Securing industrial control systems (ICS) is vital. Among other things, the security of endpoints, the systems that end-users rely on, must be given adequate consideration in this regard. In a report, Trend Micro warns of the risks and lists the main threats.
The IT security firm points to the benefits of ICS, including increased efficiency across various industries. The systems connect IT systems with operational technology, which increases efficiency and speed, among other things. At the same time, this feature makes ICS vulnerable to cyber attacks.
In a report, Trend Micro sets out the threats that manufacturing companies need to consider. These include ransomware, coinminers, so-called Conficker malware and legacy malware.
Ransomware
Ransomware is a form of malware that takes files hostage. The malware encrypts data and systems, making them inaccessible. Users who want to regain their access must pay a ransom, often in the form of crypto-currencies. In addition, victims often suffer damage as their business operations are interrupted.
Increasingly, cybercriminals are putting additional pressure on victims of ransomware through data theft. In this case, they threaten to publish stolen data. Such as customer data or trade secrets. This, too, can cause damage. Think of financial damage in the form of compensation, for example. But also image damage.
The most common forms of ransomware in ICS in 2020 were Nefilim (14.6%), Ryuk (19.8%), LockBit (10.4%) and Sodinokibi (13.5%).
Coinminers
Another threat is coinminers, which is also a variant of malware. This rogue software nests in ICS. It hijacks computing power for mining cryptocurrencies. Businesses can be significantly inconvenienced by this. For instance, coinminers can negatively affect the efficiency of ICS endpoints. And lead to slow and unresponsive systems. Especially for ICSs with limited CPU capacity or systems running on an outdated operating system, this leads to problems. The coinminer variant most frequently detected by Trend Micro on ICSs was the coinminer MALXMR.
Conficker
Conficker is malware that first emerged in 2008. Despite its age, the malware still poses a threat to ICS today. This malware spreads to systems in a variety of ways. Consider security problems in outdated operating systems that have not been kept up-to-date. However, think also of removable media such as USB sticks and cracking login credentials.
Legacy malware
Conficker is not the only legacy malware still making the rounds and still claiming victims among industrial companies. Other so-called legacy malware is also causing problems. This malware often spreads via USB sticks, which users insert into (air gapped) systems for all sorts of reasons. These include transferring data. But also creating system backups.
The legacy malware variants that Trend Micro detected the most in 2020 are Sality, Ramnit and Autorun.
Report
Further information is available in the report ‘2020 Report on Threats Affecting ICS Endpoints’, which you can download here.
Author: Wouter Hoeffnagel
