Cyber Attacks Against Energy and Utility Firms Begin Inside Enterprise It Networks

Hackers obtain administrative credentials for reconnaissance first

New research from Vectra has revealed that while industrial control systems are being targeted by hackers, most cyberattacks against energy and utility firms occur inside enterprise IT networks.

The research was published in the firm's 2018 Spotlight on Energy and Utilities highlighting the importance of detecting hidden threat behaviors inside enterprise IT networks before attackers have a chance to spy, spread and steal. These threat behaviors also show that carefully orchestrated attack campaigns generally occur over many months.

Cybercriminals have been launching carefully orchestrated attack campaigns against energy and utility networks for years. These quiet reconnaissance missions often last several months and involve observing operator behaviors and building a unique plan of attack.

Gaining access to the network

American Municipal Power's CIO, Brandon Kelley offered further insight on how attackers target industrial control systems, saying:

“When attackers move laterally inside a network, it exposes a larger attack surface that increases the risk of data acquisition and exfiltration. It’s imperative to monitor all network traffic to detect these and other attacker behaviors early and consistently.”

Remote attackers are able to gain a foothold in energy and utility networks by staging malware and spear-phishing campaigns to steal administrative credentials. Once inside, they utilize administrative connections and protocols to carry out reconnaissance and spread laterally searching for confidential data about industrial control systems.

Managing Research Director of Enterprise Management Associates, David Monaham explained how misuse of administrative credentials is a serious threat that businesses need to be more aware of, saying:

“The covert abuse of administrative credentials provides attackers with unconstrained access to critical infrastructure systems and data. This is one of the most crucial risk areas in the cyberattack lifecycle.”


SOURCE: