US Fed warns of state hackers targeting industrial control systems

From Tech HQ.com (April 14, 2022):

Industrial control systems (ICS) are essential for the steady functioning of critical infrastructures such as the energy and water grid or the manufacturing sector. Therefore, when an attack is launched on ICS, the consequences are often far-reaching, just like then a ransomware attack targeted Colonial Pipeline Inc. in the US mid-last year.

That attack brought the entire facility to a complete halt for a few days which then inevitably caused an acute fuel shortage, while prices soared through the roof. It is unfortunate though that threat actors are increasingly shifting their focus from information technology (IT) to what ICS is often referred to as operational technology (OT).

This puts the critical industrial infrastructure owned by the state and private entities at high risk of destructive cyberattacks that can cause severe economic damage. Predictably, governments across the world can only urge private entities to toughen their critical infrastructure defenses—while taking steps to improve national cyberspace security.

Hence why in the US, the Department of Energy (DOE) alongside the Cybersecurity and Infrastructure Security Agency (CISA), the National Security Agency (NSA), and the Federal Bureau of Investigation (FBI) released a joint Cybersecurity Advisory (CSA) yesterday to warn critical infrastructure owners of a tool developed by hackers to target ICS like power grids and oil refineries.

“DOE, CISA, NSA, and the FBI warn that certain advanced persistent threat (APT) actors have exhibited the capability to gain full system access to multiple ICS/supervisory control and data acquisition (SCADA) devices,” the statement reads.

The tools, according to the officials, enable the threat actors to scan for, compromise, and control affected devices once they have established initial access to the OT network. “Additionally, the actors can compromise Windows-based engineering workstations, which may be present in information technology (IT) or OT environments, using an exploit that compromises an ASRock motherboard driver with known vulnerabilities,” they said.

By compromising and maintaining full system access to ICS/SCADA devices, DOE, CISA, NSA, and the FBI said APT actors could elevate privileges, move laterally within an OT environment, and disrupt critical devices or functions. Therefore, the CSA urges critical infrastructure organizations, especially energy sector organizations, to implement the detection and mitigation recommendations provided to detect potential malicious APT activity and harden their ICS/SCADA devices. [source]

Not good. Would one these state hackers be China by chance? Or even Russia?