wp-plugin-hostgator
domain was triggered too early. This is usually an indicator for some code in the plugin or theme running too early. Translations should be loaded at the init
action or later. Please see Debugging in WordPress for more information. (This message was added in version 6.7.0.) in /home4/scienrds/scienceandnerds/wp-includes/functions.php on line 6114ol-scrapes
domain was triggered too early. This is usually an indicator for some code in the plugin or theme running too early. Translations should be loaded at the init
action or later. Please see Debugging in WordPress for more information. (This message was added in version 6.7.0.) in /home4/scienrds/scienceandnerds/wp-includes/functions.php on line 6114Source:https:\/\/techcrunch.com\/2023\/05\/25\/mandiant-russia-malware-immobilize-electric-grids\/<\/a><\/br> Security researchers have discovered new industrial control system malware, dubbed \u201cCosmicEnergy,\u201d which they say could be used to disrupt critical infrastructure systems and electric grids.<\/p>\n The malware was uncovered by researchers at Mandiant, who have likened CosmicEnergy\u2019s capabilities to the destructive Industroyer malware that the Russian state-backed \u201cSandworm\u201d hacking group used to cut power in Ukraine in 2016<\/a>.<\/p>\n Unusually, Mandiant says it uncovered CosmicEnergy through threat hunting and not following a cyberattack on critical infrastructure. The malware was uploaded to VirusTotal, a Google-owned malware and virus scanner, in December 2021 by a submitter based in Russia, according to Mandiant. The cybersecurity company\u2019s analysis shows that the malware may have been developed by Rostelecom-Solar, the cybersecurity arm of Russia\u2019s national telecom operator Rostelecom, to support exercises such as the ones hosted in collaboration with the Russian Ministry of Energy<\/a> in 2021.<\/p>\n \u201cA contractor may have developed it as a red-teaming tool for simulated power disruption exercises hosted by Rostelecom-Solar,\u201d Mandiant said. \u201cHowever, given the lack of conclusive evidence, we consider it also possible that a different actor \u2014 either with or without permission \u2014 reused code associated with the cyber range to develop this malware.\u201d<\/p>\n Mandiant says that not only do hackers regularly adapt and make use of red-team tools to facilitate real-world attacks, but its analysis of CosmicEnergy reveals that the malware\u2019s functionality is also comparable to that of other malware variants targeting industrial control systems (ICS), such as Industroyer, thus posing a \u201cplausible threat to affected electric grid assets.\u201d<\/p>\n Mandiant tells TechCrunch that it has not observed any CosmicEnergy attacks in the wild and notes that the malware lacks discovery capabilities, which means hackers would need to perform some internal reconnaissance to obtain environment information, such as IP addresses and credentials, before launching an attack.<\/p>\n However, the researchers added that because the malware targets the IEC-104, a network protocol commonly used in industrial environments that was also targeted during the 2016 attack on Ukraine\u2019s power grid, CosmicEnergy poses a real threat to organizations involved in electricity transmission and distribution.<\/p>\n \u201cThe discovery of new OT [operational technology] malware presents an immediate threat to affected organizations since these discoveries are rare and because the malware principally takes advantage of insecure by-design features of OT environments that are unlikely to be remedied any time soon,\u201d Mandiant researchers warned.<\/p>\n Mandiant\u2019s discovery of new ICS-oriented malware comes after Microsoft revealed this week that Chinese state-backed hackers had hacked into American critical infrastructure. According to the report<\/a>, an espionage group that Microsoft refers to as \u201cVolt Typhoon\u201d has targeted the U.S. island territory of Guam and could be attempting to \u201cdisrupt critical communications infrastructure between the United States and Asia region during future crises.\u201d<\/p>\n In light of the report, the U.S. government said it was working with its Five Eyes partners to identify potential breaches. Microsoft says the group has attempted to access organizations in the communications, manufacturing, utility, transportation, construction, maritime, government, information technology and education sectors.<\/p>\n<\/p><\/div>\n <\/br><\/br><\/br><\/p>\n
\nResearchers uncover Russia-linked malware that could immobilize electric grids<\/br>
\n2023-05-27 22:16:49<\/br><\/p>\n