Menu
Attack campaign infects industrial control systems with BlackEnergy malware

Attack campaign infects industrial control systems with BlackEnergy malware

Customers of three SCADA human-machine interface products from different vendors were potentially affected, ICS-CERT said

Since 2011 a group of attackers has been targeting companies that operate industrial control systems with a backdoor program called BlackEnergy.

"Multiple companies working with ICS-CERT have identified the malware on Internet-connected human-machine interfaces (HMIs)," the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT), a division of the U.S. Department of Homeland Security, said in a security advisory Tuesday.

HMIs are software applications that provide a graphical user interface for monitoring and interacting with industrial machinery. They are a component of SCADA (supervisory control and data acquisition) systems that are used in industrial environments.

ICS-CERT has not identified cases where the BlackEnergy malware was used to damage, modify or disrupt the processes controlled by the compromised HMIs and it's not clear if attackers used those HMIs to gain deeper access into the industrial control systems.

The organization believes the BlackEnergy attackers targeted deployments of HMI products from three different vendors: General Electric's Cimplicity HMI, Siemens' SIMATIC WinCC and BroadWin's WebAccess -- also distributed by Advantech.

Cimplicity HMI installations were compromised through a vulnerability that GE issued a patch for in December 2013. However, ICS-CERT believes this group of attackers has been exploiting the vulnerability since at least January 2012.

"ICS-CERT is concerned that any companies that have been running Cimplicity since 2012 with their HMI directly connected to the Internet could be infected with BlackEnergy malware," because attackers likely used automated tools to discover and compromise vulnerable systems, the organization said.

ICS-CERT has not yet established the attack vectors for the SIMATIC WinCC and the Advantech/BroadWin WebAccess HMIs, but have reason to believe customers of these products have been targeted as well.

GE issued an alert about the BlackEnergy campaign on its security website. "We recommend customers who have GE CIMPLICITY products installed follow security practices and install the latest patches," the company said. The alert includes a link to a support document accessible only to customers.

Siemens published an alert on its website too. "Siemens has been informed that a file discovered during the analysis of the BlackEnergy malware can be associated to the product SIMATIC WinCC," the alert reads. "Experts from Siemens and ICS-CERT are investigating this issue and will provide information updates as soon as possible."

Security researchers have predicted malware attacks against SCADA systems ever since the Stuxnet cybersabotage worm was discovered in 2010. Those predictions materialized this year: BlackEnergy is the second malware program found in the past several months that's directly associated with attacks against industrial control systems.

BlackEnergy is the same malware that was used by a Russian cyberespioange group dubbed Sandworm to target organizations like the NATO alliance, energy firms and telecommunication companies. In an attack campaign exposed recently the group exploited a zero-day Windows vulnerability.

That Windows vulnerability, which was patched on Oct. 14, was not used to target industrial control system environments, ICS-CERT said. "However, analysis of the technical findings in the two reports shows linkages in the shared command and control infrastructure between the campaigns, suggesting both are part of a broader campaign by the same threat actor."

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags siemensAdvantechsecuritygeneral electricBroadWinExploits / vulnerabilitiesspywaremalwareIndustrial Control Systems Cyber Emergency Response TeamintrusionDepartment of Homeland Security

Slideshows

Top 50 defining moments of the New Zealand channel in 2016

Top 50 defining moments of the New Zealand channel in 2016

Reseller News looks back on a tumultuous 12 months for the New Zealand channel, assessing the fallout from a year of sizeable industry change. Whether it be local or global mergers and acquisitions, distribution deals or job changes, the channel that started the year differs somewhat to the one set to finish it - Reseller News assesses the key moments that made 2016.​

Top 50 defining moments of the New Zealand channel in 2016
​Hewlett Packard Enterprise honours high achieving NZ channel

​Hewlett Packard Enterprise honours high achieving NZ channel

Hewlett Packard Enterprise honoured its top performing Kiwi partners at the second running of its HPE Partner Awards in New Zealand, held at a glitzy ceremony in Auckland. Recognising excellence across eight categories - from distributors to resellers - the tech giant celebrated its first year as a standalone company, following its official split from HP in 2015.

​Hewlett Packard Enterprise honours high achieving NZ channel
Nutanix treats channel partners to Christmas cruise

Nutanix treats channel partners to Christmas cruise

Nutanix recently took to the seas for a Christmas Cruise around Sydney Harbour with its Australia and New Zealand staff, customers and partners to celebrate a stellar year for the vendor. With the sun out, they were all smiles and mingled over drinks and food.

Nutanix treats channel partners to Christmas cruise
Show Comments