Western energy companies facing sabotage threat

1 July 2014 (Last Updated July 1st, 2014 18:30)

A US online security group, Symantec, has uncovered a cybercrime operation by hackers posing a potential sabotage threat to power plant operations in Europe and US.

A US online security group, Symantec, has uncovered a cybercrime operation by hackers posing a potential sabotage threat to power plant operations in Europe and US.

A cyber-espionage campaign has been launched by a hacking group called Energetic Bear, also known as Dragonfly, against energy firms and the control systems that power the electric grid and other key industrial businesses.

With early indications suggesting origination in eastern Asia, the attackers have the potential to mount sabotage operations against their victims, Symantec said in a report.

According to the report, hackers have managed to compromise several strategically vital organisations for intelligence purposes while, if they had deployed the sabotage capabilities open to them, it could have harmed or disrupted energy supplies in affected nations.

Energy grid operators, major electricity generation firms, petroleum pipeline operators and energy industry industrial equipment providers in the US, Spain, France, Italy, Germany, Turkey and Poland were mainly targeted by the hackers.

"The hacker's most determined attack campaign was compromising a number of industrial control system equipment providers."

The Dragonfly group is well resourced, with a range of malware tools at its disposal and is capable of launching attacks through a number of different vectors, Symantec said in its report.

The hacker's most determined attack campaign was compromising a number of industrial control system (ICS) equipment providers, infecting their software with a remote access-type Trojan.

The campaign allows the companies to install the malware when downloading software updates for computers running ICS equipment.

In addition to providing beachhead in the targeted organizations' networks, the infections gave the attackers the means to mount sabotage operations against infected ICS computers.

The latest campaign comes hot on the heels of Stuxnet, which was the first known major malware campaign targeted at ICS systems.

In addition to taking down ICS software, hackers also used spam email campaigns and watering hole attacks to attack targeted organisations using two main malware tools including Backdoor.Oldrea and Trojan.Karagany.

Energy