Summary:
Microsoft has highlighted the urgent need to secure internet-exposed OT devices following a series of cyber attacks targeting such environments since late 2023. The Microsoft Threat Intelligence team stressed that these attacks highlight the critical need to improve OT security and prevent critical systems from becoming easy targets. Cyber attacks on OT systems can enable malicious actors to manipulate critical industrial process parameters, either programmatically through PLCs or using the human-machine interface, potentially causing malfunctions and outages. OT systems often lack sufficient security, making them vulnerable to exploitation, especially when connected to the internet. This connectivity exposes them to discovery through internet scanning tools and attacks leveraging weak passwords or outdated software.


Recently, Rockwell Automation advised customers to disconnect industrial control systems not meant for public internet exposure due to increasing geopolitical tensions and adversarial cyber activity. Similarly, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) warned of pro-Russia hacktivists targeting North American and European industrial control systems, manipulating HMIs to disrupt water pumps and blower equipment.


Analyst Comment:
The onset of the Israel-Hamas war in October 2023 led to increased cyber attacks against poorly secured OT assets developed by Israeli companies, often conducted by Iran-affiliated groups like Cyber Av3ngers, Soldiers of Solomon, and Abnaa Al-Saada. These attacks targeted OT equipment in various sectors, both within Israel and internationally. Additionally, OT security firm Claroty reported on a destructive malware strain called Fuxnet, used by the Blackjack hacking group, allegedly backed by Ukraine, against Moscollector, a Russian company monitoring Moscow's underground water and sewage systems. Fuxnet can destroy filesystems, block device access, and physically damage NAND memory chips, rendering the devices inoperable.

Further, according to Kaspersky, internet, email clients, and removable storage devices were the main sources of threats to OT infrastructure in the first quarter of 2024. Malicious actors use scripts for various purposes, including collecting information, redirecting browsers to malicious sites, and uploading malware via the internet and email.


Suggested Corrections:
Microsoft reccomends the following mitigations: The analysis of the attack claims in question reveals diverse target profiles. It is therefore vital for organizations of all different sectors to ensure security hygiene for their OT systems to prevent similar threats.