Collaborate Disseminate
Lesley Carhart is the Principal Threat Analyst at Dragos Inc.. Lesley has been performing digital forensics and incident response on unconventional systems and advanced adversary attacks for over a decade. Lesley will be discussing her transition f… Continue reading From IT to OT Security, Lesley Carhart – Paul’s Security Weekly #603
U.S. critical infrastructure operators should be on high alert — with a close eye on network anomalies — following the revelation that a hacking group that caused a Saudi industrial plant to shut down last year is targeting facilities outside of the Middle East, industry experts told CyberScoop. “Detecting these types of advanced, stealthy threats requires extraordinary visibility into your OT [operational technology] network,” said Marty Edwards, former head of the Department of Homeland Security’s Industrial Control Systems (ICS) CERT. “Unfortunately, not all U.S. critical infrastructure asset owners are at that level of maturity.” The hacking group’s expanded operations mean that U.S. infrastructure operators “should no longer remain complacent in thinking that this is just an issue somewhere else in the world,” Edwards added. The developers of the Trisis malware, which is designed to ravage the control systems that allow plants to safely shut down, have attacked multiple U.S. companies, […]
The post U.S. industry experts call for vigilance after Trisis group goes global appeared first on Cyberscoop.
Continue reading U.S. industry experts call for vigilance after Trisis group goes global
An elite, government authored cyberweapon has been sitting online in public view for nearly anyone to copy since Dec. 22 because multinational energy technology company Schneider Electric mistakenly posted a sensitive computer file to VirusTotal, three sources familiar with the matter told CyberScoop. Schneider Electric obtained the file in question, titled “Library.zip,” after collecting evidence during a data breach investigation in the Middle East that focused on an incident at an oil and gas refinery. Library.zip holds the backbone of a dangerous malware framework known as “Trisis” or “Triton,” according to research by U.S. cybersecurity companies Dragos Inc. and FireEye. The upload to VirusTotal, a public malware repository, provided the remaining puzzle piece needed for someone to reconstruct Trisis from publicly available artifacts. After being posted to VirusTotal, Library.zip proliferated — it was picked up and re-uploaded to various platforms, including GitHub and VirusTotal. Experts say the unique malware was carefully designed to manipulate […]
The post Trisis has mistakenly been released on the open internet appeared first on Cyberscoop.
Continue reading Trisis has mistakenly been released on the open internet
The New York Times this week published a fascinating story about a young programmer in Ukraine who’d turned himself in to the local police. The Times says the man did so after one of his software tools was identified by the U.S. government as part of the arsenal used by Russian hackers suspected of hacking into the Democratic National Committee (DNC) last year. It’s a good read, as long as you can ignore that the premise of the piece is completely wrong. Continue reading Blowing the Whistle on Bad Attribution
A newly discovered malware framework, which some believe carries signs of Russian authorship, can be used by hackers to disrupt industrial control systems and cause mass power outages, according to research conducted by cybersecurity firms Dragos Inc. and ESET. The findings are significant because they represent the first known real-world case of a computer virus designed to directly interact with electric grid hardware, explained Sergio Caltagirone, director of threat intelligence for Dragos. Researchers believe that a version of the malware framework, dubbed “CrashOverride” or “Industroyer,” was previously leveraged to hack into an electric transmission station in Ukraine causing a black out for several hours last December in neighborhoods just north of Kiev. Evidence of a connection between CrashOverride’s author and the attackers behind last year’s Ukrainian power grid incident exists, according to Caltagirone, but was not published in Dragos’ technical analysis. In January, iSight Partners, a subsidiary of U.S. cybersecurity […]
The post Researchers find cyberweapon capable of knocking out electric grids appeared first on Cyberscoop.
Continue reading Researchers find cyberweapon capable of knocking out electric grids
A newly discovered malware framework, which some believe carries signs of Russian authorship, can be used by hackers to disrupt industrial control systems and cause mass power outages, according to research conducted by cybersecurity firms Dragos Inc. and ESET. The findings are significant because they represent the first known real-world case of a computer virus designed to directly interact with electric grid hardware, explained Sergio Caltagirone, director of threat intelligence for Dragos. Researchers believe that a version of the malware framework, dubbed “CrashOverride” or “Industroyer,” was previously leveraged to hack into an electric transmission station in Ukraine causing a black out for several hours last December in neighborhoods just north of Kiev. Evidence of a connection between CrashOverride’s author and the attackers behind last year’s Ukrainian power grid incident exists, according to Caltagirone, but was not published in Dragos’ technical analysis. In January, iSight Partners, a subsidiary of U.S. cybersecurity […]
The post Researchers find cyberweapon capable of knocking out electric grids appeared first on Cyberscoop.
Continue reading Researchers find cyberweapon capable of knocking out electric grids