Malicious hackers are using vulnerabilities in third party suppliers to gain access to government entities and critical infrastructure, according to a recent alert by the Department of Homeland Security\u2019s United State\u2019s Computer Emergency Readiness Team.<\/p>\n\n\n\n
\u201cSince at least May 2017, threat actors have targeted government entities and the energy, water, aviation, nuclear and critical manufacturing sectors, and, in some cases, have leveraged their capabilities to compromise victims\u2019 networks,\u201d the alert said. \u201cThis campaign comprises two distinct categories of victims: staging and intended targets. The initial victims are peripheral organizations such as trusted third party suppliers with less secure networks.\u201d<\/p>\n\n\n\n
According to the report, the hackers targeted specific third party organizations that they knew would provide access to government entities, then created fake credentials within that organization to give them access to the intended targets.<\/p>\n\n\n\n
A DHS official told Federal Times that the hackers took information on industrial control systems and created illegitimate accounts within the targeted network. However, they are not yet using the information to access those systems, making the theft concerning but not an emergency situation.<\/p>\n\n\n\n
\u201cThe threat actors leveraged compromised credentials to access victims\u2019 networks where multi-factor authentication is not used,\u201d the alert said. \u201cOnce inside of an intended target\u2019s network, the threat actors downloaded tools from a remote server.\u201d<\/p>\n\n\n\n
The hackers used a variety of methods, including spear-phishing with information obtained from company websites, as well as watering hole attacks that used malicious code on legitimate sites to trick users into providing their credentials.<\/p>\n\n\n\n
\u201cForensic analysis identified that threat actors are conducting open-source reconnaissance of their targets, gathering information posted on company-controlled websites,\u201d the alert said. \u201cThis is a common tactic for collecting the information needed for targeted spear-phishing attempts. In some cases, information posted to company websites, especially information that may appear to be innocuous, may contain operationally sensitive information.\u201d<\/p>\n\n\n\n
According to a September Symantec report referenced in the alert, a group known as Dragonfly, originally in operation since 2011, resurfaced from inactivity in 2015 and has been targeting the energy sector.<\/p>\n\n\n\n
\u201cThe Dragonfly group appears to be interested in both learning how energy facilities operate and also gaining access to operational systems themselves, to the extent that the group now potentially has the ability to sabotage or gain control of these systems should it decide to do so,\u201d the Symantec report said.<\/p>\n\n\n\n
Dragonfly targeted companies using emails with content very specific to the energy sector, along with general business concerns.<\/p>\n\n\n\n
\u201cAs well as sending malicious emails, the attackers also used watering hole attacks to harvest network credentials, by compromising websites that were likely to be visited by those involved in the energy sector,\u201d the Symantec report said. \u201cThe stolen credentials were then used in follow-up attacks against the target organizations. In one instance, after a victim visited one of the compromised servers, Backdoor.Goodor was installed on their machine via PowerShell 11 days later. Backdoor.Goodor provides the attackers with remote access to the victim\u2019s machine.\u201d<\/p>\n\n\n\n
According to Symantec, the earlier behavior by Dragonfly combined with their behavior since 2015, indicates that the group may be moving from an intelligence-gathering campaign to a sabotage campaign.<\/p>\n\n\n\n
\u201cSabotage attacks are typically preceded by an intelligence-gathering phase where attackers collect information about target networks and systems and acquire credentials that will be used in later campaigns. The most notable examples of this are Stuxnet and Shamoon, where previously stolen credentials were subsequently used to administer their destructive payloads,\u201d the Symantec report said.\u201d The original Dragonfly campaigns now appear to have been a more exploratory phase where the attackers were simply trying to gain access to the networks of targeted organizations. The Dragonfly 2.0 campaigns show how the attackers may be entering into a new phase, with recent campaigns potentially providing them with access to operational systems, access that could be used for more disruptive purposes in future.\u201d<\/p>\n\n\n\n
The US-CERT alert provided indicators of compromise for network administrator reference and recommended that they \u201creview the IP addresses, domain names, file hashes, network signatures, and YARA rules provided and add the IPs to their watchlist to determine whether malicious activity has been observed within their organization.\u201d<\/p>\n","protected":false},"excerpt":{"rendered":"
Malicious hackers are using vulnerabilities in third party suppliers to gain access to government entities and critical infrastructure.<\/p>\n","protected":false},"author":7,"featured_media":45982,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":10,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[10],"tags":[],"coauthors":[2869],"class_list":["post-22171","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cyber"],"acf":{"subheadline":"","legacy_arc_id":"CZTCUVSIORA3PFMTN7XUEQDPVQ","arc_canonical_url":"\/critical-infrastructure\/2017\/10\/23\/dhs-warns-energy-sector-of-hackers-targeting-third-party-suppliers\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n