2020 Report: ICS Endpoints as Starting Points for Threats

RANSOMWARE

Ransomware in ICS could lead to loss of view and control of physical processes, since such attacks encrypt a variety of files, including image and configuration files, that are necessary for rendering the interface. This in turn leads to loss of revenue due to disrupted operations. Victims could also lose money from extortion schemes as more ransomware operators also threaten to publicize stolen data.

In 2020, the ransomware variants we detected the most in ICS were Nefilim, Ryuk, LockBit, and Sodinokibi, mostly due to increased attacks from September to December.

Figure 1. Breakdown of ransomware that affected ICS in 2020
Source: Trend Micro™ Smart Protection Network™ infrastructure

COINMINERS

For coinminers, the mining activity’s CPU utilization can negatively affect the efficiency of ICS endpoints. The said threat can cause ICS to become slow and unresponsive, indirectly causing loss of control and view. This is especially true if the affected computers have low CPU capacity and/or running outdated operating systems, which is not rare in industrial environments.

For 2020, the coinminer variant we detected the most on ICS is the post-intrusion coinminer MALXMR. It was typically installed filelessly, but starting in 2019, we have seen MALXMR infections being propagated through the EternalBlue vulnerability.

Figure 2. Breakdown of coinminers affecting ICS in 2020
Source: Trend Micro™ Smart Protection Network™ infrastructure

CONFICKER

First discovered in 2008, Conficker is more than a decade old, but this persistent threat is still being detected. Containing worm infections that spread rapidly is not an easy task, especially when it uses multiple methods of propagation (such as network exploit, removable drives, and credential bruteforce) as in the case of Conficker.

Conficker was first known to widely propagate via the MS08-067 vulnerability found in Windows. MS08-067 does not apply to Windows 10 and Windows 7; however, our 2020 data shows that most Conficker infections were detected in these operating systems. This means that those detected in ICS are propagated using removable drives or dictionary attacks on ADMIN$ share.

Figure 3. OS distribution of ICS endpoints with Conficker detections
Source: Trend Micro™ Smart Protection Network™ infrastructure

LEGACY MALWARE

Like Conficker, legacy malware are old, but they are still persistently detected in ICS systems. The use of USB thumb drives for transferring files and data between air-gapped networks allows the propagation of such legacy worms. Another possible cause is the use of unscanned removable drives for creating system backups or cold standby terminals.

In 2020, the legacy malware variants we detected the most were Sality, Ramnit, and Autorun. Although they are not associated with notorious cybercrime groups, their persistence in industrial networks reveals insufficient security and maintenance of data backups and removable drives.