NCSC-TAD--2204-005
الرقم المرجعي: NCSC-TAD--2204-005CVSS 0
Custom Tools Targeting ICS/SCADA Devices
- نوع التهديد:
- غير متوفر
- مستوى المشاركة (TLP):
- CLEAR
- CVE:
- CVE-2020-15368
نظرة عامة
Advanced Persistent Threat (APT) actors have developed custom tools targeting Industrial Control System (ICS)/Supervisory Control and Data Acquisition (SCADA) devices. These tools can scan devices, upload malicious configurations or code, back up or restore contents, and modify device parameters. The advisory also describes efforts to exploit CVE-2020-15368 in the ASRock motherboard driver “AsrDrv103.sys” to execute malicious code in the Windows kernel and support lateral movement and disruption of critical devices or functions.
التقنيات المتأثرة
- Schneider Electric programmable logic controllers (PLCs)
- OMRON Sysmac NEX PLCs
- Open Platform Communications Unified Architecture (OPC UA) servers
- ASRock motherboard driver — AsrDrv103.sys
إجراءات الحد من المخاطر والإجراءات الفورية
- 01
Isolate ICS/SCADA systems and networks from corporate and internet networks using strong perimeter controls and limit any communications entering or leaving ICS/SCADA perimeters.
- 02
Enforce MFA for all remote access to ICS networks and devices whenever possible.
- 03
Change all passwords to ICS/SCADA devices and systems on a consistent schedule, especially all default passwords, to device-unique strong passwords to mitigate password brute force attacks and to give defender monitoring systems opportunities to detect common attacks.
- 04
Leverage a properly installed continuous OT monitoring solution to log and alert on malicious indicators and behaviors.
- 05
Enforce the principle of least privilege.
- 06
Monitor systems for loading of unusual drivers, especially for ASRock driver if no ASRock driver is normally used on the system.
- 07
Limit ICS/SCADA systems’ network connections to only specifically allowed management and engineering workstations.
المراجع
- DOE, CISA, NSA, FBI. (2022, April 13). APT Cyber Tools Targeting ICS/SCADA Devices. Retrieved from Joint Cybersecurity Advisory(يفتح في علامة تبويب جديدة)
- McKeon, J. (2022, April 15). CISA, FBI Warn of APT Cyber Tools Affecting ICS/SCADA Devices. Retrieved from Health IT Security(يفتح في علامة تبويب جديدة)
القطاعات المتأثرة
- الطاقة
- الصناعات الحيوية