A report from the U.S. Computer Emergency Readiness Team provides a detailed look at how alleged Russian attackers planned and executed a long-term cyber-attack against unprepared energy installations.
The US-CERT report explains that the “DHS and FBI characterize this activity as a multi-stage intrusion campaign by Russian government cyber actors who targeted small commercial facilities’ networks where they staged malware, conducted spear phishing, and gained remote access into energy sector networks.”
The report includes a step-by-step description of the hackers’ activities, including the specific methods, the specific IP addresses of their servers and repositories and compromise details.
The alleged Russian hackers started with a poorly defended contractor to gain access to the ultimate target’s network. Once inside their system, the hackers set it up as a staging area by creating repositories for software, creating fake accounts, and conducting surveillance in order to gather information on the software, credentials, and control processes being used.
This information was exfiltrated to remote servers using SMB protocol. Once the surveillance was complete, the hackers launched a series of processes designed to cover their tracks.
In order to prevent future attacks like these, vice president of industrial cyber-security at CyberX Phil Neray suggested managers of industrial control systems adopt practices such as continuous monitoring of activities on the network, changing permissions or changing the registry, both of which were common activities conducted by the hackers.
Meanwhile, co-founder and COO of Virsec Ray DeMeo suggested that a long term fix would be to include security readiness in an organization as part of the annual audit and that it be disclosed to stockholders. He also suggested that insurance premiums be tied to security readiness.