Menu
Attack campaign infects industrial control systems with BlackEnergy malware

Attack campaign infects industrial control systems with BlackEnergy malware

Customers of three SCADA human-machine interface products from different vendors were potentially affected, ICS-CERT said

Since 2011 a group of attackers has been targeting companies that operate industrial control systems with a backdoor program called BlackEnergy.

"Multiple companies working with ICS-CERT have identified the malware on Internet-connected human-machine interfaces (HMIs)," the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT), a division of the U.S. Department of Homeland Security, said in a security advisory Tuesday.

HMIs are software applications that provide a graphical user interface for monitoring and interacting with industrial machinery. They are a component of SCADA (supervisory control and data acquisition) systems that are used in industrial environments.

ICS-CERT has not identified cases where the BlackEnergy malware was used to damage, modify or disrupt the processes controlled by the compromised HMIs and it's not clear if attackers used those HMIs to gain deeper access into the industrial control systems.

The organization believes the BlackEnergy attackers targeted deployments of HMI products from three different vendors: General Electric's Cimplicity HMI, Siemens' SIMATIC WinCC and BroadWin's WebAccess -- also distributed by Advantech.

Cimplicity HMI installations were compromised through a vulnerability that GE issued a patch for in December 2013. However, ICS-CERT believes this group of attackers has been exploiting the vulnerability since at least January 2012.

"ICS-CERT is concerned that any companies that have been running Cimplicity since 2012 with their HMI directly connected to the Internet could be infected with BlackEnergy malware," because attackers likely used automated tools to discover and compromise vulnerable systems, the organization said.

ICS-CERT has not yet established the attack vectors for the SIMATIC WinCC and the Advantech/BroadWin WebAccess HMIs, but have reason to believe customers of these products have been targeted as well.

GE issued an alert about the BlackEnergy campaign on its security website. "We recommend customers who have GE CIMPLICITY products installed follow security practices and install the latest patches," the company said. The alert includes a link to a support document accessible only to customers.

Siemens published an alert on its website too. "Siemens has been informed that a file discovered during the analysis of the BlackEnergy malware can be associated to the product SIMATIC WinCC," the alert reads. "Experts from Siemens and ICS-CERT are investigating this issue and will provide information updates as soon as possible."

Security researchers have predicted malware attacks against SCADA systems ever since the Stuxnet cybersabotage worm was discovered in 2010. Those predictions materialized this year: BlackEnergy is the second malware program found in the past several months that's directly associated with attacks against industrial control systems.

BlackEnergy is the same malware that was used by a Russian cyberespioange group dubbed Sandworm to target organizations like the NATO alliance, energy firms and telecommunication companies. In an attack campaign exposed recently the group exploited a zero-day Windows vulnerability.

That Windows vulnerability, which was patched on Oct. 14, was not used to target industrial control system environments, ICS-CERT said. "However, analysis of the technical findings in the two reports shows linkages in the shared command and control infrastructure between the campaigns, suggesting both are part of a broader campaign by the same threat actor."


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags malwarespywareintrusionsiemensgeneral electricExploits / vulnerabilitiesDepartment of Homeland SecurityIndustrial Control Systems Cyber Emergency Response TeamAdvantechBroadWin

Events

EDGE 2024

Register your interest now for EDGE 2024!

Featured

Slideshows

How MSPs can capitalise on integrating AI into existing services

How MSPs can capitalise on integrating AI into existing services

​Given the pace of change, scale of digitalisation and evolution of generative AI, partners must get ahead of the trends to capture the best use of innovative AI solutions to develop new service opportunities. For MSPs, integrating AI capabilities into existing service portfolios can unlock enhancements in key areas including managed hosting, cloud computing and data centre management. This exclusive Reseller News roundtable in association with rhipe, a Crayon company and VMware, focused on how partners can integrate generative AI solutions into existing service offerings and unlocking new revenue streams.

How MSPs can capitalise on integrating AI into existing services
Access4 holds inaugural A/NZ Annual Conference

Access4 holds inaugural A/NZ Annual Conference

​Access4 held its inaugural Annual Conference in Port Douglass, Queensland, for Australia and New Zealand from 9-11 October, hosting partners from across the region with presentations on Access4 product updates, its 2023 Partner of the Year awards and more.

Access4 holds inaugural A/NZ Annual Conference
Show Comments