Cyber attacks against industrial companies on the rise

Blocking of malicious objects happened in nearly 32% of OT computers Kaspersky protects with its solutions in the first half of 2022. These computers are in infrastructures of industries such as oil and gas, energy, automotive and building automation. But also in other environments with OT functions. Think, for example, of workstations of engineers and operators. Or servers for supervisory control and data acquisition (SCADA) and Human Machine Interface (HMI).

In the past six months, perpetrators attempted to attack industrial computers most often with malicious scripts and phishing pages. These objects were blocked on almost 13% of the total number of protected computers. This category of threats also showed the most dynamic growth compared to the previous half of this year. It represents an increase of 3.5 percentage points.

Malicious scripts and phishing pages are one of the most common ways of spreading spyware. In the first half of 2022, this was detected on almost 9% of OT computers. In doing so, there was an increase of 0.5 percentage points between H2 2021 and H1 2022. The other way cybercriminals spread spyware is through phishing emails with a malicious document attached. Kaspersky reports an almost double increase. Up to almost 6%, in the percentage of OT computers where malicious documents were blocked.

Almost half of computers (42%) in the building automation infrastructure ( Building Management Systems), faced cyber threats. These computers are usually owned by service companies. They manage automated systems in business or shopping centres, municipalities and other types of public infrastructure. Industrial facilities and critical infrastructure objects often own the on-site building management systems.

In the first half of 2022, building management systems became the most ‘vulnerable’ type of OT infrastructure in terms of attack activity. They ranked highest in terms of the percentage of devices affected by various threat sources. These included internet sources (23 per cent), malicious email attachments and phishing links (14 per cent), malicious documents (11 per cent), Trojans, backdoors and keyloggers (13 per cent) and others.

Building automation engineers and operators make more active use of internet resources and email than in other OT infrastructures. Moreover, a building management system may not be well separated from other internal networks physically located in the building. This may make it an attractive target for sophisticated threat actors.

"It is quite normal for these types of environments to experience the impact of attackers' activities. This is because of their high exposure and relatively low cybersecurity maturity. Attackers compromise systems that may have connections to internal networks of factories, public spaces or even critical infrastructure facilities. As for smart cities and public infrastructures, the systems can manage an entire neighbourhood. They have access to lighting control, road traffic management and information, and other types of services for citizens. This makes it a real "cinch" for perpetrators. What is even more alarming is that 14% of all building management system (BMS) computers have been attacked using phishing emails, which is twice the global average," said Kirill Kruglov, senior researcher at Kaspersky ICS CERT.

Source photo: Pixabay / TheDigitalArtist