Ethical Hacking News
Iran-linked IOCONTROL malware targets SCADA and Linux-based IoT platforms in Israel and the United States, highlighting the need for greater vigilance in securing industrial control systems.
The IOCONTROL malware is a custom-built threat actor targeting industrial control systems (ICS) and Linux-based IoT platforms in Israel and the United States. The malware has been linked to a new strain of malware designed specifically to attack ICS and SCADA devices, including IP cameras, routers, and programmable logic controllers. IOCONTROL is believed to be custom-built by the threat actor but its modular configuration makes it generic enough to run on various platforms from different vendors. The malware has been detected in a Gasboy fuel management system that was previously compromised by the hacking group Cyber Av3ngers. The end goal of the infection chain is to deploy a backdoor that's automatically executed every time the device restarts. IOCONTROL uses MQTT for communications, disguising malicious traffic and allowing it to evade detection when sending DNS requests in cleartext. The malware can transmit information about the device to the server, including hostname, current user, device name and model, timezone, firmware version, and location. IOCONTROL is a significant threat to ICS and SCADAhubs due to its adaptability and ability to disguise malicious traffic. The use of MQTT and Cloudflare's DNS-over-HTTPS service by the threat actors highlights the importance of staying up-to-date on the latest security protocols and best practices.
The cybersecurity landscape has witnessed numerous threats in recent years, but one particular menace stands out for its sophistication and far-reaching implications – the Iran-linked IOCONTROL malware. This custom-built threat actor has been linked to a new strain of malware designed specifically to target industrial control systems (ICS) and Linux-based IoT platforms in Israel and the United States.
According to OT cybersecurity company Claroty, the malware has been codenamed IOCONTROL, highlighting its ability to attack ICS and SCADA devices such as IP cameras, routers, programmable logic controllers (PLCs), human-machine interfaces (HMIs), firewalls, and other Linux-based IoT/OT platforms. The malware is believed to be custom-built by the threat actor, but its modular configuration makes it generic enough to run on a variety of platforms from different vendors.
The development marks IOCONTROL as the tenth malware family to specifically single out Industrial Control Systems (ICS) after Stuxnet, Havex, Industroyer (aka CrashOverride), Triton (aka Trisis), BlackEnergy2, Industroyer2, PIPEDREAM (aka INCONTROLLER), COSMICENERGY, and FrostyGoop (aka BUSTLEBERM) to date. Claroty analyzed a malware sample extracted from a Gasboy fuel management system that was previously compromised by the hacking group called Cyber Av3ngers, which has been linked to cyber attacks exploiting Unitronics PLCs to breach water systems.
The malware was embedded within Gasboy's Payment Terminal, otherwise called OrPT. This means that the threat actors, given their ability to control the payment terminal, also had the means to shut down fuel services and potentially steal credit card information from customers. The end goal of the infection chain is to deploy a backdoor that's automatically executed every time the device restarts.
A notable aspect of IOCONTROL is its use of MQTT, a messaging protocol widely used in IoT devices, for communications, thereby allowing the threat actors to disguise malicious traffic. What's more, command-and-control (C2) domains are resolved using Cloudflare's DNS-over-HTTPS (DoH) service. This approach, already adopted by Chinese and Russian nation-state groups, is significant, as it allows the malware to evade detection when sending DNS requests in cleartext.
Once a successful C2 connection is established, the malware transmits information about the device, namely hostname, current user, device name and model, timezone, firmware version, and location, to the server, after it awaits further commands for execution. This includes checks to ensure the malware is installed in the designated directory, execute arbitrary operating system commands, terminate the malware, and scan an IP range in a specific port.
"The malware communicates with a C2 over a secure MQTT channel and supports basic commands including arbitrary code execution, self-delete, port scan, and more," Claroty said. "This functionality is enough to control remote IoT devices and perform lateral movement if needed." The malware's ability to adapt to its environment and disguise malicious traffic makes it a formidable threat to ICS and SCADAhubs.
In recent years, there has been an increasing focus on the security of industrial control systems, as these systems have become increasingly interconnected with other networks. However, the IOCONTROL threat highlights the need for greater vigilance in this area, as even custom-built malware can pose significant risks to critical infrastructure. The use of MQTT and Cloudflare's DNS-over-HTTPS service by the threat actors underscores the importance of staying up-to-date on the latest security protocols and best practices.
In conclusion, the IOCONTROL malware represents a significant threat to industrial control systems and Linux-based IoT platforms in Israel and the United States. Its custom-built nature and use of sophisticated protocols make it a formidable opponent for cybersecurity professionals. As the threat landscape continues to evolve, it is essential that organizations prioritize their security posture and stay informed about emerging threats.
Related Information:
https://thehackernews.com/2024/12/iran-linked-iocontrol-malware-targets.html
Published: Fri Dec 13 07:39:36 2024 by llama3.2 3B Q4_K_M
