![](images/Logos/Tech%20Crunch.jpg)
TechCrunch+
25 May 2023
By
Carly
Page
Researchers uncover Russia-linked malware that could
immobilize electric grids
![](images/images_06_21_2023/pic2.jpg)
Image Credits: ArtisticPhoto (opens in a new
window) / Shutterstock
Security researchers have discovered new
industrial control system malware, dubbed “CosmicEnergy,” which they
say could be used to disrupt critical infrastructure systems and
electric grids.
The malware was uncovered by researchers at Mandiant, who have
likened CosmicEnergy’s capabilities to the destructive Industroyer
malware that the Russian state-backed “Sandworm” hacking group used
to cut power in Ukraine in 2016.
Unusually, Mandiant says it uncovered CosmicEnergy through threat
hunting and not following a cyberattack on critical infrastructure.
The malware was uploaded to VirusTotal, a Google-owned malware and
virus scanner, in December 2021 by a submitter based in Russia,
according to Mandiant. The cybersecurity company’s analysis shows
that the malware may have been developed by Rostelecom-Solar, the
cybersecurity arm of Russia’s national telecom operator Rostelecom,
to support exercises such as the ones hosted in collaboration with
the Russian Ministry of Energy in 2021.
“A contractor may have developed it as a red-teaming tool for
simulated power disruption exercises hosted by Rostelecom-Solar,”
Mandiant said. “However, given the lack of conclusive evidence, we
consider it also possible that a different actor — either with or
without permission — reused code associated with the cyber range to
develop this malware.”
Mandiant says that not only do hackers regularly adapt and make use
of red-team tools to facilitate real-world attacks, but its analysis
of CosmicEnergy reveals that the malware’s functionality is also
comparable to that of other malware variants targeting industrial
control systems (ICS), such as Industroyer, thus posing a “plausible
threat to affected electric grid assets.”
Mandiant tells TechCrunch that it has not observed any CosmicEnergy
attacks in the wild and notes that the malware lacks discovery
capabilities, which means hackers would need to perform some
internal reconnaissance to obtain environment information, such as
IP addresses and credentials, before launching an attack.
However, the researchers added that because the malware targets the
IEC-104, a network protocol commonly used in industrial environments
that was also targeted during the 2016 attack on Ukraine’s power
grid, CosmicEnergy poses a real threat to organizations involved in
electricity transmission and distribution.
“The discovery of new OT [operational technology] malware presents
an immediate threat to affected organizations since these
discoveries are rare and because the malware principally takes
advantage of insecure by-design features of OT environments that are
unlikely to be remedied any time soon,” Mandiant researchers warned.
Mandiant’s discovery of new ICS-oriented malware comes after
Microsoft revealed this week that Chinese state-backed hackers had
hacked into American critical infrastructure. According to the
report, an espionage group that Microsoft refers to as “Volt
Typhoon” has targeted the U.S. island territory of Guam and could be
attempting to “disrupt critical communications infrastructure
between the United States and Asia region during future crises.”
In light of the report, the U.S. government said it was working with
its Five Eyes partners to identify potential breaches. Microsoft
says the group has attempted to access organizations in the
communications, manufacturing, utility, transportation,
construction, maritime, government, information technology and
education sectors.
Green Play Ammonia™, Yielder® NFuel Energy.
Spokane, Washington. 99212
509 995 1879 Cell,
Pacific Time Zone.
General office: 509-254
6854
4501 East Trent Ave.
Spokane, WA 99212
|