July 5, 2021 By David Bisson 3 min read

Low-sophistication operational technology (OT) attacks grew in frequency and relative severity over the previous few years, according to Mandiant. In doing so, they broadened the type of threat against which companies and governments need to defend their OT assets. Attackers in this area target critical infrastructure. Their attacks can have a physical effect on employees and other people around the affected area.

Read on to learn what these attacks look like and how some of them aren’t always as they appear.

Attackers With Limited OT Expertise

When it comes to OT, threat actors don’t always want to disrupt or modify a control process. Sometimes, they want to take control of internet-facing OT assets. From there, they can leverage that access to spread their political ideas, extort owners or secure bragging rights.

In the past, most amateur OT attacks observed by Mandiant were done by attackers looking for money. More recently, the firm has seen a surge in attempts where attackers are trying to gain control of and scout out critical infrastructure.

Attackers targeted solar energy panels, building automation systems (BAS) and home security systems across a variety of industries.

In March 2020, for instance, Mandiant analyzed screenshots shared by a threat actor who claimed to have compromised dozens of control systems. The unknown attacker also shared a video of what they claimed was a compromised Dutch-language temperature control system.

Another threat actor shared a video in which they used remote connections from their desktop to make set point changes to compromised human-machine interfaces. At one point, that attacker appeared to have accessed a BAS at an Australian hotel.

Not everyone always knows what they’re doing, or, for that matter, what they’re even seeing when it comes to critical infrastructure. In one example cited by Mandiant, for instance, a threat actor claimed to have compromised the control system for a German-language railway. A closer look revealed the attacker had really compromised a command system used with model train sets.

In a similar case, someone claimed they had compromised an Israeli ‘gas system.’ It turned out that they had really taken control of a kitchen fan system at a restaurant in Israel.

A Broader View of the Critical Infrastructure Threat Landscape

The amateur attacks fit into a larger trend of increasing threats involving OT systems. Between 2018 and 2020, for instance, researchers saw a 2,000% increase in threat actors’ attempts to target OT assets and industrial control systems. Many of those attacks relied on vulnerabilities in supervisory control and data acquisition systems and brute force attempts.

The events of 2020 didn’t slow attackers down, either. According to Fortinet, nine out of 10 organizations faced an incident involving their OT in the past year. This finding matched the firm’s 2020 study. Moreover, Fortinet observed that more than half (58%) of these victims had reported a phishing attack — up from 43% a year earlier.

Defending Against OT Attacks

Even amateur OT attacks are nothing to dismiss. They give attackers a chance to learn more about critical infrastructure for staging more campaigns in the future. They normalize OT attacks and thereby invite copycat threat actors. And they could disrupt a physical process that’s essential to the business or nation.

So, organizations need to defend themselves against amateur OT attacks. They can do this by using network segmentation to isolate critical infrastructure OT assets from public-facing networks wherever feasible and using access controls to protect those systems that require remote access. They can also use threat intelligence to keep track of threat actors’ interest in OT assets. They can then implement the right defense measures and run a penetration test as a means of checking those controls.

More from News

Securing critical infrastructure with the carrot and stick

4 min read - It wasn’t long ago that cybersecurity was a fringe topic of interest. Now, headline-making breaches impact large numbers of everyday citizens. Entire cities find themselves under cyberattack. In a short time, cyber has taken an important place in the national discourse. Today, governments, regulatory agencies and companies must work together to confront this growing threat. So how is the federal government bolstering security for critical infrastructure? It looks like they are using a carrot-and-stick approach. Back in March 2022, the…

650,000 cyber jobs are now vacant: How to tackle the risk

4 min read - How far is the United States behind in filing cybersecurity jobs? As per Rep. Andrew Garbarino, R-N.Y., Chairman of the HHS Cybersecurity and Infrastructure Protection Subcommittee, overseas adversaries have a workforce advantage over FBI cyber personnel of 50 to one. His statements were made during a recent subcommittee hearing titled “Growing the National Cybersecurity Talent Pipeline.” Meanwhile, recent CyberSeek data shows over 650,000 cyber jobs to fill nationwide. Given the rising rate of cyberattacks, these numbers are truly alarming. How…

Will data backups save you from ransomware? Think again

4 min read - Backups are an essential part of any solid anti-ransomware strategy. In fact, research shows that the median recovery cost for ransomware victims that used backups is half the cost incurred by those that paid the ransom. But not all data backup approaches are created equal. A separate report found that in 93% of ransomware incidents, threat actors actively target backup repositories. This results in 75% of victims losing at least some of their backups during the attack, and more than…

Should you worry about state-sponsored attacks? Maybe not.

4 min read - More than ever, state-sponsored cyber threats worry security professionals. In fact, nation-state activity alerts increased against critical infrastructure from 20% to 40% from 2021 to 2022, according to a recent Microsoft Digital Defense Report. With the advent of the hybrid war in Ukraine, nation-state actors are launching increasingly sophisticated attacks. But is this the most prominent danger facing companies today? While nation-state-based attacks cannot be ignored, it looks like insider cyber incidents are far more common. In fact, for the…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today