Custom Tools Targeting ICS/SCADA Devices

Threat Type:: N/A
TLP:: CLEAR
CVE:: CVE-2020-15368

Overview

Advanced Persistent Threat (APT) actors have developed custom tools targeting Industrial Control System (ICS)/Supervisory Control and Data Acquisition (SCADA) devices. These tools can scan devices, upload malicious configurations or code, back up or restore contents, and modify device parameters. The advisory also describes efforts to exploit CVE-2020-15368 in the ASRock motherboard driver “AsrDrv103.sys” to execute malicious code in the Windows kernel and support lateral movement and disruption of critical devices or functions.

Affected Technologies

Schneider Electric programmable logic controllers (PLCs)
OMRON Sysmac NEX PLCs
Open Platform Communications Unified Architecture (OPC UA) servers
ASRock motherboard driver — AsrDrv103.sys

Mitigation and Immediate Actions

01
Isolate ICS/SCADA systems and networks from corporate and internet networks using strong perimeter controls and limit any communications entering or leaving ICS/SCADA perimeters.
02
Enforce MFA for all remote access to ICS networks and devices whenever possible.
03
Change all passwords to ICS/SCADA devices and systems on a consistent schedule, especially all default passwords, to device-unique strong passwords to mitigate password brute force attacks and to give defender monitoring systems opportunities to detect common attacks.
04
Leverage a properly installed continuous OT monitoring solution to log and alert on malicious indicators and behaviors.
05
Enforce the principle of least privilege.
06
Monitor systems for loading of unusual drivers, especially for ASRock driver if no ASRock driver is normally used on the system.
07
Limit ICS/SCADA systems’ network connections to only specifically allowed management and engineering workstations.

References

Impacted Sectors

Energy
Critical Industry