Cybersecurity firm Dragos recently published a report on what it describes as the rising cybersecurity threat to manufacturing organizations.
The report discusses threat actors targeting industrial control systems (ICS) to pull of ransomware and IP-theft attacks,
Ransomware adversaries are adopting ICS-aware functionality with the ability to stop industrial related processes and cause disruptive – and potentially destructive – impacts. Dragos has not observed ICS-specific malware targeting manufacturing operations on the same scale or sophistication as that used in the disruptive TRISIS and CRASHOVERRIDE malware attacks that targeted energy operations in Saudi Arabia and Ukraine, respectively. However, known and ongoing threats to manufacturing can have direct and indirect impact to operations. This report provides a snapshot of the threat landscape as of October 2020 and is expected to change in the future as adversaries and their behaviors evolve.
. . .
The most common threat to manufacturing is ransomware. Dragos observed a significant rise in the number of non-public and public ransomware events that have affected ICS environments and operations over the last two years.
This year, Dragos identified multiple ransomware strains adopting ICS-aware functionality, including the ability to “kill” (i.e., stop) industrial processes if identified in the environment, with activity dating back to 2019. EKANS, Megacortex, and Clop are just a few ransomware strains that contain this type of code. Past concerns with ransomware in ICS focused on propagation. IT-focused ransomware could impact control system environments if it is able to migrate into Windows-based portions of control system networks and disrupt operations.
In 2020, the number of publicly reported ransomware attacks on manufacturing entities has more than tripled compared to 2019, based on data tracked by Dragos. Although most ransomware strains impacting ICS and related entities are IT focused, ransomware can have indirect impacts on operations and process control networks by impacting resources such as logistics, fleet management, sales operations and fulfillment, or loss of view to enterprise resource management tools. For example, enterprise technologies like Enterprise Resource Planning (ERP) software are integrated with data historians containing process data to distribute information across a company. By encrypting ERP and related files on a workstation, a ransomware adversary could stop vital communication and record keeping, indirectly impacting manufacturing process and logistics operations.
The report includes recommendations for manufacturers to implement mitigation strategies, including a critical examination of network assets to understand and harden potential weaknesses, mandating multi-factor authentication wherever possible, ensure network segmentation wherever possible, etc.