27 March 2019
Threat landscape for industrial automation systems. H2 2018Main events of the six-month period, vulnerabilities identified in 2018, relevant threats, and statistics from ICS computers protected by Kaspersky products.
Filter
24 January 2019
GreyEnergy’s overlap with ZebrocyZebrocy is the name given to a subset of the Sofacy group (aka Fancy Bear, Sednit, APT28, Tsar Team, etc.). GreyEnergy and Zebrocy used the same servers at the same time and attacked the same organization.
22 January 2019
Security research: ThingsPro Suite – IIoT gateway and device manager by MoxaThe security of products such as IIoT requires special attention. This time, the subject of our research was the ThingsPro Suite, an IIoT gateway and device manager from Moxa.
17 January 2019
Challenges of industrial cybersecurityFactors that have a significant effect, now and going forward, on the threat landscape, on the development, implementation, and use of organizational and technical measures to protect industrial facilities, and the main issues associated with ensuring the cybersecurity of industrial enterprises.
20 September 2018
Threats posed by using RATs in ICSThe paper provides an analysis of the prevalence of remote administration tools on OT networks and the threats associated with their use.
06 September 2018
Threat landscape for industrial automation systems: H1 2018In this report, Kaspersky Lab Industrial Control Systems Cyber Emergency Response Team (Kaspersky Lab ICS CERT) publishes the findings of its research on the threat landscape for industrial automation systems conducted during the first half of 2018.
01 August 2018
Attacks on industrial enterprises using RMS and TeamViewerThe malware used in these attacks installs legitimate remote administration software – TeamViewer or RMS – on the system. This enables the attackers to gain remote control of infected systems.
28 June 2018
The State of Industrial Cybersecurity 2018: findings of joint survey by Kaspersky Lab and PACKaspersky Lab has published the results of The State of Industrial Cybersecurity study carried out in collaboration with PAC, a CXP Group Company, and based on a survey of 320 professionals representing companies from such sectors as manufacturing and industrial production, energy, mining, transport, and logistics.
10 May 2018
OPC UA security analysisThis paper discusses our project that involved searching for vulnerabilities in implementations of the OPC UA protocol. In publishing this material, we hope to draw the attention of vendors that develop software for industrial automation systems and the industrial internet of things to problems associated with using such widely available technologies, which turned out to be quite common.
23 April 2018
Energetic Bear / Crouching Yeti: attacks on serversThis report by Kaspersky Lab ICS CERT presents information on identified servers that have been infected and used by the group. The report also includes the findings of an analysis of several webservers compromised by the Energetic Bear group during 2016 and in early 2017.
Filter
05 June 2018
Critical vulnerability in Yokogawa STARDOM controllersHardcoded credentials have been identified in Yokogawa STARDOM controllers, potentially leading to remote execution of arbitrary code on affected devices
29 May 2018
Multiple vulnerabilities in Schneider Electric Floating License ManagerDangerous vulnerabilities have been identified in the Schneider Electric Floating License Manager platform.
28 May 2018
VPNFilter malware can be used to detect SCADA equipmentCisco Talos researchers have detected new malware, which has been dubbed VPNFilter. To date, the malware has infected at least 500,000 routers and network-attached storage (NAS) devices in 54 countries of the world.
28 May 2018
Serious vulnerabilities in TELEM-GW6/GWM data concentratorsVulnerabilities in Martem TELEM-GW6/GWM data concentrators could enable remote attackers to gain control of the industrial process, cause denial of service and execute arbitrary code
23 May 2018
Serious vulnerability fixed in PACSystems industrial controllersA serious improper data validation vulnerability has been closed in some models of PACSystems industrial controllers. Exploitation of the vulnerability could cause affected devices to malfunction
23 May 2018
Dangerous vulnerabilities identified in FL SWITCH industrial Ethernet switchesCritical vulnerabilities have been identified in FL SWITCH series 3xxx, 4xxx and 48xxx industrial Ethernet switches. Updating the firmware of the switches to version 1.34 or higher is recommended to eliminate these vulnerabilities
22 May 2018
OPC Foundation Consortium comments on Kaspersky Lab’s OPC UA security analysis reportThe OPC Foundation has published an official response to Kaspersky Lab’s analysis
18 May 2018
DoS vulnerability in SIMATIC S7-400 controllersA hardware vulnerability in SIMATIC S7-400 CPUs could cause denial-of-service conditions of affected PLCs. Exploitation of the vulnerability does not require user interaction or any privileges
17 May 2018
Multiple vulnerabilities closed in Advantech WebAccessMultiple serious vulnerabilities have been closed in Advantech’s WebAccess SCADA/HMI solution. Their exploitation could lead to sensitive information disclosure, arbitrary code execution and file deletion.
26 April 2018
Vulnerabilities in Advantech WebAccess HMI DesignerDangerous vulnerabilities have been identified in Advantech WebAccess HMI Designer. Their exploitation could lead to remote code execution
Filter