Menu
Attack campaign infects industrial control systems with BlackEnergy malware

Attack campaign infects industrial control systems with BlackEnergy malware

Customers of three SCADA human-machine interface products from different vendors were potentially affected, ICS-CERT said

Since 2011 a group of attackers has been targeting companies that operate industrial control systems with a backdoor program called BlackEnergy.

"Multiple companies working with ICS-CERT have identified the malware on Internet-connected human-machine interfaces (HMIs)," the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT), a division of the U.S. Department of Homeland Security, said in a security advisory Tuesday.

HMIs are software applications that provide a graphical user interface for monitoring and interacting with industrial machinery. They are a component of SCADA (supervisory control and data acquisition) systems that are used in industrial environments.

ICS-CERT has not identified cases where the BlackEnergy malware was used to damage, modify or disrupt the processes controlled by the compromised HMIs and it's not clear if attackers used those HMIs to gain deeper access into the industrial control systems.

The organization believes the BlackEnergy attackers targeted deployments of HMI products from three different vendors: General Electric's Cimplicity HMI, Siemens' SIMATIC WinCC and BroadWin's WebAccess -- also distributed by Advantech.

Cimplicity HMI installations were compromised through a vulnerability that GE issued a patch for in December 2013. However, ICS-CERT believes this group of attackers has been exploiting the vulnerability since at least January 2012.

"ICS-CERT is concerned that any companies that have been running Cimplicity since 2012 with their HMI directly connected to the Internet could be infected with BlackEnergy malware," because attackers likely used automated tools to discover and compromise vulnerable systems, the organization said.

ICS-CERT has not yet established the attack vectors for the SIMATIC WinCC and the Advantech/BroadWin WebAccess HMIs, but have reason to believe customers of these products have been targeted as well.

GE issued an alert about the BlackEnergy campaign on its security website. "We recommend customers who have GE CIMPLICITY products installed follow security practices and install the latest patches," the company said. The alert includes a link to a support document accessible only to customers.

Siemens published an alert on its website too. "Siemens has been informed that a file discovered during the analysis of the BlackEnergy malware can be associated to the product SIMATIC WinCC," the alert reads. "Experts from Siemens and ICS-CERT are investigating this issue and will provide information updates as soon as possible."

Security researchers have predicted malware attacks against SCADA systems ever since the Stuxnet cybersabotage worm was discovered in 2010. Those predictions materialized this year: BlackEnergy is the second malware program found in the past several months that's directly associated with attacks against industrial control systems.

BlackEnergy is the same malware that was used by a Russian cyberespioange group dubbed Sandworm to target organizations like the NATO alliance, energy firms and telecommunication companies. In an attack campaign exposed recently the group exploited a zero-day Windows vulnerability.

That Windows vulnerability, which was patched on Oct. 14, was not used to target industrial control system environments, ICS-CERT said. "However, analysis of the technical findings in the two reports shows linkages in the shared command and control infrastructure between the campaigns, suggesting both are part of a broader campaign by the same threat actor."


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags securitymalwarespywareintrusionsiemensgeneral electricExploits / vulnerabilitiesDepartment of Homeland SecurityIndustrial Control Systems Cyber Emergency Response TeamAdvantechBroadWin

Featured

Slideshows

Meet the leading female front runners of the Kiwi channel

Meet the leading female front runners of the Kiwi channel

Reseller News honoured the leading female front runners of the New Zealand channel at the 2018 Women in ICT Awards (WIICTA) in Auckland. The awards honoured standout individuals across seven categories, spanning Entrepreneur; Innovation; Rising Star; Shining Star; Community; Technical and Achievement.

Meet the leading female front runners of the Kiwi channel
Meet the top performing customer-centric Microsoft channel partners

Meet the top performing customer-centric Microsoft channel partners

Microsoft honoured leading partners across the channel following a year of customer innovation and market growth in New Zealand. The 2018 Microsoft Partner Awards recognised excellence within the context of the end-user, spanning a host of emerging and established providers.

Meet the top performing customer-centric Microsoft channel partners
Reseller News launches new-look Awards at 2018 Judges’ Lunch

Reseller News launches new-look Awards at 2018 Judges’ Lunch

Introducing the Reseller News Innovation Awards, launched to the channel at the 2018 Judges’ Lunch in Auckland. With more than 70 judges now part of the voting panel, the new-look awards will reflect the changing dynamics of the channel, recognising excellence across customer value and innovation - spanning start-ups, partners, distributors and vendors.

Reseller News launches new-look Awards at 2018 Judges’ Lunch
Show Comments