreds of victims” last year in a long-running campaign that put them inside the control rooms of U.S. electric utilities where they could have caused blackouts, federal officials said.” states the WSJ.

The officials sustain that the Energetic Bear APT has already penetrated “hundreds” of systems in national power grids.

The DHS issued several alerts related to the APT attacks and shared technical details about their TTPs, including Indicators of Compromise (IOCs) to detect their presence in the IT infrastructure.

Cyber intrusions of critical infrastructure are part of long-term information warfare strategy.

Russians APT Groups carried out spear-phishing attacks against utilities’ equipment vendors and sub subtractors to gather intelligence and collect information to penetrate the infrastructure.

Hackers aim at the exploitation of the accesses into the utilities used by equipment makers and suppliers for ordinary maintenance and telemetry. Their accesses could allow them to deploy malware into the facilities.

Unfortunately, the attacks are still ongoing, many critical infrastructure are operated by private companies with pour cyber hygiene.

Unfortunately, in many cases, the operators totally ignore the presence of the attackers into their networks.

“They got to the point where they could have thrown switches,” Jonathan Homer, chief of industrial control system analysis for Homeland Security, told the paper.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(Securi ty Affairs – US critical infrastructure, hacking)

[adrotate banner=”5″]

[adrotate banner=”13″]