Rise in geopolitically driven OT cyber attacks in 2023: report

OT cybersecurity company Dragos has released its sixth annual Dragos OT Cybersecurity Year in Review report. The report named the emergence of three new threat groups, including VOLTZITE linked to Volt Typhoon, and found that ransomware continued to be the most reported cyberthreat among industrial organisations with a nearly 50% increase in reported incidents. 2023 also saw the first time a hacktivist group achieved Stage 2 of the ICS Cyber Kill Chain.

“OT cyberthreats reached a tipping point in 2023,” said Robert Lee, co-founder and CEO of Dragos. “Industrial and critical infrastructure has been moving away from highly customised facilities to ones that — for good economic and productivity reasons — share the same industrial devices, technologies and facility designs across sites and sectors. Unfortunately, adversaries are now leveraging these homogenous infrastructures to scale attacks. They also target weaknesses in environments that pushed digital transformation without adequate cybersecurity measures.

“These factors contributed to an environment in 2023 in which organisations were challenged with a range of threats, including increasingly sophisticated state actors, hacktivists preying on pervasive security weaknesses, and a growing barrage of ransomware attacks.

“There were positive developments for OT cybersecurity too,” Lee added. “We saw vendors, governments and the community collaborate to enable a unified, risk-based response to threats, as was the case with the ControlLogix vulnerabilities disclosed by Rockwell Automation. We observed that more devices and protocols are incorporating authentication. And we at Dragos experienced triple the number of organisations conducting tabletop exercises, including a 350% increase at the board and executive level, to test and strengthen their OT security strategies.”

Threat details

Dragos has identified three new OT threat groups — VOLTZITE, GANANITE and LAURIONITE.

VOLTZITE

VOLTZITE targets electric power generation, transmission and distribution and has been observed targeting cybersecurity research, technology, defence industrial bases, satellite services, telecommunications, and educational organisations. The group overlaps with Volt Typhoon, a group that the US Government has publicly linked to the People’s Republic of China. The group’s threat activities include living off the land (LOTL) techniques, prolonged surveillance, and data gathering aligned with Volt Typhoon’s assessed objectives of reconnaissance and gaining geopolitical advantage in the Asia–Pacific region. They have traditionally targeted US-based facilities, but also have been seen targeting organisations in Africa and South-East Asia.

GANANITE

GANANITE targets critical infrastructure and government entities in the Commonwealth of Independent States and Central Asian nations. The group leverages publicly available proof of concept (POC) exploits for internet-exposed endpoints and focuses on espionage and data theft.

LAURIONITE

LAURIONITE targets and exploits Oracle E-Business Suite iSupplier web services and assets across aviation, automotive and manufacturing industries. The group utilises a combination of open-source offensive security tooling and public proof of concepts to aid in their exploitation of common vulnerabilities.

Other details

Geopolitical conflicts also drove threat activity with regional and global kinetic events overlapping with OT cybersecurity threats. The Ukraine–Russia conflict prompted more mature threat groups, such as ELECTRUM, to increase activity, while tensions between China and Taiwan contributed to increased targeted cyber espionage attacks against industrial organisations in the Asia–Pacific region and the United States.

Hacktivists for the first time achieved Stage 2 of the ICS Cyber Kill Chain, when CyberAv3ngers attacked PLCs used by water utilities across North America and Europe with an anti-Israel message. While hacktivist groups typically conduct distributed denial of service (DDoS) attacks with minimal impact, this attack demonstrated the ability to disrupt OT systems by using unsophisticated methods with weak security controls. Other active hacktivist groups included CyberArmyofRussia_Reborn, NoName057(16), Anonymous Sudan, and Team Insane Pakistan.

Ransomware remains the number one attack in the industrial sector, increasing 50% from 2022. Lockbit caused 25% of total industrial ransomware attacks, with ALPHV and BlackBasta accounting for 9% each. Manufacturing continues to be the primary target of ransomware and accounted for 71% of all ransomware attacks. The majority of ransomware attacks impacted organisations in North America with 44% of incidents, followed by Europe at 32%. Dragos tracked 50 ransomware variants in 2023, a 28% increase over last year.

Frontline perspectives

Based on data gathered from annual customer service engagements conducted by Dragos’s cybersecurity experts in the field across the range of industrial sectors, the top challenges industrial organisations need to address are:

• Lack of sufficient security controls: 28% of service engagements involved issues with improper network segmentation or improperly configured firewalls.
• Improper network segmentation: Approximately 70% of OT-related incidents originated from within the IT environment.
• Lack of separate IT and OT user management: 17% of organisations had a shared domain architecture between their IT and OT systems, the most common method of lateral movement and privilege escalation.
• External connections to the ICS environment: Dragos observed four threat groups exploiting public-facing devices and external services and issued findings related to externally facing networks such as the internet in 20% of engagement reports.
   

The 2023 Dragos OT Cybersecurity Year in Review is available at https://www.dragos.com/year-in-review.

Image credit: iStock.com/bymuratdeniz