Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

10/23/2018
03:55 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Russian Research Institute Was Actively Involved In TRITON ICS Attack Activity

Data shows with a high degree of confidence that Moscow-based Central Scientific Research Institute of Chemistry and Mechanics helped develop and refine malware, FireEye says.

Late last year, a cyberattacker inadvertently shut down operations at a Saudi Arabian petrochemical plant while testing a highly sophisticated malware tool for manipulating its industrial safety systems.

In a new report this week, security vendor FireEye says it is now able to say with near certainty that a Russian government-backed research institute was involved in the attack, though the full extent of its involvement remains somewhat unclear.

The intrusion at the Middle East industrial facility attracted considerable attention for its use of TRITON, one of the few publicly known malware frameworks employed specifically for use against industrial control systems (ICS). TRITON, in fact, remains one of only three known instances of its type of malware. The other two are Stuxnet, which was used to destroy centrifuges at Iran's Natanz nuclear facility in 2010, and Industroyer, deployed in 2016 against Ukraine's power grid.

FireEye says its analysis shows that the Moscow-based Central Scientific Research Institute of Chemistry and Mechanics (CNIIHM) was involved in the activity that led to the deployment of TRITON on a Schneider Electric industrial safety system at the Saudi plant. The malware was designed to manipulate the behavior of the system in such a manner as to trigger conditions that could cause physical damage at the petrochemical plant in the same way Stuxnet did to Iran's nuclear processing facility. The attack came to light because something went awry and triggered an emergency shutdown at the Saudi plant.

FireEye says it has discovered several data points to support its assessment of CNIIHM's involvement in the intrusion with a high degree of confidence.

One of the biggest is an IP address registered to CNIIHM that was used for multiple purposes related to the attack, including network reconnaissance and specific malicious activity tied to  TRITON. Another clue is that a lot of the observed malicious behavior occurred during time periods consistent with the Moscow time zone, where CNIIHM is located. Significantly, CNIIHM also has the expertise and skill required to orchestrate and help execute the development and deployment of TRITON.

"The malware they used during the intrusion was being refined in a sort of testing environment that we could observe," says John Hultquist, director intelligence analysis at FireEye. Investigation of that activity shows direct ties to CNIIHM and a particular individual in Moscow with specific connections to the research institute.

One of CNIIHM's roles appears to have been to basically try and refine the malware to a point where it wasn't being caught by antimalware tools at the target organization, Hultquist notes. "While they were testing this stuff, we did see them go back and forth from the testing environment to the target, which basically indicated to us [CNIIHM's involvement]," he says.

There is little doubt that the Russian technical research institute supported the development and subsequent refinement of the TRITON malware, though it is possible that others were involved, as well, Hultquist says. "They were a lot less consistent with operational security and left a lot of artifacts that indicated their involvement," he explains.

While it is theoretically possible that someone within CNIIHM is involved in the TRITON activity without the knowledge or approval of the institute, that seems highly unlikely, FireEye said in its report.

Hultquist says FireEye's research confirms that Russian threat actors have the capability to target ICS systems with malware capable of causing physical damage. "We have seen Russian actors repeatedly demonstrating motive and intent," he says. "They have had a history of carrying out aggressive [cyber] activity." That means organizations have to be prepared.

Dave Weinstein, vice president of threat research at Claroty, says FireEye's report underscores the degree of complexity tied to the TRITON malware framework. Researchers have known for some time that only a highly resourced actor could have pulled off the attack; the FireEye analysis, if accurate, would validate that assumption, he says.

From a geopolitical standpoint, it will be interesting to see how the latest revelations play out, especially given the current relationship between the US and Russia.

For enterprises, this attribution doesn't change much, Weinstein says. "Organizations that operate ICS systems are less interested in the 'who' and more in the 'how' [of an attack]," he says.

Fortunately, for the moment at least, the barriers to entry remain high for those wanting to pull off TRITON-like attacks. And nation-states like Russia that have the ability to develop and execute such attacks are generally bound by some degree of deterrence. "It is not necessarily in the interest of a threat actor to actually execute these tools" given the potential for retaliation, Weinstein says.

Related Content:

 

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
97% of Americans Can't Ace a Basic Security Test
Steve Zurier, Contributing Writer,  5/20/2019
How a Manufacturing Firm Recovered from a Devastating Ransomware Attack
Kelly Jackson Higgins, Executive Editor at Dark Reading,  5/20/2019
TeamViewer Admits Breach from 2016
Dark Reading Staff 5/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Could you pass the hash, I really have to use the bathroom!
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-9892
PUBLISHED: 2019-05-22
An issue was discovered in Open Ticket Request System (OTRS) 5.x through 5.0.34, 6.x through 6.0.17, and 7.x through 7.0.6. An attacker who is logged into OTRS as an agent user with appropriate permissions may try to import carefully crafted Report Statistics XML that will result in reading of arbit...
CVE-2019-10066
PUBLISHED: 2019-05-22
An issue was discovered in Open Ticket Request System (OTRS) 7.x through 7.0.6, Community Edition 6.0.x through 6.0.17, and OTRSAppointmentCalendar 5.0.x through 5.0.12. An attacker who is logged into OTRS as an agent with appropriate permissions may create a carefully crafted calendar appointment i...
CVE-2019-10067
PUBLISHED: 2019-05-22
An issue was discovered in Open Ticket Request System (OTRS) 7.x through 7.0.6 and Community Edition 5.0.x through 5.0.35 and 6.0.x through 6.0.17. An attacker who is logged into OTRS as an agent user with appropriate permissions may manipulate the URL to cause execution of JavaScript in the context...
CVE-2019-6513
PUBLISHED: 2019-05-21
An issue was discovered in WSO2 API Manager 2.6.0. It is possible for a logged-in user to upload, as API documentation, any type of file by changing the extension to an allowed one.
CVE-2019-12270
PUBLISHED: 2019-05-21
OpenText Brava! Enterprise and Brava! Server 7.5 through 16.4 configure excessive permissions by default on Windows. During installation, a displaylistcache file share is created on the Windows server with full read and write permissions for the Everyone group at both the NTFS and Share levels. The ...